Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Packed-171, VGEN.1055.0 found.


  • This topic is locked This topic is locked
13 replies to this topic

#1 Shaggyman

Shaggyman

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 07 October 2011 - 10:56 PM

Sys was slow, with svchost.exe using 99 to 100% of CPU.
IE favorites are missing. Email (Outlook Express) is gone.
Tried AVG and AntiVir- no infection found.
Ran Clamwin in Safe Mode and it found Trojan.Packed-171 and VGEN.1055.0.

Thanks in advance for any help!!

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Shaggyman at 10:57:54 on 2011-10-07
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.421 [GMT -5:00]
.
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Tenda\W311U\UI.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/
uStart Page = hxxp://www.google.com/advanced_search?hl=en
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [DataCaching] c:\progra~1\dataca~1\FLashKsk.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\HP Digital Imaging Monitor.lnk.disabled
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\HP Photosmart Premier Fast Start.lnk.disabled
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\w311u.lnk - c:\program files\tenda\w311u\UI.exe
uPolicies-explorer: NoSMMyDocs = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15111/CTPID.cab
TCP: DhcpNameServer = 24.121.56.24 137.118.1.33
TCP: Interfaces\{E712B554-022B-4F1F-8430-9341742EA4CE} : DhcpNameServer = 24.121.56.24 137.118.1.33
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-10-7 320856]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-3-15 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 67664]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-3-15 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-3-15 269480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-10-7 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-10-7 44768]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-3-15 66616]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2010-3-10 722432]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-10-7 442200]
S3 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-11-15 116608]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2011-5-13 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2011-5-13 11104]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]
S3 usbsmi;SMI USB 2.0 WebCAM;c:\windows\system32\drivers\SMIksdrv.sys [2010-12-24 154880]
.
=============== Created Last 30 ================
.
2011-10-07 14:12:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-10-07 14:11:29 41184 ----a-w- c:\windows\avastSS.scr
2011-10-07 14:11:09 -------- d-----w- c:\program files\AVAST Software
2011-10-07 14:11:09 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2011-10-07 13:27:23 -------- d-sha-r- C:\cmdcons
2011-10-06 19:24:31 -------- d-----w- c:\documents and settings\shaggyman\Links
2011-10-06 17:48:07 -------- dc-h--w- c:\windows\ie8
2011-10-05 18:13:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-05 17:10:28 388096 ----a-r- c:\documents and settings\shaggyman\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-05 17:10:26 -------- d-----w- c:\program files\Trend Micro
2011-10-05 16:13:49 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-10-05 16:13:49 -------- d-----w- c:\windows\system32\wbem\Repository
2011-09-27 23:10:43 -------- d-----w- c:\program files\Astroburn Lite
2011-09-27 23:09:58 -------- d-----w- c:\documents and settings\all users\application data\Astroburn Lite
.
==================== Find3M ====================
.
2011-10-05 18:12:44 472808 ----a-w- c:\windows\system32\deployJava1.dll
2006-05-03 17:06:54 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 18:47:16 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 20:30:52 216064 --sha-r- c:\windows\system32\nbDX.dll
2010-01-07 05:00:00 107520 --sha-r- c:\windows\system32\TAKDSDecoder.dll
.
============= FINISH: 10:58:54.00 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 12 October 2011 - 01:26 PM

Hello and welcome to Bleeping Computer.

My name is km2357 and I will be helping you to remove any infection(s) that you may have.

I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.

Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.

Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:


Step # 1 Download and run DDS

Download DDS and save it to your desktop from here or here or here
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop. Post them back to your topic.


Step # 2: Download and Run Gmer

Please download gmer.zip from Gmer and save it to your desktop.

***Please close any open programs ***

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security Analyst


If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure that the 'Sections' button is ticked and the 'Show All' button is unticked.
  • Click the Scan button and let the program do its work. GMER will produce a log.
  • Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

Please post the results from the GMER scan in your reply.


In your next post/reply, I need to see the following:

1. The two DDS Logs (DDS and Attach.txt)
2. The GMER Log

Use multiple posts if you can't fit everything into one post.

MalWare Removal University Master

Member of ASAP
unite_Invision.png


#3 Shaggyman

Shaggyman
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 12 October 2011 - 06:15 PM

Thanks! Here are the requested logs:

DDS.txt

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.13
Run by Shaggyman at 14:38:21 on 2011-10-12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.753 [GMT -5:00]
.
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Tenda\Common\RaRegistry.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\PROGRA~1\DATACA~1\FLashKsk.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Tenda\W311U\UI.exe
C:\Program Files\CleanMem\Mini_Monitor.exe
C:\WINDOWS\explorer.exe
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/
uStart Page = hxxp://www.google.com/advanced_search?hl=en
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [DataCaching] c:\progra~1\dataca~1\FLashKsk.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\HP Digital Imaging Monitor.lnk.disabled
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\HP Photosmart Premier Fast Start.lnk.disabled
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tendaw~1.lnk - c:\program files\tenda\common\RaUI.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\w311u.lnk - c:\program files\tenda\w311u\UI.exe
uPolicies-explorer: NoSMMyDocs = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15111/CTPID.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-10-7 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-10-7 320856]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 67664]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-10-7 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-10-7 44768]
R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\tenda\common\RaRegistry.exe [2011-10-10 185632]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [2011-10-10 19072]
S3 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-11-15 116608]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2011-5-13 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2011-5-13 11104]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2011-10-10 827488]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]
S3 usbsmi;SMI USB 2.0 WebCAM;c:\windows\system32\drivers\SMIksdrv.sys [2010-12-24 154880]
.
=============== Created Last 30 ================
.
2011-10-12 14:10:10 119808 -c--a-w- c:\windows\system32\dllcache\winmine.exe
2011-10-12 14:10:10 119808 ----a-w- c:\windows\system32\winmine.exe
2011-10-12 14:08:59 56832 -c--a-w- c:\windows\system32\dllcache\sol.exe
2011-10-12 14:08:59 56832 ----a-w- c:\windows\system32\sol.exe
2011-10-11 15:42:13 -------- d-----w- c:\windows\CleanMem
2011-10-11 15:42:13 -------- d-----w- c:\program files\CleanMem
2011-10-10 18:33:06 796032 ----a-w- c:\windows\system32\Scutum.dll
2011-10-10 18:33:06 200704 ----a-w- c:\windows\system32\ssleay32.dll
2011-10-10 18:33:06 19072 ----a-w- c:\windows\system32\drivers\Scutum50.sys
2011-10-10 18:33:06 180224 ----a-w- c:\windows\system32\W32N55.dll
2011-10-10 18:33:06 152968 ----a-w- c:\windows\system32\RalinkGina.dll
2011-10-10 18:33:06 147456 ----a-w- c:\windows\system32\DiagFunc.dll
2011-10-10 18:31:52 827488 ----a-w- c:\windows\system32\drivers\rt2870.sys
2011-10-10 18:31:52 238944 ----a-w- c:\windows\system32\RaCoInst.dll
2011-10-10 18:31:48 -------- d-----w- c:\documents and settings\all users\application data\Tenda Driver
2011-10-09 13:36:46 -------- d-----w- c:\windows\system32\Adobe
2011-10-09 13:36:19 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 13:34:07 -------- d-----w- c:\windows\BACKUPS REGISTRY
2011-10-08 23:01:38 -------- d-----w- c:\documents and settings\shaggyman\application data\Astroburn Lite
2011-10-08 22:56:36 -------- d-----w- c:\documents and settings\shaggyman\application data\InfraRecorder
2011-10-08 22:13:57 1085440 ----a-w- c:\windows\system32\libeay32.dll
2011-10-08 19:16:38 -------- d-----w- c:\program files\AM-DeadLink
2011-10-08 18:16:00 266360 ----a-w- c:\windows\system32\TweakUI.exe
2011-10-08 17:06:19 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-10-08 17:06:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-08 05:13:29 -------- d-----w- c:\documents and settings\shaggyman\application data\QuickScan
2011-10-08 05:07:22 -------- d-----w- c:\program files\ESET
2011-10-08 04:48:48 -------- d-----w- c:\documents and settings\shaggyman\DoctorWeb
2011-10-07 14:12:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-10-07 14:11:29 41184 ----a-w- c:\windows\avastSS.scr
2011-10-07 14:11:09 -------- d-----w- c:\program files\AVAST Software
2011-10-07 14:11:09 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2011-10-07 13:27:23 -------- d-sha-r- C:\cmdcons
2011-10-06 19:24:31 -------- d-----w- c:\documents and settings\shaggyman\Links
2011-10-06 17:48:08 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-10-06 17:48:08 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2011-10-05 18:13:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-05 17:10:28 388096 ----a-r- c:\documents and settings\shaggyman\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-05 17:10:26 -------- d-----w- c:\program files\Trend Micro
2011-09-27 23:10:43 -------- d-----w- c:\program files\Astroburn Lite
2011-09-27 23:09:58 -------- d-----w- c:\documents and settings\all users\application data\Astroburn Lite
.
==================== Find3M ====================
.
2011-10-05 18:12:44 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-04 00:01:30 61440 ----a-w- c:\windows\system32\CleanMem.exe
2006-05-03 17:06:54 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 18:47:16 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 20:30:52 216064 --sha-r- c:\windows\system32\nbDX.dll
2010-01-07 05:00:00 107520 --sha-r- c:\windows\system32\TAKDSDecoder.dll
.
============= FINISH: 14:39:42.10 ===============

Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 3/6/2010 2:37:28 PM
System Uptime: 10/11/2011 2:07:26 PM (24 hours ago)
.
Motherboard: Intel Corporation | | D845PT
Processor: Intel® Pentium® 4 CPU 2.40GHz | J1E1 | 2392/100mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 155.547 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 75 GiB total, 41.121 GiB free.
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: CNet PRO200WL PCI Fast Ethernet Adapter
Device ID: PCI\VEN_1282&DEV_9102&SUBSYS_434E4554&REV_31\4&1351887D&0&48F0
Manufacturer: CNet Technology, Inc.
Name: CNet PRO200WL PCI Fast Ethernet Adapter
PNP Device ID: PCI\VEN_1282&DEV_9102&SUBSYS_434E4554&REV_31\4&1351887D&0&48F0
Service: DM9102
.
Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: Microsoft PS/2 Mouse
Device ID: ACPI\PNP0F03\4&268D196D&0
Manufacturer: Microsoft
Name: Microsoft PS/2 Mouse
PNP Device ID: ACPI\PNP0F03\4&268D196D&0
Service: i8042prt
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 802.11n USB Wireless LAN Card
Device ID: USB\VID_148F&PID_3070\1.0
Manufacturer: Ralink Technology, Corp.
Name: 802.11n USB Wireless LAN Card
PNP Device ID: USB\VID_148F&PID_3070\1.0
Service: rt2870
.
==== System Restore Points ===================
.
RP1: 10/6/2011 1:53:06 PM - Restore Operation
RP2: 10/8/2011 12:03:18 PM - OUTLOOK EXPRESS BACK
RP3: 10/8/2011 12:04:01 PM - test
RP4: 10/8/2011 12:05:44 PM - Restore Operation
RP5: 10/8/2011 2:35:23 PM - SHORTCUTS FIXED
RP6: 10/8/2011 5:13:07 PM - Installed Tenda Wireless LAN
RP7: 10/8/2011 6:00:19 PM - Removed TinyBurn
RP8: 10/9/2011 8:36:44 AM - Installed Adobe Shockwave Player 11.6.
RP9: 10/10/2011 9:20:54 AM - System Checkpoint
RP10: 10/10/2011 12:48:11 PM - Removed Tenda Wireless LAN
RP11: 10/10/2011 1:31:48 PM - Installed Tenda Wireless LAN
RP12: 10/11/2011 10:14:26 AM - Installed Microsoft Fix it 50403
RP13: 10/11/2011 2:03:05 PM - Installed Windows XP KB915865.
RP14: 10/11/2011 2:03:42 PM - Installed Windows NLSDownlevelMapping.
RP15: 10/11/2011 2:04:14 PM - Installed Windows IDNMitigationAPIs.
RP16: 10/11/2011 2:05:33 PM - Installed Windows Internet Explorer 7.
RP17: 10/11/2011 2:14:00 PM - Installed IE 7
RP669: 10/6/2011 1:53:06 PM - Restore Operation
.
==== Installed Programs ======================
.
µTorrent
Accord CD Ripper Free 6.6.8
Acrobat.com
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.1
Adobe Shockwave Player 11.6
afreeCodecVT
AiO_Scan_CDA
AiOSoftwareNPI
AM-DeadLink 4.4
AnswerWorks 4.0 Runtime - English
Any Video Converter 3.2.7
Apple Application Support
Apple Software Update
Astroburn Lite
avast! Free Antivirus
Blueberry PDF Form Filler
BufferChm
C6100
c6100_Help
CCleaner
CDex - Open Source Digital Audio CD Extractor
Citrix XenApp Web Plugin
CleanMem
Cole2k Media - Codec Pack (Advanced) 7.9.5
Combined Community Codec Pack 2009-09-09
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
Data Lifeguard
Dell Driver Download Manager
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
DocumentViewer
DocumentViewerQFolder
ESET Online Scanner v3
eSupportQFolder
Eusing Free Registry Cleaner
Family Tree Maker Version 16
Fax_CDA
ffdshow v1.1.3904 [2011-06-23]
Folder Size for Windows
Free CD to MP3 Converter
FullDPAppQFolder
GeoServer 2.0.2
GIMP 2.6.11
Google Earth
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB954550-v5)
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
Java Auto Updater
Java™ 6 Update 27
K-Lite Codec Pack 5.8.3 (Full)
Kate's Video Joiner
Malwarebytes' Anti-Malware version 1.51.1.1800
Media Player Classic - Home Cinema v1.5.2.3456
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Publisher 2002
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Windows XP Video Decoder Checkup Utility
NewCopy_CDA
NVIDIA Drivers
OCR Software by I.R.I.S 7.0
PanoStandAlone
PartitionMagic 6.0
PhotoGallery
Pinnacle Hollywood FX
PrimoPDF -- brought to you by Nitro PDF Software
ProductContextNPI
QuickTime
RandMap
Readme
RegScrubXP 3.25
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
SanDisk ImageMate/SecureMate
Scan
ScanModule V5.1
ScannerCopy
SkinsHP1
SlideShow
SmartPack 1.19.0
SmartSound Quicktracks Plugin
SnapAPI
SolutionCenter
Sonic_PrimoSDK
Spybot - Search & Destroy
Status
StreamTransport version: 1.0.2.2041
Studio 9
Studio 9.4 Patch
SUPER © v2011.build.49 (July 1st, 2011) version v2011.build.49
SUPERAntiSpyware Free Edition
Tenda Wireless LAN Card
Toolbox
TrayApp
TurboTax 2009
TurboTax 2009 WinBizFedFormset
TurboTax 2009 WinBizReleaseEngine
TurboTax 2009 WinBizTaxSupport
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wrapper
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wmoiper
TurboTax 2010 wrapper
TurboTax Business 2007
TurboTax Business 2009
TurboTax Home & Business 2007
TurboTax Premier 2005
Tweak UI
Unload
USB2.0 UVC WebCam
W311U
WD Diagnostics
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinZip
Zoom Player (remove only)
.
==== Event Viewer Messages From Past Week ========
.
10/7/2011 11:43:06 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD aswRdr aswSP aswTdi avgio avipbb Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv StarOpen Tcpip
10/6/2011 8:28:27 AM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
10/6/2011 8:28:24 AM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
10/6/2011 8:09:43 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address C83A35C34E2B. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
10/6/2011 2:32:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
10/6/2011 12:57:01 PM, error: Service Control Manager [7034] - The Folder Size service terminated unexpectedly. It has done this 1 time(s).
10/6/2011 12:51:51 PM, error: Print [19] - Sharing printer failed + 1722, Printer Family Tree Maker Printer share name Printer4.
10/6/2011 12:47:49 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {9B1F122C-2982-4E91-AA8B-E071D54F2A4D}
10/6/2011 12:27:02 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
10/6/2011 11:55:58 AM, error: Service Control Manager [7034] - The HP Port Resolver service terminated unexpectedly. It has done this 1 time(s).
10/6/2011 11:55:54 AM, error: Service Control Manager [7034] - The HP Status Server service terminated unexpectedly. It has done this 1 time(s).
10/5/2011 9:54:00 PM, error: Service Control Manager [7031] - The SAS Core Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
10/5/2011 12:56:10 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s).
10/5/2011 12:35:21 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dnscache service.
10/5/2011 11:17:45 AM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
10/5/2011 11:15:59 AM, error: Print [19] - Sharing printer failed + 1722, Printer PrimoPDF share name Printer.
10/5/2011 10:48:47 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv StarOpen Tcpip
10/5/2011 10:48:47 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 10:48:47 AM, error: Service Control Manager [7001] - The Network Location Awareness (NLA) service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 10:48:47 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 10:48:47 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 10:48:47 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
10/5/2011 10:47:39 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/5/2011 10:42:00 AM, error: Service Control Manager [7034] - The Pml Driver HPZ12 service terminated unexpectedly. It has done this 1 time(s).
10/5/2011 1:19:39 PM, error: Service Control Manager [7000] - The Intuit Update Service service failed to start due to the following error: The system cannot find the file specified.
10/5/2011 1:00:35 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
10/10/2011 12:36:30 PM, error: Service Control Manager [7034] - The Ralink Registry Writer service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 12:19:00 PM, error: Dhcp [1002] - The IP address lease 192.168.1.65 for the Network Card with network address C83A35C34E2B has been denied by the DHCP server 192.168.1.254 (The DHCP Server sent a DHCPNACK message).
10/10/2011 11:08:40 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 1:24:23 PM, error: Service Control Manager [7000] - The Scutum50 NDIS Protocol Driver service failed to start due to the following error: The system cannot find the file specified.
.
==== End Of File ===========================
GMER log

