Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Horse Cryptic.cvd on Vista.


  • Please log in to reply
9 replies to this topic

#1 jaz1240

jaz1240

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:17 AM

Posted 17 July 2011 - 10:42 AM

Hello,

i am pretty sure i am infected with a trojan.
recently i had...
Google searches redirected
error message:Data Execution prevention has closed internet explorer
iexplore.exe opens twice by itself and uses a lot of memory and cpu over and over, after i "end process".
file location- C:\Program Files\Internet Explorer
AVG scan has found;"C:\Windows\explorer.exe (4092)";"Trojan horse Cryptic.CVD";"Deleted"
;"C:\Windows\explorer.exe (4092):\memory_00020000";"Trojan horse Cryptic.CVD";"Infected"
No sound from internet explorer.
many files suddenly are "hidden"

Running Vista service pack 2, 32 bit.

any help someone can offer would be greatly appreciated!!
i have been working at this for a couple of weeks, but no luck.
thanks in advance

Edited by hamluis, 17 July 2011 - 12:11 PM.
No logs, moved from MRL to AII.


BC AdBot (Login to Remove)

 


#2 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:04:17 AM

Posted 23 July 2011 - 01:30 PM

Hi jaz1240,

:welcome: to BleepingComputer.
We sincerely apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Do you still need help? If so, continue follow these instructions:

My name is Jason and I'll be helping you with your computer problems. You can call me by my screename jntkwx or Jason is fine.

Some things to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • Please do not attach logs or put logs in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can also help.
  • Do not run anything while running a fix.
  • If you don't understand a step, please ask for clarification before continuing with any future steps.

Click on the Watch Topic button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

:step1: Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt.
  • Please post the contents of that document.

:step2: Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer log
  • List Users, Partitions and Memory size
Click Go and post the result.

:step3: Let's try rebooting into Safe Mode.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu with several options. Press the down arrow key on your keyboard until Safe Mode with Networking is selected. Press Enter. Please see here for additional details.

:step4: Once in Safe Mode with Networking, download Rkill

Run Rkill (renamed iExplore.exe).

Please be patient while Rkill looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If it appears like Rkill did not stop the malware from running, please try running RKill again until the malware is no longer running.

If you are unable to download or run rkill from the main download, try these alternate download locations:

1. http://download.bleepingcomputer.com/grinler/rkill.com
2. http://download.bleepingcomputer.com/grinler/rkill.pif
3. http://download.bleepingcomputer.com/grinler/rkill.scr
4. http://download.bleepingcomputer.com/grinler/eXplorer.exe
5. http://download.bleepingcomputer.com/grinler/iExplore.exe
6. http://download.bleepingcomputer.com/grinler/uSeRiNiT.exe
7. http://download.bleepingcomputer.com/grinler/WiNlOgOn.exe
8. http://www.boredomsoft.org/hosted/rkill.exe
9. http://www.boredomsoft.org/hosted/rkill.com
10. http://www.boredomsoft.org/hosted/rkill.scr
11. http://www.boredomsoft.org/hosted/eXplorer.exe
12. http://www.boredomsoft.org/hosted/iExplore.exe


Do not reboot your computer after running RKill as the malware programs will start again!

:step5: Still in Safe Mode with Networking, Please download Malwarebytes Anti-Malware and save it to your desktop.
Download Link 1
Download Link 2MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware


:step6: Reboot into Normal mode. Next run Superantisypware (SAS):

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from http://www.superantispyware.com/downloads/SASDEFINITIONS.EXE (copy and paste that website address) and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a USB drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.

:step7: Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

:step8:Download & Run Unhide
Unhide.exe
Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.


In your next reply, please include:
  • SecurityCheck's checkup.txt file
  • MiniToolbox's Result.txt file
  • Malwarebytes' log file
  • SuperAntiSpyware log file
  • GMER log file
  • How's the computer running now? Please include a detailed description of anything out of the ordinary, including any error messages.

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#3 jaz1240

jaz1240
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:17 AM

Posted 24 July 2011 - 03:02 PM

hi and thanks jason.

i have done what you requested, see below.
i am still having the same issues as before.


i am pretty sure i am infected with a trojan.
recently i had...
Google searches redirected
error message:Data Execution prevention has closed internet explorer
iexplore.exe opens twice by itself and uses a lot of memory and cpu over and over, after i "end process".
file location- C:\Program Files\Internet Explorer
AVG scan has found;"C:\Windows\explorer.exe (4092)";"Trojan horse Cryptic.CVD";"Deleted"
;"C:\Windows\explorer.exe (4092):\memory_00020000";"Trojan horse Cryptic.CVD";"Infected"
No sound from internet explorer.
many files suddenly are "hidden"


Results of screen317's Security Check version 0.99.17
Windows Vista Service Pack 2 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
AVG 2011
McAfee Security Scan Plus
McAfee SecurityCenter
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