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-12 17:39:21
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 WDC_WD2500JB-00REA0 rev.20.00K20
Running: gmer.exe; Driver: C:\DOCUME~1\SHAGGY~1\LOCALS~1\Temp\agkdykoc.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xF5B8D374]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xF5C1C2B8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xF5BB1829]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xF5B8F996]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xF5B8F9EE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xF5B8FB04]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xF5BB11DD]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xF5B8F8EC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xF5B8FA3E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xF5B8F940]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xF5B8FAB2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xF5B8D398]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xF5BB1EEF]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xF5BB21A5]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xF5B8FD88]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xF5BB1D5A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xF5BB1BC5]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xF5C1C368]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xF5B8D162]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xF5B8D3BC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xF5B8FEFC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xF5B8DE54]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xF5B8F9C6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xF5B8FA16]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xF5B8FB2E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xF5BB1539]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xF5B8F918]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xF5B8FBC0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xF5B8FA7E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xF5B8F96E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xF5B8FCA4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xF5B8FADC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xF5C1C400]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xF5BB1A40]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xF5B8DD1A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xF5BB1892]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xF5C246E2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xF5BB0850]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xF5B8D3E0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xF5B8D404]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xF5B8D1BC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xF5B8D2F8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xF5BB1FF6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xF5B8D2D4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xF5B8D31C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xF5B8D428]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xF5C319A6]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntoskrnl.exe!ObInsertObject 8056503A 5 Bytes JMP F5C2EE84 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 3CC 8056B712 4 Bytes CALL F5B8E4AF \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
PAGE ntoskrnl.exe!ZwCreateProcessEx 8057FC60 7 Bytes JMP F5C319AA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ObMakeTemporaryObject 8059F84D 5 Bytes JMP F5C2D3DE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF71ED360, 0x24BB1D, 0xE8000020]
.text win32k.sys!EngFreeUserMem + 674 BF809FDF 5 Bytes JMP F5B90E48 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngDeleteSurface + 45 BF8138FE 5 Bytes JMP F5B90D54 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!BRUSHOBJ_pvAllocRbrush + 320C BF81E743 5 Bytes JMP F5B90016 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngSetLastError + 7657 BF82868B 5 Bytes JMP F5B900DA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateBitmap + 698 BF838560 5 Bytes JMP F5B90FB2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateBitmap + BB6 BF838A7E 5 Bytes JMP F5B90CC4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateBitmap + 3605 BF83B4CD 5 Bytes JMP F5B911BA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateBitmap + D9AB BF845873 5 Bytes JMP F5B9014A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngMultiByteToWideChar + 2F20 BF8527E0 5 Bytes JMP F5B8FFFE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngMultiByteToWideChar + 84B4 BF857D74 5 Bytes JMP F5B91118 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!XLATEOBJ_iXlate + 23AD BF873983 5 Bytes JMP F5B90EFA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngStretchBlt + 37BB BF87882D 5 Bytes JMP F5B90D7E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngGetCurrentCodePage + 413A BF890AD9 5 Bytes JMP F5B904A4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngGradientFill + 4B52 BF8B3770 5 Bytes JMP F5B90326 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngGradientFill + 4BDD BF8B37FB 5 Bytes JMP F5B904CC \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngAlphaBlend + 9286 BF8C31E7 5 Bytes JMP F5B901E4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!PATHOBJ_bCloseFigure + 19CE BF8ED991 5 Bytes JMP F5B8FF32 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!PATHOBJ_bCloseFigure + D4C6 BF8F9489 5 Bytes JMP F5B90254 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!PATHOBJ_bCloseFigure + D746 BF8F9709 5 Bytes JMP F5B9028E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateClip + 1994 BF912612 5 Bytes JMP F5B90096 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateClip + 2568 BF9131E6 5 Bytes JMP F5B901AE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateClip + 4F29 BF915BA7 5 Bytes JMP F5B905E6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngPlgBlt + 1931 BF9438F8 5 Bytes JMP F5B91070 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
? C:\DOCUME~1\SHAGGY~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\smss.exe[504] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00391014
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00390804
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00390A08
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00390C0C
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00390E10
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003901F8
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003903FC
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00390600
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 003A0804
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 003A0A08
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 003A0600
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003A01F8
.text C:\Program Files\Tenda\Common\RaRegistry.exe[552] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003A03FC
.text C:\WINDOWS\system32\locator.exe[640] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\locator.exe[640] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\locator.exe[640] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\locator.exe[640] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\locator.exe[640] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\locator.exe[640] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\locator.exe[640] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\locator.exe[640] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\locator.exe[640] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\locator.exe[640] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\System32\svchost.exe[712] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\System32\svchost.exe[712] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[712] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\System32\svchost.exe[712] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\System32\svchost.exe[712] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\System32\svchost.exe[712] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\System32\svchost.exe[712] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\System32\svchost.exe[712] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\System32\svchost.exe[712] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\System32\svchost.exe[712] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\csrss.exe[724] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\winlogon.exe[748] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000701F8
.text C:\WINDOWS\system32\winlogon.exe[748] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\winlogon.exe[748] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000703FC
.text C:\WINDOWS\system32\winlogon.exe[748] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\winlogon.exe[748] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\winlogon.exe[748] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\winlogon.exe[748] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\winlogon.exe[748] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\winlogon.exe[748] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\winlogon.exe[748] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\services.exe[792] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\services.exe[792] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\services.exe[792] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\services.exe[792] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\services.exe[792] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\services.exe[792] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\services.exe[792] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\services.exe[792] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\services.exe[792] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\services.exe[792] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\lsass.exe[804] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\lsass.exe[804] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\lsass.exe[804] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\lsass.exe[804] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\lsass.exe[804] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\lsass.exe[804] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\lsass.exe[804] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\lsass.exe[804] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\lsass.exe[804] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\lsass.exe[804] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00391014
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00390804
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00390A08
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00390C0C
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00390E10
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003901F8
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003903FC
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00390600
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 003A0804
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 003A0A08
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 003A0600
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003A01F8
.text C:\Program Files\Java\jre6\bin\jqs.exe[904] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003A03FC
.text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\svchost.exe[1052] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\svchost.exe[1052] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[1052] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\svchost.exe[1052] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\svchost.exe[1052] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\svchost.exe[1052] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\svchost.exe[1052] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\svchost.exe[1052] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\svchost.exe[1052] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\svchost.exe[1052] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\System32\svchost.exe[1092] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\System32\svchost.exe[1092] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1092] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\System32\svchost.exe[1092] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\System32\svchost.exe[1092] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\System32\svchost.exe[1092] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\System32\svchost.exe[1092] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\System32\svchost.exe[1092] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\System32\svchost.exe[1092] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\System32\svchost.exe[1092] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\spoolsv.exe[1136] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\spoolsv.exe[1136] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\spoolsv.exe[1136] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\spoolsv.exe[1136] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\spoolsv.exe[1136] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\spoolsv.exe[1136] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\spoolsv.exe[1136] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\spoolsv.exe[1136] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\spoolsv.exe[1136] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\spoolsv.exe[1136] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\System32\svchost.exe[1188] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\System32\svchost.exe[1188] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1188] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\System32\svchost.exe[1188] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\System32\svchost.exe[1188] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\System32\svchost.exe[1188] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\System32\svchost.exe[1188] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\System32\svchost.exe[1188] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\System32\svchost.exe[1188] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\System32\svchost.exe[1188] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\svchost.exe[1244] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001401F8
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001403FC
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00381014
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00380804
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00380A08
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00380C0C
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00380E10
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003801F8
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003803FC
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00380600
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00390804
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00390A08
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00390600
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003901F8
.text C:\Program Files\FolderSize\FolderSizeSvc.exe[1368] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003903FC
.text C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1440] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\System32\svchost.exe[1440] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1612] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1612] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1612] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Documents and Settings\Shaggyman\Desktop\Bleeping Help\gmer.exe[1768] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Documents and Settings\Shaggyman\Desktop\Bleeping Help\gmer.exe[1768] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001401F8
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001403FC
.text C:\WINDOWS\System32\nvsvc32.exe[1804] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\nvsvc32.exe[1804] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00380804
.text C:\WINDOWS\System32\nvsvc32.exe[1804] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00380A08
.text C:\WINDOWS\System32\nvsvc32.exe[1804] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00380600
.text C:\WINDOWS\System32\nvsvc32.exe[1804] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003801F8
.text C:\WINDOWS\System32\nvsvc32.exe[1804] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003803FC
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00391014
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00390804
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00390A08
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00390C0C
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00390E10
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003901F8
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003903FC
.text C:\WINDOWS\System32\nvsvc32.exe[1804] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00390600
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001401F8
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001403FC
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00380804
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00380A08
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00380600
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003801F8
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003803FC
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00391014
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00390804
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00390A08
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00390C0C
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00390E10
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003901F8
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003903FC
.text C:\PROGRA~1\DATACA~1\FLashKsk.exe[2364] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00390600
.text C:\WINDOWS\System32\alg.exe[2492] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\System32\alg.exe[2492] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\alg.exe[2492] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\System32\alg.exe[2492] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\alg.exe[2492] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002B0804
.text C:\WINDOWS\System32\alg.exe[2492] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002B0A08
.text C:\WINDOWS\System32\alg.exe[2492] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002B0600
.text C:\WINDOWS\System32\alg.exe[2492] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002B01F8
.text C:\WINDOWS\System32\alg.exe[2492] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002B03FC
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002C1014
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002C0804
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002C0A08
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002C0C0C
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002C0E10
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002C01F8
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002C03FC
.text C:\WINDOWS\System32\alg.exe[2492] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002C0600
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00390804
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00390A08
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00390600
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003901F8
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003903FC
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 003A1014
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 003A0804
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 003A0A08
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 003A0C0C
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 003A0E10
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003A01F8
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003A03FC
.text C:\Program Files\CleanMem\Mini_Monitor.exe[2516] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 003A0600
.text C:\Program Files\AVAST Software\Avast\avastUI.exe[2532] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\AVAST Software\Avast\avastUI.exe[2532] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\wscntfy.exe[2572] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\system32\wscntfy.exe[2572] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\wscntfy.exe[2572] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\system32\wscntfy.exe[2572] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\wscntfy.exe[2572] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002D0804
.text C:\WINDOWS\system32\wscntfy.exe[2572] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002D0A08
.text C:\WINDOWS\system32\wscntfy.exe[2572] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002D0600
.text C:\WINDOWS\system32\wscntfy.exe[2572] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002D01F8
.text C:\WINDOWS\system32\wscntfy.exe[2572] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002D03FC
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002E1014
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002E0804
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002E0A08
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002E0C0C
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002E0E10
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002E01F8
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002E03FC
.text C:\WINDOWS\system32\wscntfy.exe[2572] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002E0600
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002B1014
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002B0804
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002B0A08
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002B0C0C
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002B0E10
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002B01F8
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002B03FC
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002B0600
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002C0600
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\System32\wbem\wmiprvse.exe[2588] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002C03FC
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001401F8
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001403FC
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 003C1014
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 003C0804
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 003C0A08
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 003C0C0C
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 003C0E10
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003C01F8
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003C03FC
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 003C0600
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 003D0804
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 003D0A08
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 003D0600
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003D01F8
.text C:\Program Files\Microsoft ActiveSync\wcescomm.exe[2676] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003D03FC
.text C:\WINDOWS\system32\devldr32.exe[2704] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000801F8
.text C:\WINDOWS\system32\devldr32.exe[2704] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\devldr32.exe[2704] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000803FC
.text C:\WINDOWS\system32\devldr32.exe[2704] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002C1014
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002C0C0C
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002C0E10
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\devldr32.exe[2704] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\devldr32.exe[2704] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002D0804
.text C:\WINDOWS\system32\devldr32.exe[2704] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002D0A08
.text C:\WINDOWS\system32\devldr32.exe[2704] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002D0600
.text C:\WINDOWS\system32\devldr32.exe[2704] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002D01F8
.text C:\WINDOWS\system32\devldr32.exe[2704] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002D03FC
.text C:\WINDOWS\system32\ctfmon.exe[2824] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000A01F8
.text C:\WINDOWS\system32\ctfmon.exe[2824] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\system32\ctfmon.exe[2824] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000A03FC
.text C:\WINDOWS\system32\ctfmon.exe[2824] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002C1014
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002C0804
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002C0A08
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002C0C0C
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002C0E10
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002C01F8
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002C03FC
.text C:\WINDOWS\system32\ctfmon.exe[2824] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002C0600
.text C:\WINDOWS\system32\ctfmon.exe[2824] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002D0804
.text C:\WINDOWS\system32\ctfmon.exe[2824] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002D0A08
.text C:\WINDOWS\system32\ctfmon.exe[2824] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002D0600
.text C:\WINDOWS\system32\ctfmon.exe[2824] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002D01F8
.text C:\WINDOWS\system32\ctfmon.exe[2824] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002D03FC
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001401F8
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001403FC
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 003A1014
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 003A0804
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 003A0A08
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 003A0C0C
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 003A0E10
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 003A01F8
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 003A03FC
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 003A0600
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 003B0804
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 003B0A08
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 003B0600
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 003B01F8
.text C:\PROGRA~1\MICROS~3\rapimgr.exe[3140] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 003B03FC
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 001501F8
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 001503FC
.text C:\Program Files\Tenda\W311U\UI.exe[3256] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 00651014
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 00650804
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 00650A08
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 00650C0C
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 00650E10
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 006501F8
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 006503FC
.text C:\Program Files\Tenda\W311U\UI.exe[3256] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 00650600
.text C:\Program Files\Tenda\W311U\UI.exe[3256] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00660804
.text C:\Program Files\Tenda\W311U\UI.exe[3256] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 00660A08
.text C:\Program Files\Tenda\W311U\UI.exe[3256] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 00660600
.text C:\Program Files\Tenda\W311U\UI.exe[3256] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 006601F8
.text C:\Program Files\Tenda\W311U\UI.exe[3256] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 006603FC
.text C:\WINDOWS\explorer.exe[3732] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8
.text C:\WINDOWS\explorer.exe[3732] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62]
.text C:\WINDOWS\explorer.exe[3732] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC
.text C:\WINDOWS\explorer.exe[3732] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002C1014
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002C0804
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002C0A08
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002C0C0C
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002C0E10
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002C01F8
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002C03FC
.text C:\WINDOWS\explorer.exe[3732] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002C0600
.text C:\WINDOWS\explorer.exe[3732] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002D0804
.text C:\WINDOWS\explorer.exe[3732] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002D0A08
.text C:\WINDOWS\explorer.exe[3732] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002D0600
.text C:\WINDOWS\explorer.exe[3732] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002D01F8
.text C:\WINDOWS\explorer.exe[3732] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002D03FC