SUPERAntiSpyware Free Edition
Java™ 6 Update 20
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player 10.2.152.26
````````````````````````````````
Process Check:
objlist.exe by Laurent

AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````




MiniToolBox by Farbar
Ran by Jeff (administrator) on 23-07-2011 at 15:16:02
Windows Vista ™ Home Premium Service Pack 2 (X86)

***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================

::1 localhost

127.0.0.1 localhost


========================= Event log errors: ===============================

Application errors:
==================
Error: (07/23/2011 02:50:05 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x0000671a,
process id 0x1758, application start time 0xiexplore.exe0.

Error: (07/23/2011 02:45:32 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2011 00:09:55 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module USER32.dll, version 6.0.6002.18005, time stamp 0x49e0380e, exception code 0xc0000409, fault offset 0x000119ae,
process id 0x1df4, application start time 0xiexplore.exe0.

Error: (07/23/2011 00:07:59 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0xf170fc85,
process id 0x1df4, application start time 0xiexplore.exe0.

Error: (07/23/2011 11:48:10 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module USER32.dll, version 6.0.6002.18005, time stamp 0x49e0380e, exception code 0xc0000409, fault offset 0x00015359,
process id 0x1a4c, application start time 0xiexplore.exe0.

Error: (07/23/2011 11:47:39 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module mshtml.dll, version 8.0.6001.19088, time stamp 0x4de090ed, exception code 0xc0000096, fault offset 0x000ffc80,
process id 0x1a4c, application start time 0xiexplore.exe0.

Error: (07/23/2011 11:45:42 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0xfc6c0000,
process id 0x1a4c, application start time 0xiexplore.exe0.

Error: (07/23/2011 11:34:55 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module msvcrt.dll, version 7.0.6002.18005, time stamp 0x49e0379e, exception code 0xc0000409, fault offset 0x00025085,
process id 0xb64, application start time 0xiexplore.exe0.

Error: (07/23/2011 11:31:36 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x1475ff20,
process id 0xb64, application start time 0xiexplore.exe0.

Error: (07/23/2011 11:21:42 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.19088, time stamp 0x4de07b1b, faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436, exception code 0xc0000409, fault offset 0x00039a1f,
process id 0x1d9c, application start time 0xiexplore.exe0.


System errors:
=============
Error: (07/23/2011 02:47:40 PM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2767

Error: (07/23/2011 02:47:40 PM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2767

Error: (07/23/2011 02:45:33 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (07/23/2011 02:45:33 PM) (Source: Service Control Manager) (User: )
Description: AnchorChips General Purpose USB Driver (ezusb.sys)%%1058

Error: (07/23/2011 00:12:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: SYSTEM)
Description: 0x80070643Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2478663){3967DD7D-E56B-464E-8B95-A3F360DD90E9}101

Error: (07/23/2011 00:12:27 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: SYSTEM)
Description: 0x80070643Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2518870){C38C111F-A9A8-4146-A678-C4121C18BF4A}101

Error: (07/23/2011 11:01:01 AM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2767

Error: (07/23/2011 11:01:00 AM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2767

Error: (07/23/2011 10:58:29 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (07/23/2011 10:58:29 AM) (Source: Service Control Manager) (User: )
Description: AnchorChips General Purpose USB Driver (ezusb.sys)%%1058


Microsoft Office Sessions:
=========================
Error: (06/15/2011 04:01:06 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2175 seconds with 1260 seconds of active time. This session ended with a crash.

Error: (05/11/2011 10:04:56 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash.

Error: (04/11/2011 04:33:48 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.

Error: (04/10/2011 07:15:56 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13 seconds with 0 seconds of active time. This session ended with a crash.

Error: (03/22/2011 07:15:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.

Error: (03/02/2011 11:46:11 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3116 seconds with 1920 seconds of active time. This session ended with a crash.

Error: (01/30/2011 00:28:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 288 seconds with 60 seconds of active time. This session ended with a crash.

Error: (01/30/2011 00:21:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3219 seconds with 240 seconds of active time. This session ended with a crash.

Error: (01/10/2011 10:53:47 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 27 seconds with 0 seconds of active time. This session ended with a crash.

Error: (12/09/2010 04:05:12 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6535.5002, Microsoft Office Version: 12.0.6425.1000. This session lasted 548 seconds with 420 seconds of active time. This session ended with a crash.


========================= Memory info: ===================================

Percentage of memory in use: 51%
Total physical RAM: 3061.68 MB
Available physical RAM: 1473.05 MB
Total Pagefile: 6343.63 MB
Available Pagefile: 4651.56 MB
Total Virtual: 2047.88 MB
Available Virtual: 1959.61 MB

========================= Partitions: =====================================

1 Drive c: (ACER) (Fixed) (Total:111.57 GB) (Free:14.92 GB) NTFS
2 Drive d: (DATA) (Fixed) (Total:111.55 GB) (Free:111.3 GB) NTFS

========================= Users: ========================================

User accounts for \\JEFF-PC

Administrator Guest Jeff

== End of log ==


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7255

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.19088

7/23/2011 3:50:12 PM
mbam-log-2011-07-23 (15-50-12).txt

Scan type: Quick scan
Objects scanned: 190348
Time elapsed: 7 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/23/2011 at 08:54 PM

Application Version : 4.52.1000

Core Rules Database Version : 7451
Trace Rules Database Version: 5263

Scan type : Complete Scan
Total Scan Time : 04:50:05

Memory items scanned : 808
Memory threats detected : 0
Registry items scanned : 9065
Registry threats detected : 0
File items scanned : 164998
File threats detected : 72

Adware.Tracking Cookie
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@serving-sys[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@content.yieldmanager[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@advertising[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@insightexpressai[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@pointroll[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@revsci[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@r1-ads.ace.advertising[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@citi.bridgetrack[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@yieldmanager[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@search.orfind[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@educationcom.112.2o7[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@mediabrandsww[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@doubleclick[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ads.pointroll[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@cdn.jemamedia[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@search.clicksthe[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ad.yieldmanager[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@search.findxml[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@invitemedia[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ads.undertone[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ru4[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@lucidmedia[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@realmedia[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@search.321findit[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ads.bridgetrack[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@xml.prostreammedia[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@adbrite[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@search.clicksare[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@pro-market[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@apmebf[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@zedo[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@media6degrees[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@questionmarket[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@adserver.adtechus[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@network.realmedia[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@dc.tremormedia[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@adxpose[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@mediaplex[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@collective-media[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@xml.trafficengine[1].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@viewablemedia[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@content.yieldmanager[3].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ads.pubmatic[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@imrworldwide[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@enhance[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@tribalfusion[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@fastclick[2].txt
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@atdmt[2].txt
adultfriendfinder.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
cdn1.static1.pornrabbit.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
files.youporn.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
media.mtvnservices.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
media1.break.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
media1.shufuni.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
s0.2mdn.net [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
secure-uk.imrworldwide.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
secure-us.imrworldwide.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
vidii.hardsextube.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
www.alphaporno.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
www.pornhub.com [ C:\Users\Jeff\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FDC32NDH ]
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ad.yieldmanager[2]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@adbrite[1]_txt_1310561014.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@advertising[2]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@atdmt[2]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@burstnet[1]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@questionmarket[1]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@realmedia[2]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@revsci[1]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@ru4[1]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@serving-sys[2]_txt_1310561015.arl
C:\Users\Jeff\AppData\Roaming\Microsoft\Windows\Cookies\jeff@tribalfusion[1]_txt_1310561015.arl

Trojan.Agent/Gen-PEC
C:\USERS\JEFF\APPDATA\LOCAL\TEMP\RARSFX0\PROCS\EXPLORER.EXE



GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-07-24 07:47:52
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 Hitachi_HTS542525K9SA00 rev.BBFOC31P
Running: gmer.exe; Driver: C:\Users\Jeff\AppData\Local\Temp\kgldypob.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xAAFEC7A0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xAAFEC848]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xAAFEC8E4]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xAAFEC980]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x90D049BE]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x90D04958]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x90D0496C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x90D04944]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x90D049D2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x90D049AA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x90D04996]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x90D04982]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 3F1 828FCB74 4 Bytes [A0, C7, FE, AA]
.text ntkrnlpa.exe!KeSetEvent + 621 828FCDA4 8 Bytes [48, C8, FE, AA, E4, C8, FE, ...]
.text ntkrnlpa.exe!KeSetEvent + 681 828FCE04 4 Bytes [80, C9, FE, AA] {OR CL, 0xfe; STOSB }
PAGE ntkrnlpa.exe!ZwCreateUserProcess 82A19BA6 5 Bytes JMP 90D04986 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtSetInformationProcess 82A64858 2 Bytes JMP 90D0499A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtSetInformationProcess + 3 82A6485B 2 Bytes [2A, 0E] {SUB CL, [ESI]}
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 82A6A28D 7 Bytes JMP 90D049D6 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenThread 82A6C4AA 5 Bytes JMP 90D04948 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 82A922EB 5 Bytes JMP 90D049C2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcess 82AE1D63 5 Bytes JMP 90D0495C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 82AE1DAE 7 Bytes JMP 90D04970 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwSetContextThread 82AE2867 5 Bytes JMP 90D049AE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
init C:\Windows\System32\Drivers\driverx.sys entry point in "init" section [0xAAFF771E]

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\Explorer.EXE[2200] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C5 757EB37C 4 Bytes [F0, 1F, 00, 10]
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2756] kernel32.dll!LoadLibraryW 75019400 5 Bytes JMP 0041C3C0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2756] kernel32.dll!LoadLibraryA 7501957C 5 Bytes JMP 0041C340 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!CreateWindowExW 75231305 5 Bytes JMP 6B43DB04 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!DialogBoxParamW 752510B0 5 Bytes JMP 6B3654C5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!DialogBoxIndirectParamW 75252EF5 5 Bytes JMP 6B535329 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!DialogBoxParamA 75268152 5 Bytes JMP 6B5352C6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!DialogBoxIndirectParamA 7526847D 5 Bytes JMP 6B53538C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!MessageBoxIndirectA 7527D4D9 5 Bytes JMP 6B53525B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!MessageBoxIndirectW 7527D5D3 5 Bytes JMP 6B5351F0 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!MessageBoxExA 7527D639 5 Bytes JMP 6B53518E C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] USER32.dll!MessageBoxExW 7527D65D 5 Bytes JMP 6B53512C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] WININET.dll!HttpAddRequestHeadersA 7543CF4E 5 Bytes JMP 008C6811
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] WININET.dll!HttpAddRequestHeadersW 7543FE49 5 Bytes JMP 008C6A1C
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] ws2_32.dll!closesocket 769B330C 5 Bytes JMP 0178000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] ws2_32.dll!recv 769B343A 5 Bytes JMP 0176000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] ws2_32.dll!connect 769B40D9 5 Bytes JMP 0177000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] ws2_32.dll!getaddrinfo 769B418A 5 Bytes JMP 018B000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] ws2_32.dll!send 769B659B 5 Bytes JMP 0179000A
.text C:\Program Files\Internet Explorer\iexplore.exe[4796] ws2_32.dll!gethostbyname 769C62D4 5 Bytes JMP 018A000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!SetWindowsHookExW 752287AD 5 Bytes JMP 6B439A91 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!CallNextHookEx 75228E3B 5 Bytes JMP 6B42D0CD C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!UnhookWindowsHookEx 752298DB 5 Bytes JMP 6B3A466E C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!CreateWindowExW 75231305 5 Bytes JMP 6B43DB04 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!DialogBoxParamW 752510B0 5 Bytes JMP 6B3654C5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!DialogBoxIndirectParamW 75252EF5 5 Bytes JMP 6B535329 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!DialogBoxParamA 75268152 5 Bytes JMP 6B5352C6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!DialogBoxIndirectParamA 7526847D 5 Bytes JMP 6B53538C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!MessageBoxIndirectA 7527D4D9 5 Bytes JMP 6B53525B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!MessageBoxIndirectW 7527D5D3 5 Bytes JMP 6B5351F0 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!MessageBoxExA 7527D639 5 Bytes JMP 6B53518E C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] USER32.dll!MessageBoxExW 7527D65D 5 Bytes JMP 6B53512C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] ole32.dll!OleLoadFromStream 750F1E80 5 Bytes JMP 6B535691 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] ole32.dll!CoCreateInstance 75129F3E 5 Bytes JMP 6B43DB60 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WININET.dll!HttpAddRequestHeadersA 7543CF4E 5 Bytes JMP 009E6811
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WININET.dll!HttpAddRequestHeadersW 7543FE49 5 Bytes JMP 009E6A1C
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WS2_32.dll!closesocket 769B330C 5 Bytes JMP 0178000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WS2_32.dll!recv 769B343A 5 Bytes JMP 0176000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WS2_32.dll!connect 769B40D9 5 Bytes JMP 0177000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WS2_32.dll!getaddrinfo 769B418A 5 Bytes JMP 017B000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WS2_32.dll!send 769B659B 5 Bytes JMP 0179000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5440] WS2_32.dll!gethostbyname 769C62D4 5 Bytes JMP 017A000A

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [733E7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7343A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [733EBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [733DF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [733E75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [733DE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [73418395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [733EDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [733DFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [733DFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [733D71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7346CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7340C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [733DD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [733D6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [733D687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [733E2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [10002300] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [10001B30] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [10002690] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Windows\Explorer.EXE[2200] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [10001290] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)

---- Threads - GMER 1.0.15 ----

Thread System [4:240] 86960E7A
Thread System [4:244] 86963008

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_2_for_KB981852~31bf3856ad364e35~x86~~6.0.1.2@Install\0imeHigh 30096142
Reg HKLM\SOFTWARE\Classes\CLSID\{5A90F5EE-16B8-4c2a-81B3-FD5329BA4780}\LocalSe
Reg HKLM\SOFTWARE\Classes\CLSID\{5A90F5EE-16B8-4c2a-81B3-FD5329BA4780}\LocalSe@ "C:\Program Files\McAfee\SiteAdvisor\McSACore.exe"
Reg HKLM\SOFTWARE\Classes\CLSID\{5A90F5EE-16B8-4c2a-81B3-FD5329BA4780}\VersionIndepend
Reg HKLM\SOFTWARE\Classes\CLSID\{5A90F5EE-16B8-4c2a-81B3-FD5329BA4780}\VersionIndepend@ SASettings.SASettings
Reg HKLM\SOFTWARE\Classes\Interface\{BD080184-0DDD-411C-99EE-ED60F4
Reg HKLM\SOFTWARE\Classes\Interface\{BD080184-0DDD-411C-99EE-ED60F4@ IMcSASettings_ReadOnly
Reg HKLM\SOFTWARE\Classes\Interface\{BD080184-0DDD-411C-99EE-ED60F4\NumMethods
Reg HKLM\SOFTWARE\Classes\Interface\{BD080184-0DDD-411C-99EE-ED60F4\NumMethods@ 6
Reg HKLM\SOFTWARE\Classes\Interface\{BD080184-0DDD-411C-99EE-ED60F4\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{BD080184-0DDD-411C-99EE-ED60F4\ProxyStubClsid32@ {0CB58125-ED4E-4125-B72E-BA3435AC4421}
Reg HKLM\SOFTWARE\Classes\McSACore.McSACore\CLSID@ {5A90F5EE-16B8-4c2a-81B3-FD5329BA477C}