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[792] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 005E0002
IAT C:\WINDOWS\system32\services.exe[792] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 005E0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x46 0x47 0x15 0xB0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x6B 0x65 0x49 0x6A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...

---- EOF - GMER 1.0.15 ----

#4 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 13 October 2011 - 12:00 AM

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

µTorrent

I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Also available here.

My recommendation is you go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).



Step # 1: Download and Run ComboFix

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

*Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

When finished, it shall produce a log for you. Please post C:\ComboFix.txt in your next reply.

MalWare Removal University Master

Member of ASAP
unite_Invision.png


#5 Shaggyman

Shaggyman
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 13 October 2011 - 09:15 AM

Deleted the executable for UTorrent (not listed in Add/Remove programs) and removed entries from Documents and Settings...Application Data.

Here is the ComboFix Log:

ComboFix 11-10-13.02 - Shaggyman 10/13/2011 8:35.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.754 [GMT -5:00]
Running from: c:\documents and settings\Shaggyman\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\MSN Gaming Zone\lobby.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-13 to 2011-10-13 )))))))))))))))))))))))))))))))
.
.
2011-10-12 14:10 . 2001-08-23 12:00 119808 -c--a-w- c:\windows\system32\dllcache\winmine.exe
2011-10-12 14:10 . 2001-08-23 12:00 119808 ----a-w- c:\windows\system32\winmine.exe
2011-10-12 14:08 . 2001-08-23 12:00 56832 -c--a-w- c:\windows\system32\dllcache\sol.exe
2011-10-12 14:08 . 2001-08-23 12:00 56832 ----a-w- c:\windows\system32\sol.exe
2011-10-11 15:42 . 2011-10-11 15:42 -------- d-----w- c:\program files\CleanMem
2011-10-11 15:42 . 2011-10-11 15:42 -------- d-----w- c:\windows\CleanMem
2011-10-10 18:33 . 2009-12-10 16:16 796032 ----a-w- c:\windows\system32\Scutum.dll
2011-10-10 18:33 . 2009-12-10 16:16 200704 ----a-w- c:\windows\system32\ssleay32.dll
2011-10-10 18:33 . 2009-12-10 16:16 19072 ----a-w- c:\windows\system32\drivers\Scutum50.sys
2011-10-10 18:33 . 2009-12-10 16:16 180224 ----a-w- c:\windows\system32\W32N55.dll
2011-10-10 18:33 . 2009-12-10 16:16 147456 ----a-w- c:\windows\system32\DiagFunc.dll
2011-10-10 18:33 . 2009-12-10 16:15 152968 ----a-w- c:\windows\system32\RalinkGina.dll
2011-10-10 18:31 . 2010-04-15 00:31 238944 ----a-w- c:\windows\system32\RaCoInst.dll
2011-10-10 18:31 . 2010-04-14 23:39 827488 ----a-w- c:\windows\system32\drivers\rt2870.sys
2011-10-10 18:31 . 2011-10-10 18:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Tenda Driver
2011-10-09 13:36 . 2011-10-09 13:36 -------- d-----w- c:\windows\system32\Adobe
2011-10-09 13:36 . 2011-10-09 15:35 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 13:34 . 2011-10-09 13:34 -------- d-----w- c:\windows\BACKUPS REGISTRY
2011-10-08 23:01 . 2011-10-08 23:01 -------- d-----w- c:\documents and settings\Shaggyman\Application Data\Astroburn Lite
2011-10-08 22:56 . 2011-10-08 22:57 -------- d-----w- c:\documents and settings\Shaggyman\Application Data\InfraRecorder
2011-10-08 22:13 . 2009-12-10 16:16 1085440 ----a-w- c:\windows\system32\libeay32.dll
2011-10-08 19:16 . 2011-10-08 19:16 -------- d-----w- c:\program files\AM-DeadLink
2011-10-08 18:16 . 2003-06-25 21:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2011-10-08 17:06 . 2011-10-08 17:06 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-08 05:13 . 2011-10-08 05:13 -------- d-----w- c:\documents and settings\Shaggyman\Application Data\QuickScan
2011-10-08 05:07 . 2011-10-08 05:07 -------- d-----w- c:\program files\ESET
2011-10-08 04:48 . 2011-10-08 04:48 -------- d-----w- c:\documents and settings\Shaggyman\DoctorWeb
2011-10-08 04:18 . 2011-10-08 04:19 -------- d-----w- C:\rsit
2011-10-07 14:12 . 2011-09-06 20:37 320856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-10-07 14:12 . 2011-09-06 20:36 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-10-07 14:12 . 2011-09-06 20:36 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-10-07 14:12 . 2011-09-06 20:36 52568 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-10-07 14:12 . 2011-09-06 20:38 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-10-07 14:12 . 2011-09-06 20:36 110552 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-10-07 14:12 . 2011-09-06 20:36 104536 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-10-07 14:12 . 2011-09-06 20:33 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-10-07 14:11 . 2011-09-06 20:45 41184 ----a-w- c:\windows\avastSS.scr
2011-10-07 14:11 . 2011-09-06 20:45 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-10-07 14:11 . 2011-10-07 14:11 -------- d-----w- c:\program files\AVAST Software
2011-10-07 14:11 . 2011-10-07 14:11 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-10-06 19:24 . 2011-10-06 19:24 -------- d-----w- c:\documents and settings\Shaggyman\Links
2011-10-06 17:48 . 2008-04-14 00:11 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-10-06 17:48 . 2008-04-14 00:11 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2011-10-05 18:13 . 2011-10-05 18:12 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-05 17:10 . 2011-10-05 17:10 388096 ----a-r- c:\documents and settings\Shaggyman\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-10-05 17:10 . 2011-10-08 04:19 -------- d-----w- c:\program files\Trend Micro
2011-09-27 23:10 . 2011-10-08 23:02 -------- d-----w- c:\program files\Astroburn Lite
2011-09-27 23:09 . 2011-09-27 23:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Astroburn Lite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-05 18:12 . 2010-05-01 02:47 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-04 00:01 . 2009-04-01 05:19 61440 ----a-w- c:\windows\system32\CleanMem.exe
2006-05-03 17:06 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 18:47 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 20:30 216064 --sha-r- c:\windows\system32\nbDX.dll
2010-01-07 05:00 107520 --sha-r- c:\windows\system32\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-10-07_13.36.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 05:02 . 2009-07-12 05:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
- 2009-07-12 06:05 . 2009-07-12 06:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-12 05:05 . 2009-07-12 05:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
- 2009-07-12 06:05 . 2009-07-12 06:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2011-10-12 22:53 . 2011-10-12 22:53 16384 c:\windows\temp\Perflib_Perfdata_918.dat
+ 2011-10-12 23:15 . 2011-10-12 23:15 16384 c:\windows\temp\Perflib_Perfdata_628.dat
+ 2011-10-08 22:13 . 2010-04-14 23:29 13931 c:\windows\system32\ReinstallBackups\0005\DriverFiles\RaCoInst.dat
+ 2011-10-10 18:31 . 2010-04-14 23:29 13931 c:\windows\system32\RaCoInst.dat
+ 2001-08-23 12:00 . 2007-08-13 23:36 44544 c:\windows\system32\pngfilt.dll
- 2001-08-23 12:00 . 2011-10-06 17:41 78318 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2011-10-10 18:20 78318 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2009-03-08 09:31 48128 c:\windows\system32\mshtmler.dll
+ 2001-08-23 12:00 . 2007-08-13 23:01 48128 c:\windows\system32\mshtmler.dll
- 2001-08-23 12:00 . 2009-03-08 09:31 45568 c:\windows\system32\mshta.exe
+ 2001-08-23 12:00 . 2007-08-13 23:32 45568 c:\windows\system32\mshta.exe
+ 2007-08-13 23:36 . 2007-08-13 23:36 12288 c:\windows\system32\msfeedssync.exe
+ 2011-08-02 23:08 . 2011-08-02 23:08 98304 c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 86016 c:\windows\system32\Macromed\Shockwave 10\SwMenuX.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 77824 c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
+ 2011-08-02 23:08 . 2011-08-02 23:08 24576 c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2001-08-23 12:00 . 2007-08-13 23:44 40960 c:\windows\system32\licmgr10.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 27136 c:\windows\system32\jsproxy.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 92672 c:\windows\system32\inseng.dll
+ 2001-08-23 12:00 . 2007-08-13 23:36 36352 c:\windows\system32\imgutil.dll
+ 2009-03-08 10:32 . 2007-08-13 23:39 13312 c:\windows\system32\ieudinit.exe
+ 2001-08-23 12:00 . 2007-08-13 23:39 55296 c:\windows\system32\iesetup.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 43008 c:\windows\system32\iernonce.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 54784 c:\windows\system32\ie4uinit.exe
+ 2007-08-13 23:36 . 2007-08-13 23:36 61952 c:\windows\system32\icardie.dll
+ 2011-10-10 18:31 . 2010-04-14 23:29 13931 c:\windows\system32\DRVSTORE\rt2870_C8E6DA18E82EE01CFDF0E53654201153FDE3D86E\RaCoInst.dat
+ 2007-08-13 23:36 . 2007-08-13 23:36 44544 c:\windows\system32\dllcache\pngfilt.dll
- 2009-03-08 09:31 . 2009-03-08 09:31 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2007-08-13 23:01 . 2007-08-13 23:01 48128 c:\windows\system32\dllcache\mshtmler.dll
- 2009-03-08 09:31 . 2009-03-08 09:31 45568 c:\windows\system32\dllcache\mshta.exe
+ 2007-08-13 23:32 . 2007-08-13 23:32 45568 c:\windows\system32\dllcache\mshta.exe
+ 2007-08-13 23:44 . 2007-08-13 23:44 40960 c:\windows\system32\dllcache\licmgr10.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 27136 c:\windows\system32\dllcache\jsproxy.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 92672 c:\windows\system32\dllcache\inseng.dll
+ 2007-08-13 23:36 . 2007-08-13 23:36 36352 c:\windows\system32\dllcache\imgutil.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 55296 c:\windows\system32\dllcache\iesetup.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 43008 c:\windows\system32\dllcache\iernonce.dll
+ 2010-03-07 14:23 . 2007-08-13 23:44 69120 c:\windows\system32\dllcache\iedw.exe
+ 2007-08-13 23:39 . 2007-08-13 23:39 54784 c:\windows\system32\dllcache\ie4uinit.exe
+ 2007-08-13 23:18 . 2007-08-13 23:18 60416 c:\windows\system32\dllcache\hmmapi.dll
+ 2010-03-07 15:22 . 2007-08-13 23:54 33792 c:\windows\system32\dllcache\custsat.dll
- 2010-03-07 15:22 . 2008-04-14 00:11 33792 c:\windows\system32\dllcache\custsat.dll
+ 2007-08-13 23:42 . 2007-08-13 23:42 17408 c:\windows\system32\dllcache\corpol.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 71680 c:\windows\system32\dllcache\admparse.dll
+ 2001-08-23 12:00 . 2008-04-14 00:11 35328 c:\windows\system32\corpol.dll
+ 2011-08-16 20:57 . 2011-08-16 20:57 86016 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
+ 2011-08-16 20:59 . 2011-08-16 20:59 12800 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 71680 c:\windows\system32\admparse.dll
+ 2011-10-09 13:36 . 2011-10-09 13:36 61440 c:\windows\Installer\{FF2A5498-4EFE-430F-A138-7EB365DBEBAD}\ARPPRODUCTICON.exe
+ 2011-10-11 19:04 . 2008-04-14 00:12 37888 c:\windows\ie7\url.dll
+ 2011-10-11 19:05 . 2007-08-13 23:52 66048 c:\windows\ie7\spuninst\ieResetIcons.exe
+ 2011-10-11 19:05 . 2007-08-13 23:54 32960 c:\windows\ie7\spuninst\iecustom.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 39424 c:\windows\ie7\pngfilt.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 96256 c:\windows\ie7\occache.dll
+ 2011-10-11 19:04 . 2008-04-13 16:26 56832 c:\windows\ie7\mshtmler.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 29184 c:\windows\ie7\mshta.exe
+ 2011-10-11 19:04 . 2008-04-14 00:11 22016 c:\windows\ie7\licmgr10.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 15872 c:\windows\ie7\jsproxy.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 96256 c:\windows\ie7\inseng.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 35840 c:\windows\ie7\imgutil.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 93184 c:\windows\ie7\iexplore.exe
+ 2011-10-11 19:04 . 2008-04-14 00:11 62976 c:\windows\ie7\iesetup.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 48640 c:\windows\ie7\iernonce.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 18432 c:\windows\ie7\iedw.exe
+ 2011-10-11 19:04 . 2008-04-14 00:12 34304 c:\windows\ie7\ie4uinit.exe
+ 2011-10-11 19:04 . 2008-04-14 00:11 38912 c:\windows\ie7\hmmapi.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 55808 c:\windows\ie7\extmgr.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 33792 c:\windows\ie7\custsat.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 99840 c:\windows\ie7\advpack.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 61440 c:\windows\ie7\admparse.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 653120 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 569664 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