---- Files - GMER 1.0.15 ----

File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A6.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A7.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A8.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A9.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166AA.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166AB.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166AC.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166AD.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166AE.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166AF.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B0.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B1.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B2.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B3.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B4.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B5.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B6.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B7.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B8.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166B9.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166BA.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166BB.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166BC.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166BD.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166BE.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166BF.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166C0.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166C1.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS16699.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS1669A.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS1669B.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS1669C.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS1669D.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS1669E.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS1669F.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A0.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A1.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A2.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A3.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A4.log 131072 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS166A5.log 131072 bytes

---- EOF - GMER 1.0.15 ----

#4 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:04:17 AM

Posted 24 July 2011 - 05:48 PM

Hi jaz1240,

:step1: I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:
1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.
Therefore please go to add/remove in the control panel and remove either AVG or McAfee.

:step2: Rerun Malwarebytes
Still in Safe Mode with Networking, open Malwarebytes, click on the Update tab, and click the check for Updates button.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

If you have trouble updating, troubleshoot Malwarebytes' Anti-Malware

:step3: I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image
      icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.

:step4: As this infection is known to be bundled with the TDSS rootkit infection, you should also run a program that can be used to scan for this infection. Please carefully follow the steps in the following guide:

How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller Please download a new version of TDSSKiller, as it is updated often.

If after running TDSSKiller, you are still unable to update Malwarebytes' Anti-malware or continue to have Google search result redirects, then you should post a virus removal request using the steps in the following topic rather than continuing with this here (please let me know if this is the case):

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help Topic

:step5: We need to run SFC Scan now.

We will need to open up an elevated command prompt. This can be down by clicking on Start > All Programs > Accessories, right click on Command Prompt, and then click on Run as Administrator.

You will need to click Allow.

Type the following command below, and then press ENTER:

sfc /scannow

The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.


In your next reply, please include:
  • Malwarebytes' log file
  • ESET log file
  • TDSSkiller log file (located at C:\)
  • How's your computer running now?

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#5 jaz1240

jaz1240
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:17 AM

Posted 27 July 2011 - 09:34 AM

hello and thanks again.
i have posted the log files
the iexplore DOES NOT open up in my processes any more since i followed your last instructions.
my google searches have redirected in about only 1 of 10 times. it was previously redirecting 10 of 10. i was redirected to 'yellow pages' website.

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7270

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19088

7/25/2011 5:19:30 PM
mbam-log-2011-07-25 (17-19-30).txt

Scan type: Quick scan
Objects scanned: 182532
Time elapsed: 7 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\5a3cbc80-1ca093c9 multiple threats deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\a9f2e82-4f2dcaa3_1310561014.arl multiple threats deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\ac8c29b-6b7672ba multiple threats deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2cc07e61-147b41d8 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2cc07e61-1977db39 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2cc07e61-34124dc7 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2cc07e61-3eb9e511 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2cc07e61-477931cb a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\2cc07e61-5e0deaf3 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\68eab3ab-6843cca4 multiple threats deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\51d1c3f7-794b1e0e a variant of Java/TrojanDownloader.OpenStream.NCE trojan deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\691d9f39-34fcdc32_1310561014.arl Java/TrojanDownloader.Agent.NCM trojan deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\6622747b-7c3e188c_1310561014.arl multiple threats deleted - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\60d9c47e-3e23e9fa a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Users\Jeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\60d9c47e-6c442649 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined

2011/07/25 17:02:25.0209 3372 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/25 17:02:27.0078 3372 ================================================================================
2011/07/25 17:02:27.0078 3372 SystemInfo:
2011/07/25 17:02:27.0078 3372
2011/07/25 17:02:27.0079 3372 OS Version: 6.0.6002 ServicePack: 2.0
2011/07/25 17:02:27.0079 3372 Product type: Workstation
2011/07/25 17:02:27.0079 3372 ComputerName: JEFF-PC
2011/07/25 17:02:27.0080 3372 UserName: Jeff
2011/07/25 17:02:27.0080 3372 Windows directory: C:\Windows
2011/07/25 17:02:27.0080 3372 System windows directory: C:\Windows
2011/07/25 17:02:27.0080 3372 Processor architecture: Intel x86
2011/07/25 17:02:27.0080 3372 Number of processors: 2
2011/07/25 17:02:27.0080 3372 Page size: 0x1000
2011/07/25 17:02:27.0080 3372 Boot type: Normal boot
2011/07/25 17:02:27.0080 3372 ================================================================================
2011/07/25 17:02:29.0025 3372 Initialize success
2011/07/25 17:02:45.0932 0512 ================================================================================
2011/07/25 17:02:45.0932 0512 Scan started
2011/07/25 17:02:45.0932 0512 Mode: Manual;
2011/07/25 17:02:45.0932 0512 ================================================================================
2011/07/25 17:02:48.0331 0512 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/07/25 17:02:48.0703 0512 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/07/25 17:02:49.0370 0512 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/07/25 17:02:49.0646 0512 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/07/25 17:02:50.0035 0512 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/07/25 17:02:50.0458 0512 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
2011/07/25 17:02:51.0048 0512 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/07/25 17:02:51.0354 0512 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/07/25 17:02:51.0667 0512 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/07/25 17:02:51.0989 0512 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/07/25 17:02:52.0754 0512 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/07/25 17:02:53.0268 0512 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/07/25 17:02:53.0523 0512 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/07/25 17:02:53.0793 0512 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/07/25 17:02:54.0184 0512 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/07/25 17:02:54.0473 0512 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/07/25 17:02:54.0744 0512 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/07/25 17:02:55.0051 0512 athr (2846f5ee802889d500fcf5cc48b28381) C:\Windows\system32\DRIVERS\athr.sys
2011/07/25 17:02:55.0507 0512 AVGIDSDriver (97824e8c95d9717777abd46a7b632310) C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys
2011/07/25 17:02:55.0870 0512 AVGIDSEH (c59c9bc3f0612bd207ccdc5d8cb9ce39) C:\Windows\system32\DRIVERS\AVGIDSEH.Sys
2011/07/25 17:02:56.0405 0512 AVGIDSFilter (c5559de2ec66cede15a1664f6d183d8e) C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys
2011/07/25 17:02:56.0863 0512 AVGIDSShim (ae5e9667fa40206796d1bd5bd0427a8a) C:\Windows\system32\DRIVERS\AVGIDSShim.Sys
2011/07/25 17:02:57.0168 0512 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\Windows\system32\DRIVERS\avgldx86.sys
2011/07/25 17:02:57.0637 0512 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\Windows\system32\DRIVERS\avgmfx86.sys
2011/07/25 17:02:57.0843 0512 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\Windows\system32\DRIVERS\avgrkx86.sys
2011/07/25 17:02:58.0085 0512 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\Windows\system32\DRIVERS\avgtdix.sys
2011/07/25 17:02:58.0496 0512 b57nd60x (aa6b367ca7da571dfc3374ec137d87a5) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/07/25 17:02:58.0751 0512 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/07/25 17:02:59.0031 0512 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/07/25 17:02:59.0350 0512 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
2011/07/25 17:02:59.0683 0512 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/07/25 17:02:59.0919 0512 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/07/25 17:03:00.0173 0512 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/07/25 17:03:00.0418 0512 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/07/25 17:03:00.0658 0512 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/07/25 17:03:00.0974 0512 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/07/25 17:03:01.0188 0512 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/07/25 17:03:01.0353 0512 Cam5607 (4b999349156c3e203e0728aca4274359) C:\Windows\system32\Drivers\BisonC07.sys
2011/07/25 17:03:01.0627 0512 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/07/25 17:03:01.0889 0512 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/07/25 17:03:02.0162 0512 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/07/25 17:03:02.0276 0512 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/07/25 17:03:02.0577 0512 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/07/25 17:03:02.0895 0512 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/07/25 17:03:03.0146 0512 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/07/25 17:03:03.0553 0512 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/07/25 17:03:03.0927 0512 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/07/25 17:03:04.0370 0512 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
2011/07/25 17:03:04.0666 0512 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/07/25 17:03:04.0995 0512 DKbFltr (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys
2011/07/25 17:03:05.0454 0512 DriverX (7ce858a0a41c3db941a93f36059a2b4f) C:\Windows\System32\Drivers\driverx.sys
2011/07/25 17:03:05.0679 0512 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/07/25 17:03:05.0924 0512 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
2011/07/25 17:03:06.0307 0512 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/07/25 17:03:06.0675 0512 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/07/25 17:03:07.0231 0512 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/07/25 17:03:07.0558 0512 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/07/25 17:03:07.0912 0512 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/07/25 17:03:08.0308 0512 EZUSB (0d58fe0b853a1fd3d626f5118ce79f8f) C:\Windows\system32\Drivers\ezusb.sys
2011/07/25 17:03:09.0270 0512 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/07/25 17:03:09.0696 0512 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/07/25 17:03:10.0385 0512 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/07/25 17:03:10.0889 0512 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/07/25 17:03:11.0158 0512 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/07/25 17:03:11.0480 0512 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/07/25 17:03:11.0812 0512 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/07/25 17:03:12.0079 0512 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/07/25 17:03:12.0358 0512 grmnusb (6003bc70f1a8307262bd3c941bda0b7e) C:\Windows\system32\drivers\grmnusb.sys
2011/07/25 17:03:12.0748 0512 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/07/25 17:03:13.0189 0512 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/07/25 17:03:13.0445 0512 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/07/25 17:03:13.0753 0512 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/07/25 17:03:14.0122 0512 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/07/25 17:03:14.0353 0512 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/07/25 17:03:14.0930 0512 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/07/25 17:03:15.0616 0512 HSF_DPV (7bc42c65b5c6281777c1a7605b253ba8) C:\Windows\system32\DRIVERS\HSX_DPV.sys
2011/07/25 17:03:15.0876 0512 HSXHWAZL (9ebf2d102ccbb6bcdfbf1b7922f8ba2e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
2011/07/25 17:03:16.0233 0512 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/07/25 17:03:16.0488 0512 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/07/25 17:03:16.0731 0512 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/07/25 17:03:16.0861 0512 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:\Windows\system32\DRIVERS\iaStor.sys
2011/07/25 17:03:17.0226 0512 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/07/25 17:03:17.0699 0512 igfx (9378d57e2b96c0a185d844770ad49948) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/07/25 17:03:18.0080 0512 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/07/25 17:03:18.0434 0512 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
2011/07/25 17:03:18.0954 0512 IntcAzAudAddService (b795745f7e51aa20d46753ec5a811aca) C:\Windows\system32\drivers\RTKVHDA.sys
2011/07/25 17:03:19.0257 0512 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/07/25 17:03:19.0539 0512 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/07/25 17:03:19.0801 0512 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/07/25 17:03:19.0861 0512 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/07/25 17:03:20.0104 0512 irda (e50a95179211b12946f7e035d60af560) C:\Windows\system32\DRIVERS\irda.sys
2011/07/25 17:03:20.0200 0512 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/07/25 17:03:20.0844 0512 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/07/25 17:03:21.0118 0512 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/07/25 17:03:21.0314 0512 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/07/25 17:03:21.0597 0512 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/07/25 17:03:21.0862 0512 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/07/25 17:03:22.0059 0512 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\drivers\kbdhid.sys
2011/07/25 17:03:22.0357 0512 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/07/25 17:03:22.0644 0512 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/07/25 17:03:22.0826 0512 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/07/25 17:03:23.0223 0512 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/07/25 17:03:23.0644 0512 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/07/25 17:03:23.0842 0512 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/07/25 17:03:24.0447 0512 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
2011/07/25 17:03:25.0021 0512 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/07/25 17:03:25.0369 0512 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/07/25 17:03:25.0644 0512 mfeavfk (c97cbfd71c1c215150a3b3e55f77a7a3) C:\Windows\system32\drivers\mfeavfk.sys
2011/07/25 17:03:26.0405 0512 mfebopk (5447338b83a1a2354fb2fea7604387fd) C:\Windows\system32\drivers\mfebopk.sys
2011/07/25 17:03:28.0486 0512 mfehidk (6c9a6ed60b8fc3baf72fe1b1d096445b) C:\Windows\system32\drivers\mfehidk.sys
2011/07/25 17:03:28.0734 0512 mferkdk (a551154b51d6a93fccf70fc4e8eaf4bd) C:\Windows\system32\drivers\mferkdk.sys
2011/07/25 17:03:28.0939 0512 mfesmfk (299a86b780c9627aaa24e74292363ed2) C:\Windows\system32\drivers\mfesmfk.sys
2011/07/25 17:03:29.0113 0512 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/07/25 17:03:29.0232 0512 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/07/25 17:03:29.0440 0512 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/07/25 17:03:29.0623 0512 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/07/25 17:03:29.0747 0512 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/07/25 17:03:30.0005 0512 MPFP (96cf5286bc370b558735a7b891232d92) C:\Windows\system32\Drivers\Mpfp.sys
2011/07/25 17:03:30.0318 0512 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/07/25 17:03:30.0637 0512 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/07/25 17:03:30.0962 0512 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/07/25 17:03:31.0084 0512 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/07/25 17:03:31.0185 0512 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/07/25 17:03:31.0481 0512 mrxsmb10 (d4a3c7c580c4ccb5c06f2ada933ad507) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/07/25 17:03:31.0907 0512 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/07/25 17:03:32.0297 0512 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/07/25 17:03:32.0583 0512 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/07/25 17:03:32.0890 0512 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/07/25 17:03:33.0186 0512 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/07/25 17:03:34.0149 0512 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/07/25 17:03:34.0419 0512 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/07/25 17:03:34.0549 0512 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/07/25 17:03:34.0669 0512 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/07/25 17:03:34.0959 0512 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/07/25 17:03:35.0266 0512 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/07/25 17:03:35.0388 0512 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/07/25 17:03:36.0035 0512 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/07/25 17:03:36.0584 0512 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/07/25 17:03:36.0852 0512 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/07/25 17:03:37.0180 0512 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/07/25 17:03:37.0419 0512 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/07/25 17:03:37.0636 0512 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/07/25 17:03:37.0782 0512 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/07/25 17:03:37.0958 0512 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/07/25 17:03:38.0525 0512 NETw3v32 (35d5458d9a1b26b2005abffbf4c1c5e7) C:\Windows\system32\DRIVERS\NETw3v32.sys
2011/07/25 17:03:39.0138 0512 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/07/25 17:03:39.0994 0512 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/07/25 17:03:40.0311 0512 NSCIRDA (6d8d2e5652fc2442c810c5d8be784148) C:\Windows\system32\DRIVERS\nscirda.sys
2011/07/25 17:03:40.0495 0512 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/07/25 17:03:40.0878 0512 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/07/25 17:03:41.0227 0512 NTIDrvr (7f1c1f78d709c4a54cbb46ede7e0b48d) C:\Windows\system32\DRIVERS\NTIDrvr.sys