- 2009-07-12 06:05 . 2009-07-12 06:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-12 05:05 . 2009-07-12 05:05 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2010-03-07 15:24 . 2006-07-14 15:51 121856 c:\windows\system32\xmllite.dll
- 2010-03-07 15:24 . 2009-01-07 23:21 121856 c:\windows\system32\xmllite.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 818688 c:\windows\system32\wininet.dll
+ 2007-08-13 23:45 . 2007-08-13 23:45 206336 c:\windows\system32\WinFXDocObj.exe
+ 2001-08-23 12:00 . 2007-08-13 23:54 231424 c:\windows\system32\webcheck.dll
+ 2001-08-23 12:00 . 2008-04-14 00:12 434176 c:\windows\system32\vbscript.dll
+ 2001-08-23 12:00 . 2007-08-13 23:44 105984 c:\windows\system32\url.dll
- 2001-08-23 12:00 . 2009-03-08 09:34 105984 c:\windows\system32\url.dll
+ 2011-10-08 22:13 . 2009-06-30 17:06 722432 c:\windows\system32\ReinstallBackups\0005\DriverFiles\rt2870.sys
+ 2011-10-08 22:13 . 2009-06-30 17:05 221184 c:\windows\system32\ReinstallBackups\0005\DriverFiles\RaCoInst.dll
+ 2001-08-23 12:00 . 2011-10-10 18:20 463684 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2011-10-06 17:41 463684 c:\windows\system32\perfh009.dat
+ 2001-08-23 12:00 . 2007-08-13 23:44 101376 c:\windows\system32\occache.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 670720 c:\windows\system32\mstime.dll
+ 2001-08-23 12:00 . 2007-08-13 23:44 192000 c:\windows\system32\msrating.dll
- 2001-08-23 12:00 . 2009-03-08 09:22 156160 c:\windows\system32\msls31.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 156160 c:\windows\system32\msls31.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 475648 c:\windows\system32\mshtmled.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 180224 c:\windows\system32\Macromed\Shockwave 10\Proj.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 475136 c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 339968 c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 606208 c:\windows\system32\Macromed\Shockwave 10\iml32X.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 471040 c:\windows\system32\Macromed\Shockwave 10\Control.dll
+ 2011-10-09 13:36 . 2011-10-09 13:36 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe
+ 2011-10-09 15:35 . 2011-10-09 15:35 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe
+ 2011-10-09 15:35 . 2011-10-09 15:35 335520 c:\windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.dll
+ 2001-08-23 12:00 . 2008-04-14 00:11 512000 c:\windows\system32\jscript.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 180736 c:\windows\system32\ieui.dll
+ 2007-08-13 23:34 . 2007-08-13 23:34 266752 c:\windows\system32\iertutil.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 191488 c:\windows\system32\iepeers.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 382976 c:\windows\system32\iedkcs32.dll
+ 2007-07-11 17:27 . 2007-07-11 17:27 383488 c:\windows\system32\ieapfltr.dll
+ 2001-08-23 12:00 . 2007-08-13 22:56 161792 c:\windows\system32\ieakui.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 229376 c:\windows\system32\ieaksie.dll
- 2001-08-23 12:00 . 2009-03-08 09:33 229376 c:\windows\system32\ieaksie.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 152064 c:\windows\system32\ieakeng.dll
+ 2010-03-07 14:23 . 2007-08-13 23:54 131584 c:\windows\system32\extmgr.dll
+ 2001-08-23 12:00 . 2007-08-13 23:35 214528 c:\windows\system32\dxtrans.dll
+ 2001-08-23 12:00 . 2007-08-13 23:35 346624 c:\windows\system32\dxtmsft.dll
+ 2011-10-10 18:31 . 2010-04-14 23:39 827488 c:\windows\system32\DRVSTORE\rt2870_C8E6DA18E82EE01CFDF0E53654201153FDE3D86E\rt2870.sys
+ 2011-10-10 18:31 . 2010-04-15 00:31 238944 c:\windows\system32\DRVSTORE\rt2870_C8E6DA18E82EE01CFDF0E53654201153FDE3D86E\RaCoInst.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 818688 c:\windows\system32\dllcache\wininet.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 231424 c:\windows\system32\dllcache\webcheck.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 765952 c:\windows\system32\dllcache\VGX.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 413696 c:\windows\system32\dllcache\vbscript.dll
- 2009-03-08 09:34 . 2009-03-08 09:34 105984 c:\windows\system32\dllcache\url.dll
+ 2007-08-13 23:44 . 2007-08-13 23:44 105984 c:\windows\system32\dllcache\url.dll
+ 2006-09-23 18:12 . 2006-09-23 18:12 474112 c:\windows\system32\dllcache\shlwapi.dll
- 2009-01-07 23:20 . 2009-01-07 23:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2007-08-13 23:44 . 2007-08-13 23:44 101376 c:\windows\system32\dllcache\occache.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 670720 c:\windows\system32\dllcache\mstime.dll
+ 2007-08-13 23:44 . 2007-08-13 23:44 192000 c:\windows\system32\dllcache\msrating.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 156160 c:\windows\system32\dllcache\msls31.dll
- 2001-08-23 12:00 . 2009-03-08 09:22 156160 c:\windows\system32\dllcache\msls31.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 475648 c:\windows\system32\dllcache\mshtmled.dll
+ 2007-08-13 23:38 . 2007-08-13 23:38 491520 c:\windows\system32\dllcache\jscript.dll
+ 2007-08-13 23:43 . 2007-08-13 23:43 622080 c:\windows\system32\dllcache\iexplore.exe
+ 2007-08-13 23:54 . 2007-08-13 23:54 191488 c:\windows\system32\dllcache\iepeers.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 382976 c:\windows\system32\dllcache\iedkcs32.dll
+ 2001-08-23 12:00 . 2007-08-13 22:56 161792 c:\windows\system32\dllcache\ieakui.dll
- 2009-03-08 09:33 . 2009-03-08 09:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 152064 c:\windows\system32\dllcache\ieakeng.dll
+ 2010-03-07 14:23 . 2007-08-13 23:54 131584 c:\windows\system32\dllcache\extmgr.dll
+ 2007-08-13 23:35 . 2007-08-13 23:35 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-08-13 23:35 . 2007-08-13 23:35 346624 c:\windows\system32\dllcache\dxtmsft.dll
+ 2007-08-13 23:39 . 2007-08-13 23:39 123904 c:\windows\system32\dllcache\advpack.dll
+ 2001-08-23 12:00 . 2007-08-13 23:39 123904 c:\windows\system32\advpack.dll
+ 2011-08-16 20:57 . 2011-08-16 20:57 114176 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
+ 2011-08-16 20:59 . 2011-08-16 20:59 434176 c:\windows\system32\Adobe\Shockwave 11\Proj.dll
+ 2011-08-16 20:57 . 2011-08-16 20:57 365056 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
+ 2011-08-16 20:46 . 2011-08-16 20:46 990208 c:\windows\system32\Adobe\Shockwave 11\iml32.dll
+ 2011-08-16 20:57 . 2011-08-16 20:57 542720 c:\windows\system32\Adobe\Shockwave 11\Control.dll
+ 2011-08-16 21:05 . 2011-08-16 21:05 112568 c:\windows\system32\Adobe\Director\SWDNLD.exe
+ 2011-08-16 21:04 . 2011-08-16 21:04 279480 c:\windows\system32\Adobe\Director\SwDir.dll
+ 2011-08-16 20:59 . 2011-08-16 20:59 145920 c:\windows\system32\Adobe\Director\np32dsw.dll
+ 2011-10-09 13:36 . 2011-10-09 13:36 797696 c:\windows\Installer\457a707.msi
+ 2011-10-11 19:04 . 2008-04-14 00:12 666112 c:\windows\ie7\wininet.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 276480 c:\windows\ie7\webcheck.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 851968 c:\windows\ie7\vgx.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 619520 c:\windows\ie7\urlmon.dll
+ 2011-10-11 19:05 . 2006-09-06 22:43 371424 c:\windows\ie7\spuninst\updspapi.dll
+ 2011-10-11 19:05 . 2006-09-06 22:43 213216 c:\windows\ie7\spuninst\spuninst.exe
+ 2011-10-11 19:04 . 2008-04-14 00:12 532480 c:\windows\ie7\mstime.dll
+ 2011-10-11 19:04 . 2008-04-14 00:12 146432 c:\windows\ie7\msrating.dll
+ 2011-10-11 19:04 . 2001-08-23 12:00 146432 c:\windows\ie7\msls31.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 449024 c:\windows\ie7\mshtmled.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 251904 c:\windows\ie7\iepeers.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 323584 c:\windows\ie7\iedkcs32.dll
+ 2011-10-11 19:04 . 2001-08-23 12:00 221184 c:\windows\ie7\ieakui.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 216576 c:\windows\ie7\ieaksie.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 143360 c:\windows\ie7\ieakeng.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 205312 c:\windows\ie7\dxtrans.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 357888 c:\windows\ie7\dxtmsft.dll
+ 2011-10-11 15:42 . 2011-10-11 15:42 325952 c:\windows\CleanMem\lua5.1.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
- 2009-07-12 06:02 . 2009-07-12 06:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2009-07-12 05:02 . 2009-07-12 05:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 1162240 c:\windows\system32\urlmon.dll
+ 2001-08-23 12:00 . 2007-08-13 23:54 3578368 c:\windows\system32\mshtml.dll
+ 2011-08-02 23:08 . 2011-08-02 23:08 1503232 c:\windows\system32\Macromed\Shockwave 10\dirapiX.dll
+ 2011-10-09 13:36 . 2011-10-09 13:36 8522400 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 6049280 c:\windows\system32\ieframe.dll
+ 2007-02-12 21:10 . 2007-02-12 21:10 2451312 c:\windows\system32\ieapfltr.dat
+ 2007-08-13 23:54 . 2007-08-13 23:54 1162240 c:\windows\system32\dllcache\urlmon.dll
- 2009-01-07 23:20 . 2009-01-07 23:20 1497088 c:\windows\system32\dllcache\shdocvw.dll
+ 2006-09-23 18:12 . 2006-09-23 18:12 1497088 c:\windows\system32\dllcache\shdocvw.dll
+ 2007-08-13 23:54 . 2007-08-13 23:54 3578368 c:\windows\system32\dllcache\mshtml.dll
- 2009-01-07 23:20 . 2009-01-07 23:20 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2006-09-23 18:12 . 2006-09-23 18:12 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2011-08-16 21:04 . 2011-08-16 21:04 1040824 c:\windows\system32\Adobe\Shockwave 11\SwHelper_1161629.exe
+ 2011-08-16 20:47 . 2011-08-16 20:47 1740800 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
+ 2011-10-11 19:04 . 2008-04-14 00:11 3066880 c:\windows\ie7\mshtml.dll
+ 2011-07-20 23:34 . 2011-07-20 23:34 1220672 c:\windows\Downloaded Program Files\qsax.dll
+ 2011-10-11 15:42 . 2011-10-11 15:42 1340928 c:\windows\CleanMem\uninstall.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"DataCaching"="c:\progra~1\DATACA~1\FLashKsk.exe" [2001-11-29 262144]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk.disabled [2010-7-9 1818]
HP Photosmart Premier Fast Start.lnk.disabled [2010-7-9 808]
Tenda Wireless Utility.lnk - c:\program files\Tenda\Common\RaUI.exe [2011-10-10 379392]
W311U.lnk - c:\program files\Tenda\W311U\UI.exe [2010-3-10 2170880]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-10-05 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^STIMON.lnk]
backup=c:\windows\pss\STIMON.lnkCommon Startup
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\STIMON.lnk
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
"PhotoShow Deluxe Media Manager"=c:\progra~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe"
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TrueImageMonitor.exe"=c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"PinnacleDriverCheck"=c:\windows\system32\PSDrvCheck.exe -CheckReg
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\System32\NvMcTray.dll,NvTaskbarInit
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [10/7/2011 9:12 AM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10/7/2011 9:12 AM 320856]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2/17/2010 11:25 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 11:15 AM 67664]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/7/2011 9:12 AM 20568]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [10/10/2011 1:33 PM 19072]
S3 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [11/15/2010 11:59 PM 116608]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [5/13/2011 4:13 PM 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [5/13/2011 4:13 PM 11104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 11:15 AM 12872]
S3 usbsmi;SMI USB 2.0 WebCAM;c:\windows\system32\drivers\SMIksdrv.sys [12/24/2010 6:32 PM 154880]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-13 c:\windows\Tasks\Clean System Memory.job
- c:\windows\system32\CleanMem.exe [2009-04-01 00:01]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/
uStart Page = hxxp://www.google.com/advanced_search?hl=en
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 24.121.56.24 137.118.1.33
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-13 08:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(764)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2011-10-13 08:53:18
ComboFix-quarantined-files.txt 2011-10-13 13:53
ComboFix2.txt 2011-05-09 14:55
.
Pre-Run: 166,971,789,312 bytes free
Post-Run: 167,018,926,080 bytes free
.
- - End Of File - - 3747D75C38D6F6AB6C001BC40166F1B1

#6 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 13 October 2011 - 02:12 PM

Registry Cleaners + "Tweak" Tools

Re. Eusing Free Registry Cleaner

RegScrubXP 3.25


I don't personally recommend the use of ANY Registry Cleaners or "Tweak" Tools

They are marketed as ways to make your machine run faster and more efficiently ...... Some will actually achieve this .... IF you know how to use them correctly.
Removing "Orphaned/Old/Obsolete" registry entries is fine ..... as long as they actually are "Orphaned/Old/Obsolete", it won't speed up your machine though
Stopping services and setting policies can speed up your machine ..... as long as you stop and set the right ones, and even then it's debatable if you will notice the improvement.

Remove the wrong registry entry, or stop the wrong service, and not only can you slow your machine .... you could kill it !

To use a Registry Cleaner or "Tweak" tool to its full advantage, you really need to know what it is they are doing and what else the changes may affect.
In short, if you know how to use them safely ----- you don't actually need them.

discussion on regcleaners >> http://forums.whatthetech.com/Regcleaner_t42862.html
And for more good information see what Miekiemoes has to say >> http://miekiemoes.blogspot.com/2008/02/registry-cleaners-and-system-tweaking_13.html



Step # 1 Run CCleaner

CCleaner will remove everything from the temp/temporary folders but please note that it will not make back ups!