2011/07/25 17:03:41.0742 0512 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/07/25 17:03:42.0094 0512 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/07/25 17:03:42.0464 0512 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/07/25 17:03:42.0813 0512 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/07/25 17:03:43.0059 0512 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/07/25 17:03:43.0509 0512 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/07/25 17:03:43.0764 0512 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/07/25 17:03:44.0030 0512 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/07/25 17:03:44.0234 0512 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/07/25 17:03:44.0412 0512 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/07/25 17:03:44.0693 0512 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/07/25 17:03:45.0016 0512 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/07/25 17:03:45.0778 0512 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/07/25 17:03:46.0233 0512 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/07/25 17:03:46.0516 0512 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/07/25 17:03:46.0831 0512 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/07/25 17:03:47.0124 0512 PSDFilter (18de162f9b83079c24cd96f59292f5ed) C:\Windows\system32\DRIVERS\psdfilter.sys
2011/07/25 17:03:47.0327 0512 PSDNServ (bc1457a28e76ab3106d43802ac22a627) C:\Windows\system32\DRIVERS\PSDNServ.sys
2011/07/25 17:03:47.0638 0512 psdvdisk (ac151e5b0943304e368c98ec78b5fc4f) C:\Windows\system32\DRIVERS\PSDVdisk.sys
2011/07/25 17:03:48.0083 0512 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/07/25 17:03:48.0396 0512 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/07/25 17:03:48.0628 0512 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/07/25 17:03:48.0988 0512 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/07/25 17:03:49.0162 0512 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/07/25 17:03:49.0414 0512 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/07/25 17:03:49.0698 0512 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/07/25 17:03:49.0928 0512 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/07/25 17:03:50.0217 0512 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/07/25 17:03:50.0366 0512 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/07/25 17:03:50.0496 0512 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/07/25 17:03:50.0803 0512 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/07/25 17:03:51.0438 0512 Revoflt (b9bb8e2093c1615ad6ea55ad96214354) C:\Windows\system32\DRIVERS\revoflt.sys
2011/07/25 17:03:51.0670 0512 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/07/25 17:03:51.0885 0512 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/07/25 17:03:52.0003 0512 SASENUM (7ce61c25c159f50f9eaf6d77fc83fa35) C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
2011/07/25 17:03:52.0214 0512 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
2011/07/25 17:03:52.0451 0512 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/07/25 17:03:52.0936 0512 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2011/07/25 17:03:53.0149 0512 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/07/25 17:03:53.0261 0512 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/07/25 17:03:53.0518 0512 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/07/25 17:03:53.0929 0512 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/07/25 17:03:54.0200 0512 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/07/25 17:03:54.0509 0512 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/07/25 17:03:54.0862 0512 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/07/25 17:03:54.0997 0512 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/07/25 17:03:55.0308 0512 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/07/25 17:03:55.0504 0512 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/07/25 17:03:55.0618 0512 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/07/25 17:03:55.0878 0512 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/07/25 17:03:56.0549 0512 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/07/25 17:03:57.0044 0512 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
2011/07/25 17:03:57.0376 0512 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
2011/07/25 17:03:57.0530 0512 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
2011/07/25 17:03:57.0766 0512 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/07/25 17:03:57.0948 0512 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/07/25 17:03:58.0022 0512 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/07/25 17:03:58.0084 0512 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/07/25 17:03:58.0314 0512 SynTP (c5f25d490d0915732508fd421bf76d93) C:\Windows\system32\DRIVERS\SynTP.sys
2011/07/25 17:03:58.0725 0512 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/07/25 17:03:59.0147 0512 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/07/25 17:03:59.0294 0512 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/07/25 17:03:59.0401 0512 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/07/25 17:03:59.0595 0512 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/07/25 17:03:59.0733 0512 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/07/25 17:03:59.0971 0512 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/07/25 17:04:00.0437 0512 tifm21 (78213f01ce781f93180bef5eb5b3ad81) C:\Windows\system32\drivers\tifm21.sys
2011/07/25 17:04:00.0751 0512 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/07/25 17:04:00.0994 0512 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/07/25 17:04:01.0152 0512 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/07/25 17:04:01.0295 0512 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/07/25 17:04:01.0422 0512 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/07/25 17:04:01.0889 0512 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/07/25 17:04:02.0149 0512 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/07/25 17:04:02.0279 0512 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/07/25 17:04:02.0548 0512 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/07/25 17:04:02.0625 0512 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/07/25 17:04:02.0878 0512 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/07/25 17:04:03.0175 0512 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/07/25 17:04:03.0457 0512 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/07/25 17:04:03.0799 0512 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/07/25 17:04:04.0275 0512 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/07/25 17:04:04.0469 0512 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/07/25 17:04:04.0694 0512 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/07/25 17:04:04.0977 0512 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/07/25 17:04:05.0446 0512 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/07/25 17:04:05.0803 0512 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/07/25 17:04:06.0085 0512 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/07/25 17:04:06.0602 0512 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/07/25 17:04:06.0926 0512 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/07/25 17:04:07.0435 0512 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/07/25 17:04:07.0912 0512 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/07/25 17:04:08.0110 0512 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/07/25 17:04:08.0186 0512 volsnap (e269bb33062f9a6b4115c86781d767aa) C:\Windows\system32\drivers\volsnap.sys
2011/07/25 17:04:08.0189 0512 Suspicious file (Forged): C:\Windows\system32\drivers\volsnap.sys. Real md5: e269bb33062f9a6b4115c86781d767aa, Fake md5: 147281c01fcb1df9252de2a10d5e7093
2011/07/25 17:04:08.0202 0512 volsnap - detected Rootkit.Win32.TDSS.tdl3 (0)
2011/07/25 17:04:08.0654 0512 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/07/25 17:04:09.0187 0512 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/07/25 17:04:09.0510 0512 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/25 17:04:09.0568 0512 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/07/25 17:04:09.0807 0512 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/07/25 17:04:09.0974 0512 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/07/25 17:04:10.0486 0512 winachsf (5a77ac34a0ffb70ce8b35b524fede9ba) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
2011/07/25 17:04:10.0835 0512 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/07/25 17:04:11.0514 0512 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/07/25 17:04:11.0851 0512 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/07/25 17:04:12.0116 0512 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/07/25 17:04:12.0451 0512 XAudio (88af537264f2b818da15479ceeaf5d7c) C:\Windows\system32\DRIVERS\xaudio.sys
2011/07/25 17:04:12.0603 0512 MBR (0x1B8) (6fc6f9186c07bca94e140f63bfe6e9b4) \Device\Harddisk0\DR0
2011/07/25 17:04:12.0816 0512 Boot (0x1200) (aeba00ae23a5db6c7867f53f2e985bba) \Device\Harddisk0\DR0\Partition0
2011/07/25 17:04:13.0057 0512 Boot (0x1200) (6c7f80b3a4b47ca1fafd87e252e36fcb) \Device\Harddisk0\DR0\Partition1
2011/07/25 17:04:13.0098 0512 ================================================================================
2011/07/25 17:04:13.0098 0512 Scan finished
2011/07/25 17:04:13.0098 0512 ================================================================================
2011/07/25 17:04:13.0125 3984 Detected object count: 1
2011/07/25 17:04:13.0125 3984 Actual detected object count: 1
2011/07/25 17:04:56.0384 3984 volsnap (e269bb33062f9a6b4115c86781d767aa) C:\Windows\system32\drivers\volsnap.sys
2011/07/25 17:04:56.0387 3984 Suspicious file (Forged): C:\Windows\system32\drivers\volsnap.sys. Real md5: e269bb33062f9a6b4115c86781d767aa, Fake md5: 147281c01fcb1df9252de2a10d5e7093
2011/07/25 17:04:59.0269 3984 Backup copy found, using it..
2011/07/25 17:04:59.0285 3984 C:\Windows\system32\drivers\volsnap.sys - will be cured after reboot
2011/07/25 17:04:59.0285 3984 Rootkit.Win32.TDSS.tdl3(volsnap) - User select action: Cure
2011/07/25 17:05:27.0080 1316 Deinitialize success

thanks one more time!

#6 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:04:17 AM

Posted 27 July 2011 - 09:44 AM

Hi jaz1240,

Let's double check we've gotten everything.

:step1: Clear Cache/Temp Files
Download TFC by OldTimer to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

:step2: Rerun Malwarebytes (Full Scan. May take some time. Please be patient.)
Open Malwarebytes, click on the Update tab, and click the check for Updates button.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Full Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

If you have trouble updating, troubleshoot Malwarebytes' Anti-Malware

:step3: Please run the F-Secure Online Scanner
Follow the Instruction here for installation.
Accept the License Agreement.
Once the ActiveX installs,Click Full System Scan
Once the download completes, the scan will begin automatically.
The scan will take some time to finish, so please be patient.
When the scan completes, click the Automatic cleaning (recommended) button.
Click the Show Report button and Copy&Paste the entire report in your next reply.


In your next reply, please include:
  • Malwarebytes log
  • F-Secure log
  • How's your computer running now? Please include a detailed description of anything out of the ordinary, including any error messages.

Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#7 jaz1240

jaz1240
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:17 AM

Posted 29 July 2011 - 01:05 AM

hi jason.
thanks for everything.
Google search still redirecting.
but other issues seem to be remedied!
here are the log files you requested.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7270

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19088

7/28/2011 9:16:45 PM
mbam-log-2011-07-28 (21-16-45).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 305868
Time elapsed: 1 hour(s), 13 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





Scanning Report
Thursday, July 28, 2011 21:48:18 - 22:52:03

Computer name: JEFF-PC
Scanning type: Scan system for malware, spyware and rootkits
Target: C:\ D:\
13 malware found
TrackingCookie.Questionmarket (spyware)

System (Disinfected)

TrackingCookie.Advertising (spyware)

System (Disinfected)

TrackingCookie.Atdmt (spyware)

System (Disinfected)

Suspicious:W32/Malware!Gemini (spyware)

System (Disinfected)

TrackingCookie.Doubleclick (spyware)

System (Disinfected)

TrackingCookie.Revsci (spyware)

System (Disinfected)

TrackingCookie.Fastclick (spyware)

System (Disinfected)

TrackingCookie.Adbrite (spyware)

System (Disinfected)

TrackingCookie.Mediaplex (spyware)

System (Disinfected)

TrackingCookie.Liveperson (spyware)

System (Disinfected)

TrackingCookie.Yieldmanager (spyware)

System (Disinfected)

Suspicious:W32/Malware!Gemini (virus)

C:\USERS\JEFF\DOWNLOADS\GMER\GMER.EXE (Not cleaned & Submitted)

Suspicious:W32/Malware!Gemini (virus)

C:\USERS\JEFF\DESKTOP\GMER.EXE (Not cleaned)

Statistics
Scanned:

Files: 65770
System: 4191
Not scanned: 45

Actions:

Disinfected: 11
Renamed: 0
Deleted: 0
Not cleaned: 2
Submitted: 1

Files not scanned:

C:\PAGEFILE.SYS
C:\HIBERFIL.SYS
C:\WINDOWS\TEMP\MCMSC_EUDDULPXUCHQPSO
C:\WINDOWS\TEMP\SQLITE_4CTRGEBY8LHPT4C
C:\WINDOWS\TEMP\SQLITE_M2YKFKBP2MGEXI8
C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM
C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB
C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB
C:\USERS\JEFF\APPDATA\LOCAL\TEMP\HSPERFDATA_JEFF\4004
C:\USERS\JEFF\APPDATA\LOCAL\TEMP\HSPERFDATA_JEFF\5552
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\186CBF9A68FDC67B983DCFED44621130_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\22DC7F06F5CC63DF01761AB69664C4CC_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\2D952298F8993C623A6C03208E5007FA_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\26254C69EA8FE7ED8E73767A64D86D70_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\49E667F1194005DB4A583EA251909BB6_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6C9FCFFD1B90C16D7DBBEF02BA0A0620_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5328273EEC364E563388EE020BD0303A_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8A41E65DBA0273CDA5F030E6612E85BA_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9BB024908E7063430C486B4954E63741_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7238635C585B2A7B09950D3F1ECF44CF_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8CEA9C4F5E30156F38E0EC27A478FC4D_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B6C19FACB9BDD8C2569520A94EB1BD3C_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\A24B246E95A34FB6A233319093E2DAE9_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C15E7D9B8F8D081C51C00308F363F4F0_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CCC0F1A921D66A7C2330C58C0A52DFD5_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CD8B916A0D7B16CE12AED297DDAA1779_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\CEDF47AD7F1AF19F7D6058A500562C93_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\D076302C0276D298F68383BB7BAA00C7_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DEA47AC2D3BD49F764D7CBF3AF1F4C33_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\BB229EBE468B1D45472E7BC83B9EDB5D_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F8811F5A1D85F6FED355B2AEC41176BD_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F0B160657CF9845D8419AAC0E1A5D46F_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C3EEC4628A3E460C417E64B7415FD2EE_788CA89A-0149-4A61-A038-16BCA0B7C801
C:\BOOT\BCD

Options
Scanning engines:

Scanning options:

Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
Use advanced heuristics

thanks.

#8 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:04:17 AM

Posted 29 July 2011 - 09:25 AM

Hi jaz1240,

Looking good. :thumbup2:

:step1: Please re-download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer Log Errors
  • List Installed Programs
Click Go . Please put code boxes around just this log, like this, but without the x: [xcode] MiniToolBox log [/xcode]
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif


#9 jaz1240

jaz1240
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:12:17 AM

Posted 29 July 2011 - 09:02 PM

hi jason,

here is the latest log. thanks

MiniToolBox by Farbar
Ran by Jeff (administrator) on 29-07-2011 at 18:54:09
Windows Vista ™ Home Premium Service Pack 2 (X86)

***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= FF Proxy Settings: ==============================

========================= Hosts content: =================================

::1 localhost

127.0.0.1 localhost

========================= IP Configuration: ================================

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : Jeff-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR5007EG Wireless Network Adapter
Physical Address. . . . . . . . . : 00-17-C4-21-78-4A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::4cbe:483a:bd0b:fd5%12(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.124(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, July 29, 2011 5:04:03 PM
Lease Expires . . . . . . . . . . : Saturday, July 30, 2011 5:04:06 PM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 218109892
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-0F-E3-63-59-00-1D-72-39-48-BC
DNS Servers . . . . . . . . . . . : 66.76.175.70
208.180.42.100
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 6:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:2872:1f33:3f57:fe83(Preferred)
Link-local IPv6 Address . . . . . : fe80::2872:1f33:3f57:fe83%13(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 72:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{12667D8F-E482-424C-B3C4-9A8A4D52AE9C}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 74:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{CFF6B887-1F9F-42C1-9C3E-0E7E44A7B879}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 76:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{CFF6B887-1F9F-42C1-9C3E-0E7E44A7B879}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: rdns-sanj-a.suddenlink.net
Address: 66.76.175.70

Name: google.com
Addresses: 74.125.91.105
74.125.91.106
74.125.91.147
74.125.91.99
74.125.91.103
74.125.91.104



Pinging google.com [74.125.93.104] with 32 bytes of data:

Reply from 74.125.93.104: bytes=32 time=101ms TTL=50

Reply from 74.125.93.104: bytes=32 time=101ms TTL=50



Ping statistics for 74.125.93.104:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 101ms, Maximum = 101ms, Average = 101ms

Server: rdns-sanj-a.suddenlink.net
Address: 66.76.175.70

Name: yahoo.com
Addresses: 209.191.122.70
67.195.160.76
69.147.125.65
72.30.2.43
98.137.149.56



Pinging yahoo.com [209.191.122.70] with 32 bytes of data:

Reply from 209.191.122.70: bytes=32 time=72ms TTL=52

Reply from 209.191.122.70: bytes=32 time=65ms TTL=52



Ping statistics for 209.191.122.70:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 65ms, Maximum = 72ms, Average = 68ms



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
12 ...00 17 c4 21 78 4a ...... Atheros AR5007EG Wireless Network Adapter
1 ........................... Software Loopback Interface 1
13 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
86 ...00 00 00 00 00 00 00 e0 isatap.{12667D8F-E482-424C-B3C4-9A8A4D52AE9C}
76 ...00 00 00 00 00 00 00 e0 isatap.{CFF6B887-1F9F-42C1-9C3E-0E7E44A7B879}
75 ...00 00 00 00 00 00 00 e0 isatap.{CFF6B887-1F9F-42C1-9C3E-0E7E44A7B879}
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.124 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.124 281
192.168.1.124 255.255.255.255 On-link 192.168.1.124 281
192.168.1.255 255.255.255.255 On-link 192.168.1.124 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.124 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.124 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
13 38 ::/0 On-link
1 306 ::1/128 On-link
13 38 2001::/32 On-link
13 286 2001:0:4137:9e76:2872:1f33:3f57:fe83/128
On-link
12 281 fe80::/64 On-link
13 286 fe80::/64 On-link
13 286 fe80::2872:1f33:3f57:fe83/128
On-link
12 281 fe80::4cbe:483a:bd0b:fd5/128
On-link
1 306 ff00::/8 On-link
13 286 ff00::/8 On-link
12 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

========================= Event log errors: ===============================

Application errors:
==================