  • Before first use, select Options > Advanced and UNCHECK Only delete files in Windows Temp folder older than 24 hours
  • Then select the items you wish to clean up.
  • In the Windows Tab:
  • Clean all entries in the Internet Explorer section except Cookies
  • Clean all the entries in the Windows Explorer section
  • Clean all entries in the System section
  • Clean all entries in the Advanced section
  • Clean any others that you choose
  • In the Applications Tab:
  • Clean all except cookies in the Firefox/Mozilla section if you use it
  • Clean all in the Opera section if you use it
  • Clean Sun Java in the Internet Section
  • Clean any others that you choose
  • Click the Run Cleaner button.
  • A pop up box will appear advising this process will permanently delete files from your system.
  • Click OK and it will scan and clean your system.
  • Click exit when done.
  • If it asks you to reboot at the end, click NO



Step # 2 Run Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware.
  • Before running a scan, click the Update tab, next click Check for Updates to download any updates, if available.
  • Next click the Scanner tab and select Perform Quick Scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • You can also access the log by doing the following:
  • Click on the Malwarebytes' Anti-Malware icon to launch the program.
  • Click on the Logs tab.
  • Click on the log at the bottom of those listed to highlight it.
  • Click Open.



In your next post/reply, I need to see the following:

1. MalwareBytes' Log
2. A fresh DDS Log

MalWare Removal University Master

Member of ASAP
unite_Invision.png


#7 Shaggyman

Shaggyman
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 13 October 2011 - 04:01 PM

MBam Log: Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7940

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

10/13/2011 3:47:34 PM
mbam-log-2011-10-13 (15-47-34).txt

Scan type: Quick scan
Objects scanned: 183941
Time elapsed: 3 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)


DDS only runs part way, then disappears.
I tried deleting DDS logs and executable, then downloading a fresh copy- but it does the same thing.
AVAST is disabled for running DDS...

#8 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 14 October 2011 - 01:32 AM

Try running DDS in Safe Mode ( You can go in Safe Mode by restarting your computer, then continually tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.) and see if it you get a log, if you do post it your next post/reply.


If DDS fails to work again, try the following:

Step # 1 Download and Run RSIT

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)


Post either the DDS or RSIT logs in your next reply. :)

MalWare Removal University Master

Member of ASAP
unite_Invision.png


#9 Shaggyman

Shaggyman
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 14 October 2011 - 08:28 AM

DDS ran fine in Safe Mode:

dds.txt

.
DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
Internet Explorer: 7.0.5730.13
Run by Shaggyman at 8:17:29 on 2011-10-14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.751 [GMT -5:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/
uStart Page = hxxp://www.google.com/advanced_search?hl=en
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [DataCaching] c:\progra~1\dataca~1\FLashKsk.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\HP Digital Imaging Monitor.lnk.disabled
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\HP Photosmart Premier Fast Start.lnk.disabled
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tendaw~1.lnk - c:\program files\tenda\common\RaUI.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\w311u.lnk - c:\program files\tenda\w311u\UI.exe
uPolicies-explorer: NoSMMyDocs = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15111/CTPID.cab
TCP: DhcpNameServer = 24.121.56.24 137.118.1.33
TCP: Interfaces\{62D9E201-0CF4-477B-BC1A-589997A00254} : DhcpNameServer = 24.121.56.24 137.118.1.33
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2011-10-10 827488]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-10-7 442200]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-10-7 320856]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 67664]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-10-7 20568]
S2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-10-7 44768]
S2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\tenda\common\RaRegistry.exe [2011-10-10 185632]
S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [2011-10-10 19072]
S3 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-11-15 116608]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2011-5-13 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2011-5-13 11104]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]
S3 usbsmi;SMI USB 2.0 WebCAM;c:\windows\system32\drivers\SMIksdrv.sys [2010-12-24 154880]
.
=============== Created Last 30 ================
.
2011-10-12 14:10:10 119808 -c--a-w- c:\windows\system32\dllcache\winmine.exe
2011-10-12 14:10:10 119808 ----a-w- c:\windows\system32\winmine.exe
2011-10-12 14:08:59 56832 -c--a-w- c:\windows\system32\dllcache\sol.exe
2011-10-12 14:08:59 56832 ----a-w- c:\windows\system32\sol.exe
2011-10-11 15:42:13 -------- d-----w- c:\windows\CleanMem
2011-10-11 15:42:13 -------- d-----w- c:\program files\CleanMem
2011-10-10 18:33:06 796032 ----a-w- c:\windows\system32\Scutum.dll
2011-10-10 18:33:06 200704 ----a-w- c:\windows\system32\ssleay32.dll
2011-10-10 18:33:06 19072 ----a-w- c:\windows\system32\drivers\Scutum50.sys
2011-10-10 18:33:06 180224 ----a-w- c:\windows\system32\W32N55.dll
2011-10-10 18:33:06 152968 ----a-w- c:\windows\system32\RalinkGina.dll
2011-10-10 18:33:06 147456 ----a-w- c:\windows\system32\DiagFunc.dll
2011-10-10 18:31:52 827488 ----a-w- c:\windows\system32\drivers\rt2870.sys
2011-10-10 18:31:52 238944 ----a-w- c:\windows\system32\RaCoInst.dll
2011-10-10 18:31:48 -------- d-----w- c:\documents and settings\all users\application data\Tenda Driver
2011-10-09 13:36:46 -------- d-----w- c:\windows\system32\Adobe
2011-10-09 13:36:19 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 13:34:07 -------- d-----w- c:\windows\BACKUPS REGISTRY
2011-10-08 23:01:38 -------- d-----w- c:\documents and settings\shaggyman\application data\Astroburn Lite
2011-10-08 22:56:36 -------- d-----w- c:\documents and settings\shaggyman\application data\InfraRecorder
2011-10-08 22:13:57 1085440 ----a-w- c:\windows\system32\libeay32.dll
2011-10-08 19:16:38 -------- d-----w- c:\program files\AM-DeadLink
2011-10-08 18:16:00 266360 ----a-w- c:\windows\system32\TweakUI.exe
2011-10-08 17:06:19 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-10-08 17:06:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-08 05:13:29 -------- d-----w- c:\documents and settings\shaggyman\application data\QuickScan
2011-10-08 05:07:22 -------- d-----w- c:\program files\ESET
2011-10-08 04:48:48 -------- d-----w- c:\documents and settings\shaggyman\DoctorWeb
2011-10-07 14:12:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-10-07 14:11:29 41184 ----a-w- c:\windows\avastSS.scr
2011-10-07 14:11:09 -------- d-----w- c:\program files\AVAST Software
2011-10-07 14:11:09 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2011-10-07 13:27:23 -------- d-sha-r- C:\cmdcons
2011-10-06 19:24:31 -------- d-----w- c:\documents and settings\shaggyman\Links
2011-10-06 17:48:08 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-10-06 17:48:08 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2011-10-05 18:13:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-05 17:10:28 388096 ----a-r- c:\documents and settings\shaggyman\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-05 17:10:26 -------- d-----w- c:\program files\Trend Micro
2011-09-27 23:10:43 -------- d-----w- c:\program files\Astroburn Lite
2011-09-27 23:09:58 -------- d-----w- c:\documents and settings\all users\application data\Astroburn Lite
.
==================== Find3M ====================
.
2011-10-05 18:12:44 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-04 00:01:30 61440 ----a-w- c:\windows\system32\CleanMem.exe
2006-05-03 17:06:54 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 18:47:16 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 20:30:52 216064 --sha-r- c:\windows\system32\nbDX.dll
2010-01-07 05:00:00 107520 --sha-r- c:\windows\system32\TAKDSDecoder.dll
.
============= FINISH: 8:18:03.85 ===============


Attach.txt
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 3/6/2010 2:37:28 PM
System Uptime: 10/14/2011 7:49:30 AM (1 hours ago)
.
Motherboard: Intel Corporation | | D845PT
Processor: Intel® Pentium® 4 CPU 2.40GHz | J1E1 | 2392/100mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 156.471 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 75 GiB total, 41.121 GiB free.
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: CNet PRO200WL PCI Fast Ethernet Adapter
Device ID: PCI\VEN_1282&DEV_9102&SUBSYS_434E4554&REV_31\4&1351887D&0&48F0
Manufacturer: CNet Technology, Inc.
Name: CNet PRO200WL PCI Fast Ethernet Adapter
PNP Device ID: PCI\VEN_1282&DEV_9102&SUBSYS_434E4554&REV_31\4&1351887D&0&48F0
Service: DM9102
.
Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: Microsoft PS/2 Mouse
Device ID: ACPI\PNP0F03\4&268D196D&0
Manufacturer: Microsoft
Name: Microsoft PS/2 Mouse
PNP Device ID: ACPI\PNP0F03\4&268D196D&0
Service: i8042prt
.
==== System Restore Points ===================
.
RP1: 10/6/2011 1:53:06 PM - Restore Operation
RP2: 10/8/2011 12:03:18 PM - OUTLOOK EXPRESS BACK
RP3: 10/8/2011 12:04:01 PM - test
RP4: 10/8/2011 12:05:44 PM - Restore Operation
RP5: 10/8/2011 2:35:23 PM - SHORTCUTS FIXED
RP6: 10/8/2011 5:13:07 PM - Installed Tenda Wireless LAN
RP7: 10/8/2011 6:00:19 PM - Removed TinyBurn
RP8: 10/9/2011 8:36:44 AM - Installed Adobe Shockwave Player 11.6.
RP9: 10/10/2011 9:20:54 AM - System Checkpoint
RP10: 10/10/2011 12:48:11 PM - Removed Tenda Wireless LAN
RP11: 10/10/2011 1:31:48 PM - Installed Tenda Wireless LAN
RP12: 10/11/2011 10:14:26 AM - Installed Microsoft Fix it 50403
RP13: 10/11/2011 2:03:05 PM - Installed Windows XP KB915865.
RP14: 10/11/2011 2:03:42 PM - Installed Windows NLSDownlevelMapping.
RP15: 10/11/2011 2:04:14 PM - Installed Windows IDNMitigationAPIs.
RP16: 10/11/2011 2:05:33 PM - Installed Windows Internet Explorer 7.
RP17: 10/11/2011 2:14:00 PM - Installed IE 7
RP18: 10/12/2011 9:33:14 PM - System Checkpoint
RP669: 10/6/2011 1:53:06 PM - Restore Operation
.
==== Installed Programs ======================
.
Accord CD Ripper Free 6.6.8
Acrobat.com
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.1
Adobe Shockwave Player 11.6
afreeCodecVT
AiO_Scan_CDA
AiOSoftwareNPI
AM-DeadLink 4.4
AnswerWorks 4.0 Runtime - English
Any Video Converter 3.2.7
Apple Application Support
Apple Software Update
Astroburn Lite
avast! Free Antivirus
Blueberry PDF Form Filler
BufferChm
C6100
c6100_Help
CCleaner
CDex - Open Source Digital Audio CD Extractor
Citrix XenApp Web Plugin
CleanMem
Cole2k Media - Codec Pack (Advanced) 7.9.5
Combined Community Codec Pack 2009-09-09
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
Data Lifeguard
Dell Driver Download Manager
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
DocumentViewer
DocumentViewerQFolder
ESET Online Scanner v3
eSupportQFolder
Eusing Free Registry Cleaner
Family Tree Maker Version 16
Fax_CDA
ffdshow v1.1.3904 [2011-06-23]
Folder Size for Windows
Free CD to MP3 Converter
FullDPAppQFolder
GeoServer 2.0.2
GIMP 2.6.11
Google Earth
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB954550-v5)
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
Java Auto Updater
Java™ 6 Update 27
K-Lite Codec Pack 5.8.3 (Full)
Kate's Video Joiner
Malwarebytes' Anti-Malware version 1.51.1.1800
Media Player Classic - Home Cinema v1.5.2.3456
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Publisher 2002
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Windows XP Video Decoder Checkup Utility
NewCopy_CDA
NVIDIA Drivers
OCR Software by I.R.I.S 7.0
PanoStandAlone
PartitionMagic 6.0
PhotoGallery
Pinnacle Hollywood FX
PrimoPDF -- brought to you by Nitro PDF Software
ProductContextNPI
QuickTime
RandMap
Readme
RegScrubXP 3.25
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
SanDisk ImageMate/SecureMate
Scan
ScanModule V5.1
ScannerCopy
SkinsHP1
SlideShow
SmartPack 1.19.0
SmartSound Quicktracks Plugin
SnapAPI
SolutionCenter
Sonic_PrimoSDK
Spybot - Search & Destroy
Status
StreamTransport version: 1.0.2.2041
Studio 9
Studio 9.4 Patch
SUPER © v2011.build.49 (July 1st, 2011) version v2011.build.49
SUPERAntiSpyware Free Edition
Tenda Wireless LAN Card
Toolbox
TrayApp
TurboTax 2009
TurboTax 2009 WinBizFedFormset
TurboTax 2009 WinBizReleaseEngine
TurboTax 2009 WinBizTaxSupport
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wrapper
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wmoiper
TurboTax 2010 wrapper
TurboTax Business 2007
TurboTax Business 2009
TurboTax Home & Business 2007
TurboTax Premier 2005
Tweak UI
Unload
USB2.0 UVC WebCam
W311U
WD Diagnostics
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinZip
Zoom Player (remove only)
.
==== Event Viewer Messages From Past Week ========
.
10/8/2011 4:01:43 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/8/2011 3:57:52 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
10/7/2011 8:18:20 AM, error: Service Control Manager [7000] - The Intuit Update Service service failed to start due to the following error: The system cannot find the file specified.
10/7/2011 11:43:06 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD aswRdr aswSP aswTdi avgio avipbb Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv StarOpen Tcpip
10/7/2011 11:43:06 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
10/7/2011 11:43:06 PM, error: Service Control Manager [7001] - The Network Location Awareness (NLA) service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
10/7/2011 11:43:06 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/7/2011 11:43:06 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/7/2011 11:43:06 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
10/14/2011 7:51:31 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 aswSnx aswSP aswTdi Fips intelppm PCLEPCI SASDIFSV SASKUTIL StarOpen
10/13/2011 8:32:19 AM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).
10/12/2011 3:01:50 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
10/10/2011 12:36:30 PM, error: Service Control Manager [7034] - The Ralink Registry Writer service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 12:19:00 PM, error: Dhcp [1002] - The IP address lease 192.168.1.65 for the Network Card with network address C83A35C34E2B has been denied by the DHCP server 192.168.1.254 (The DHCP Server sent a DHCPNACK message).
10/10/2011 11:21:20 AM, error: Service Control Manager [7034] - The Pml Driver HPZ12 service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 11:08:40 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 11:04:07 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
10/10/2011 1:24:23 PM, error: Service Control Manager [7000] - The Scutum50 NDIS Protocol Driver service failed to start due to the following error: The system cannot find the file specified.
.
==== End Of File ===========================

#10 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 14 October 2011 - 01:18 PM

Step # 1 Update Adobe Acrobat Reader

There is a newer version of Adobe Acrobat Reader available. (See Note below)

  • First, go to Add/Remove Programs and uninstall Adobe Reader 9.1.
  • Please go to this link Adobe Acrobat Reader Download Link
  • On the right Untick McAfee® Security Scan Plus if you do not wish to include this in the installation.
  • Click the Continue button
  • Click Run, and click Run again
  • Next click the Install Now button and follow the on screen prompts

Note: Adobe Reader X (10.1.1) is a large program and if you prefer a smaller program you can get Foxit 5.0.2 instead from http://www.foxitsoftware.com/downloads/index.php

If you decide to install Foxit 5.0.2 instead of Adobe, do the following during Foxit's Setup/Installation process:

Uncheck the following boxes:

I accept the License Terms and want to install Foxit Toolbar

Make Ask.com my default search

Create desktop, quick launch and start menu icon to eBay



ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here to run the scan.

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: Posted Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Posted Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Posted Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!


In your next post/reply, I need to see the following:

1. ESET Log
2. How is your computer doing, any problems?

MalWare Removal University Master

Member of ASAP
unite_Invision.png


#11 Shaggyman

Shaggyman
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 15 October 2011 - 12:48 AM

System seems to be functioning normally.

ESet log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.5730.13 (longhorn(wmbla).070711-1130)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=c5cfbd209d04f2429aa4788a13941eea
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-15 01:04:17
# local_time=2011-10-14 08:04:17 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=148756
# found=0
# cleaned=0
# scan_time=8428

#12 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 15 October 2011 - 01:43 AM

Then if there are no more problems, you're good to go. :)


You can delete the following off of your computer:

DDS.scr
The two DDS Logs
GMER.zip
GMER.exe
The GMER Log



To remove ComboFix, do the following:

Go to Start > Run - type in ComboFix /Uninstall & click OK


Empty your Recycle Bin.



Please take the time to read my All Clean Post.

Please follow these simple steps in order to keep your computer clean and secure:

This is a good time to clear your existing system restore points and establish a new clean restore point

  • Go to Start > All Programs > Accessories > System Tools > System Restore
  • Select Create a restore point, and Ok it.
  • Next, go to Start > Run and type in cleanmgr
  • Make sure the C:\ drive is selected and click OK. If your computer's Hard Drive is not located on C:, change it to the correct drive letter then click OK.
  • Select the More options tab
  • Choose the option to clean up system restore and OK it.
  • This will remove all restore points except the new one you just created.
.

Clearing your restore points is not something you should do on a regular basis. Normally, this process only needs to be done after clearing out an infestation of malware.


Make your Internet Explorer more secure This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it asks you if you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Set correct settings for files that should be hidden in Windows XP
  • Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
  • Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
  • If unchecked please checkHide protected operating system files (Recommended)
  • If necessary check "Display content of system folders"
  • If necessary Uncheck Hide file extensions for known file types.
  • Click OK
  • Use An Antivirus Software and Keep It Updated - It is very important that your computer has an antivirus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a day. If you do not update your antivirus software, then it will not be able to catch any of the new variants that may come out.
  • Visit Microsoft's Update Site Frequently It is important that you visit Microsoft Updates regularly. This will ensure your computer has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  • Install SpywareBlaster SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. You can find SpywareBlaster here:
    SpywareBlaster
  • Use the hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate web pages. We can customize a hosts file so that it blocks certain web pages. However, it can slow down certain computers. This is why using a hosts file is optional. Download mvps hosts file Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
    • Click the start button on the task bar at the bottom of your screen
    • Click run
    • In the dialog box, type services.msc
    • hit enter, then locate dns client
    • Highlight it, then doubleclick it.
    • On the dropdown box, change the setting from automatic to manual.
    • Click ok..
  • Use an alternative instant messenger program.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  • Please read Tony Klein's excellent article: How I got Infected in the First Place
  • Please read Understanding Spyware, Browser Hijackers, and Dialers
  • Please read Simple and easy ways to keep your computer safe and secure on the Internet
  • If you are using Internet Explorer, please consider using an alternate browser: Mozilla's Firefox or
    Opera.
    If you decide to use either FireFox or Opera, it is very important that you keep them up to date and check frequently for updates of the browser of your choice.
  • Update all these programs regularly Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.


Here's a good website to read about Malware prevention:

http://users.telenet.be/bluepatchy/miekiemoes/prevention.html

If your computer is running slow, click here for instructions on how to help speed up your computer.

Good luck!

Please reply one last time so that I know you have read my post and this thread can be closed.

MalWare Removal University Master

Member of ASAP
unite_Invision.png


#13 Shaggyman

Shaggyman
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:29 AM

Posted 15 October 2011 - 09:45 PM

Looks like we're back to the way we were- thanks!!

#14 km2357

km2357

  • Malware Response Team
  • 1,784 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:29 AM

Posted 16 October 2011 - 12:11 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

MalWare Removal University Master

Member of ASAP
unite_Invision.png





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users