Error: (07/29/2011 05:01:40 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/29/2011 09:22:07 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/29/2011 06:54:31 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/28/2011 07:57:05 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/28/2011 07:37:15 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/28/2011 01:02:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/28/2011 10:58:52 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/27/2011 10:47:00 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/27/2011 06:38:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/27/2011 07:00:08 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/29/2011 05:01:40 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (07/29/2011 05:01:40 PM) (Source: Service Control Manager) (User: )
Description: AnchorChips General Purpose USB Driver (ezusb.sys)%%1058

Error: (07/29/2011 09:22:07 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (07/29/2011 09:22:07 AM) (Source: Service Control Manager) (User: )
Description: AnchorChips General Purpose USB Driver (ezusb.sys)%%1058

Error: (07/29/2011 07:13:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: SYSTEM)
Description: 0x80070643Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2478663){3967DD7D-E56B-464E-8B95-A3F360DD90E9}101

Error: (07/29/2011 07:13:22 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: SYSTEM)
Description: 0x80070643Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2518870){C38C111F-A9A8-4146-A678-C4121C18BF4A}101

Error: (07/29/2011 06:54:31 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (07/29/2011 06:54:31 AM) (Source: Service Control Manager) (User: )
Description: AnchorChips General Purpose USB Driver (ezusb.sys)%%1058

Error: (07/28/2011 11:23:28 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: SYSTEM)
Description: 0x80070643Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2478663){3967DD7D-E56B-464E-8B95-A3F360DD90E9}101

Error: (07/28/2011 11:23:15 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: SYSTEM)
Description: 0x80070643Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2518870){C38C111F-A9A8-4146-A678-C4121C18BF4A}101


Microsoft Office Sessions:
=========================
Error: (06/15/2011 04:01:06 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2175 seconds with 1260 seconds of active time. This session ended with a crash.

Error: (05/11/2011 10:04:56 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash.

Error: (04/11/2011 04:33:48 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.

Error: (04/10/2011 07:15:56 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13 seconds with 0 seconds of active time. This session ended with a crash.

Error: (03/22/2011 07:15:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.

Error: (03/02/2011 11:46:11 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3116 seconds with 1920 seconds of active time. This session ended with a crash.

Error: (01/30/2011 00:28:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 288 seconds with 60 seconds of active time. This session ended with a crash.

Error: (01/30/2011 00:21:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3219 seconds with 240 seconds of active time. This session ended with a crash.

Error: (01/10/2011 10:53:47 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 27 seconds with 0 seconds of active time. This session ended with a crash.

Error: (12/09/2010 04:05:12 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6535.5002, Microsoft Office Version: 12.0.6425.1000. This session lasted 548 seconds with 420 seconds of active time. This session ended with a crash.


=========================== Installed Programs ============================

2007 Microsoft Office system (Version: 12.0.6425.1000)
Acer Assist
Acer Crystal Eye (Version: 7.32.701.13d)
Acer Crystal Eye Webcam (Version: 2.0.0.20)
Acer eDataSecurity Management (Version: 2.8.4354)
Acer eLock Management (Version: 2.5.4302)
Acer Empowering Technology (Version: 2.5.4301)
Acer eNet Management (Version: 2.6.4303)
Acer ePower Management (Version: 2.5.4310)
Acer ePresentation Management (Version: 2.5.4300)
Acer eSettings Management (Version: 2.5.4302)
Acer GridVista (Version: 2.72.317)
Acer Mobility Center Plug-In (Version: 1.0.4301)
Acer Registration
Acer ScreenSaver (Version: 2.11.20071207)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe AIR (Version: 2.6.0.19120)
Adobe Flash Player 10 ActiveX (Version: 10.1.102.64)
Adobe Flash Player 10 Plugin (Version: 10.2.152.26)
Adobe Reader X (10.1.0) (Version: 10.1.0)
Akamai NetSession Interface
Broadcom Gigabit Integrated Controller (Version: 10.50.08)
BufferChm (Version: 82.0.173.000)
Business Contact Manager for Outlook 2007 SP2 (Version: 3.0.8619.1)
CustomerResearchQFolder (Version: 1.00.0000)
D4200 (Version: 82.0.201.000)
D4200_Help (Version: 82.0.201.000)
DeviceManagementQFolder (Version: 1.00.0000)
dj_sf_ProductContext (Version: 82.0.201.000)
dj_sf_software (Version: 82.0.201.000)
dj_sf_software_req (Version: 82.0.201.000)
ESET Online Scanner v3
eSupportQFolder (Version: 1.00.0000)
Garmin MapSource (Version: 6.16.3)
Garmin USB Drivers (Version: 2.3.0.0)
Google Earth Plug-in (Version: 5.2.1.1588)
Google Update Helper (Version: 1.3.21.57)
HDAUDIO Soft Data Fax Modem with SmartCP
HP Customer Participation Program 8.0 (Version: 8.0)
HP Deskjet 8.0 Software (Version: 8.0)
HP Imaging Device Functions 8.0 (Version: 8.0)
HP Photosmart Essential (Version: 1.12.0.46)
HP Solution Center 8.0 (Version: 8.0)
HP Update (Version: 4.000.005.006)
HPProductAssistant (Version: 82.0.173.000)
HPSSupply (Version: 2.1.3.0000)
Intel® Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Japanese Fonts Support For Adobe Reader 8 (Version: 8.0)
Java Auto Updater (Version: 2.0.2.1)
Java™ 6 Update 20 (Version: 6.0.200)
Launch Manager
LightScribe 1.4.142.1 (Version: 1.4.142.1)
Malwarebytes' Anti-Malware version 1.51.1.1800 (Version: 1.51.1.1800)
MapSource - Trip & Waypoint Manager v2 (Version: 2.00)
MapSource - US Topo v3.02
MapSource (Version: 5.4)
MarketResearch (Version: 82.0.174.000)
McAfee Security Scan Plus (Version: 2.0.181.2)
McAfee SecurityCenter
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2003 Web Components (Version: 11.0.8173.0)
Microsoft Office 2007 Primary Interop Assemblies (Version: 12.0.4518.1014)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Home and Student 2007 (Version: 12.0.6425.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Professional Hybrid 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Small Business Connectivity Components (Version: 2.0.7024.0)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (Version: 12.0.4518.1014)
Microsoft Silverlight (Version: 4.0.60531.0)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.4.5000.00)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server Setup Support Files (English) (Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Mozilla Firefox 4.0.1 (x86 en-US) (Version: 4.0.1)
NTI Backup NOW! 4.7 (Version: 1.00.0000)
NTI CD & DVD-Maker (Version: 7)
NTI Shadow (Version: 3.7.6.37)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
OOIBase32
Paint.NET v3.5.6 (Version: 3.56.0)
PDF-Viewer (Version: 2.0.56.0)
PowerDVD (Version: 7.32.3730a.0)
R for Windows 2.10.1 (Version: 2.10.1)
Realtek High Definition Audio Driver (Version: 6.0.1.5543)
Revo Uninstaller Pro 2.5.3 (Version: 2.5.3)
SolutionCenter (Version: 82.0.188.000)
Status (Version: 82.0.173.000)
SUPERAntiSpyware Free Edition (Version: 4.26.0.1006)
Synaptics Pointing Device Driver (Version: 10.0.15.0)
TBS WMP Plug-in (Version: 1.00.676)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 2.00.0002)
Tinn-R 1.17.2.4
TIPCI (Version: 2.00.0002)
Toolbox (Version: 82.0.173.000)
TrayApp (Version: 82.0.188.000)
UnloadSupport (Version: 1.00.0000)
WebReg (Version: 82.0.173.000)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)

== End of log ==

thanks again!

#10 jntkwx

jntkwx

  • Malware Response Team
  • 4,339 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New England, U.S.A.
  • Local time:04:17 AM

Posted 29 July 2011 - 09:11 PM

jaz1240,


Your computer looks clean! How is it running now?

Let's take some preventative steps to ensure you don't get infected again:


:step1: Please download OTCleanIt and save it to desktop.
  • Double-click OTCleanIt.exe.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.

:step2: Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Microsoft: ‘Unprecedented Wave of Java Exploitation’
Drive-by Trojan preying on out-of-date Java installations
Ghosts of Java Haunt UsersPlease follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 7 and save it to your desktop.
  • Look for "Java Platform, Standard Edition".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows" (32-bit) or "Windows x64" (64-bit).
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "I agree to the Java SE...License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Posted Image > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u24-windows-i586.exe to install the newest version.
  • If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.

:step3: Make Internet Explorer more secure:
Hold down the Windows Key, and press the R key.
In the Run Dialog box, type: inetcpl.cpl & click OK
Click on the Security tab,
Click Reset all zones to default level
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

:step4: Reinstall Several Programs
Download and install these one at a time (they won't let you install them at the same time).

:step5: Install the Latest Version of Common Software:
It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting http://secunia.com/vulnerability_scanning/online/ and http://www.calendarofupdates.com/updates/calendar.html.

I recommend FileHippo's update checker that scans your computer for programs it recognizes and allows you to easily download new versions of common software: http://filehippo.com/updatechecker/UpdateChecker.exe

:step6: Finally, read this tutorial and follow each of the steps:
http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

Please feel free to post any future computer problems in the appropriate forum. Have a great day! :
Regards,
Jason

 

Simple and easy ways to keep your computer safe and secure on the Internet

If I am helping you and have not returned in 48 hours, please feel free to send me a PM with a link to the topic.
My help is free... however, if you wish to show appreciation and support me personally fighting against malware, please consider a donation: btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users