Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Not-A-V Virus


  • This topic is locked This topic is locked
1 reply to this topic

#1 Submit2s

Submit2s

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:USA-Missouri
  • Local time:10:13 PM

Posted 03 April 2012 - 10:23 AM

Hello, I have been fighting with this virus since 3/27/2012. The OS is Windows

XP Pro. Symptoms. Popup with multiple windows from the systems: The popup window

title bar defined: Update Progress, message states: Aborted: Another installer

or an updated installation is currently running. AVG rootkit removal came up

with: filename A0021019.dl, virus name not-a-v. I manually checked documents and

settings, application data and temp folders for culprits prior to running

combofix. Didn't see anything out of the ordinary. However, combofix came back

with files within the folders I had checked prior to running; As though this

virus/rootkit attaches itself to combofix and regenerate files; at least that is

the thought I'm going with at the moment.

Steps I had taken prior to posting here for help.

1. Ran Defogger
2. Ran TDSKiller
3. Ran DDS
4. Combofix 3x
5. Full scan with Zonealarm security,
6. Ran Malware Bytes
7. Rkill
8. MGtools, logs attached.

After leaving the security forums as a helper, I did finish my Master's in MIS

and Bachelors in Network Security. I haven't been online fighting viruses in a

while, however within my community. This one has my crossing my eyes. My gut is

telling me something with Java or the MS Uninstallers, I can't tell because

everything I see looks legitimate; have glasses and still can't see, lol

__________________________________________________

Hello, I have been fighting with this virus since 3/27/2012. The OS is Windows

XP Pro. Symptoms. Popup with multiple windows from the systems: The popup window

title bar defined: Update Progress, message states: Aborted: Another installer

or an updated installation is currently running. AVG rootkit removal came up

with: filename A0021019.dl, virus name not-a-v. I manually checked documents and

settings, application data and temp folders for culprits prior to running

combofix. Didn't see anything out of the ordinary. However, combofix came back

with files within the folders I had checked prior to running; As though this

virus/rootkit attaches itself to combofix and regenerate files; at least that is

the thought I'm going with at the moment.

Steps I had taken prior to posting here for help.

1. Ran Defogger
2. Ran TDSKiller
3. Ran DDS
4. Combofix 3x
5. Full scan with Zonealarm security,
6. Ran Malware Bytes
7. Rkill
8. MGtools, logs attached.

After leaving the security forums as a helper, I did finish my Master's in MIS

and Bachelors in Network Security. I haven't been online fighting viruses in a

while, however, have been within my community. This one has my crossing my eyes.

My gut is telling me something with Java/Flash or the MS Uninstallers, I can't

tell because everything I see looks legitimate or I have been looking at this too

long; have glasses and still can't see, lol.

Combofix Log, 3/27/2012
ComboFix 12-03-27.03 - Tyra Ross 03/27/2012 15:34:41.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.445 [GMT -5:00]
Running from: c:\documents and settings\Tyra Ross\Desktop\ComboFix.exe
FW: ZoneAlarm Extreme Security Firewall *Enabled* {829BDA32-94B3-44F4-8446-

F8FCFF809F8B}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions

)))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\SPL2B.tmp
c:\documents and settings\All Users\SPL44.tmp
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\dllcache\wmpvis.dll
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\msssc.dll
c:\windows\system32\oobe\msoobe.err
.
.
((((((((((((((((((((((((( Files Created from 2012-02-27 to 2012-03-27

)))))))))))))))))))))))))))))))
.
.
2012-03-27 19:14 . 2012-03-27 19:16 -------- d-----w- C:\rsit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report

))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-12 13:27 . 2011-06-29 18:41 414368 ----a-w- c:\windows

\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:22 . 2001-08-18 14:00 1860096 ----a-w- c:\windows

\system32\win32k.sys
2012-01-11 19:06 . 2012-02-16 22:14 3072 ------w- c:\windows

\system32\iacenc.dll
2012-01-09 16:20 . 2009-07-10 01:17 139784 ----a-w- c:\windows

\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points

))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security

\prxtbZon2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-

5964de3ab546}]
2011-05-09 09:49 176936 ----a-w- c:\program files

\ZoneAlarm_Security\prxtbZon2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security

\prxtbZon2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security

\prxtbZon2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2011-04-01 2228536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2005-06-21 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2005-06-21 126976]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08

69632]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-11-10 73360]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-11-03

738944]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27

434080]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Zoom Wireless-G USB.lnk - c:\program files\Zoom Wireless-G USB\WLANUTL.exe [2009

-7-9 770048]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer

\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop

Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi2"=ma_cmidn.dll
"Midi3"=evolusbn.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tyra Ross^Start

Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\documents and settings\Tyra Ross\Start Menu\Programs\Startup\Logitech .

Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe

ARM]
2012-01-02 15:07 843712 ----a-r- c:\program files\Common Files

\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe

Reader Speed Launcher]
2012-01-04 03:51 37296 ----a-w- c:\program files\Adobe\Reader

9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-25 10:01 1397760 ------w- c:\program files\Ahead\InCD

\InCD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark

5600-6600 Series Fax Server]
2008-05-30 01:04 311976 ----a-w- c:\program files\Lexmark 5600-

6600 Series\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech

Vid]
2009-04-30 20:39 5472016 ----a-w- c:\program files\Logitech

\Logitech Vid\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-08-12 17:18 205336 ----a-w- c:\program files\Logitech\LWS

\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxduamon]
2008-05-30 01:04 16040 ----a-w- c:\program files\Lexmark 5600-

6600 Series\lxduamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\lxdumon.exe]
2008-05-30 01:04 676520 ----a-w- c:\program files\Lexmark 5600-

6600 Series\lxdumon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger

\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-10-12 00:25 1961984 ------w- c:\program files\Ahead\Nero

BackItUp\NBJ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\NeroFilterCheck]
2006-01-12 21:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\SunJavaUpdateSched]
2010-02-18 16:43 248040 ----a-w- c:\program files\Common Files

\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-14 22:07 39408 ----a-w- c:\program files\Google

\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-19 01:05 204288 ------w- c:\program files\Windows Media

Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring

\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile

\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\lxducoms.exe"=
"c:\\Program Files\\Lexmark 5600-6600 Series\\lxduamon.exe"=
"c:\\Program Files\\Lexmark 5600-6600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark 5600-6600 Series\\lxdufax.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
3;4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN

v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-

03-18 130384]
R2 EvoInstallerService;M-Audio Installer;c:\program files\M-Audio\Install

\EvoInst.exe [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update

\GoogleUpdate.exe [2011-02-16 136176]
R3 EVOLUSB;%EVOL_USB.SvcDesc%;c:\windows\system32\drivers\evolusb.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update

\GoogleUpdate.exe [2011-02-16 136176]
R3 RDID1078;Roland Fantom G;c:\windows\system32\Drivers\rdwm1078.sys [2007-12-11

136320]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:

\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-

18 753504]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-10-14 11352]
S2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField

\ISWKL.sys [2011-11-03 27016]
S2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField

\IswSvc.exe [2011-11-03 497280]
S2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe [2008-05-24 594600]
S2 lxduCATSCustConnectService;lxduCATSCustConnectService;c:\windows

\System32\spool\DRIVERS\W32X86\3\\lxduserv.exe [2008-05-24 98984]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

[2011-08-19 450848]
S3 dalwdmservice;dal service;c:\windows\system32\drivers\dalwdm.sys [2003-09-02

70144]
S3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [2011-11-03

36744]
S3 XG762NXP;Zoom 802.11g XG762 Driver;c:\windows\system32\DRIVERS\WlanUZXP.sys

[2008-03-27 519168]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - klmd25
*Deregistered* - Normandy
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-16 18:17]
.
2012-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-16 18:17]
.
2012-03-27 c:\windows\Tasks\User_Feed_Synchronization-{59444A25-747E-4BAF-A5E4-

2C86DC53B954}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
uInternet Settings,ProxyServer = http=127.0.0.1:52505
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} -

hxxp://filedownload.att.net/Gh/Rainforest_Adventure_Web/Game/gamehouseplayer.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

http://www.gmer.net
Rootkit scan 2012-03-27 16:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1202660629-2049760794-682003330-1003\Software\SecuROM\!

CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:43,f0,f8,e3,58,ca,9e,fc,f0,14,4e,ce,dd,6b,b2,3c,3a,36,31,7e,54,60,2a,
c7,40,1b,b3,de,79,36,81,18,a5,4f,da,db,b4,b9,0b,bb,78,fd,f5,12,b3,f8,59,ac,\
"??"=hex:22,ef,c9,6c,1e,ab,c5,22,3d,c7,49,51,c1,4d,c3,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(676)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
.
- - - - - - - > 'lsass.exe'(732)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
.
- - - - - - - > 'csrss.exe'(652)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2012-03-27 17:36:09
ComboFix-quarantined-files.txt 2012-03-27 22:35
.
Pre-Run: 63,774,625,792 bytes free
Post-Run: 63,810,531,328 bytes free
.
- - End Of File - - FF2C2ECF63431C725325AB760DF2A3EC

____________________________________________________________
combofix 3/30/2012

ComboFix 12-03-30.06 - Tyra Ross 03/30/2012 15:34:02.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.476 [GMT -5:00]
Running from: c:\documents and settings\Tyra Ross\Desktop\ComboFix.exe
FW: ZoneAlarm Extreme Security Firewall *Enabled* {829BDA32-94B3-44F4-8446-

F8FCFF809F8B}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions

)))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\mydnswatch
.
.
((((((((((((((((((((((((( Files Created from 2012-02-28 to 2012-03-30

)))))))))))))))))))))))))))))))
.
.
2012-03-30 20:22 . 2012-03-30 20:25 -------- d-----w- C:

\32788R22FWJFW
2012-03-30 19:51 . 2012-03-30 19:51 -------- d-----w- c:

\windows\LastGood
2012-03-30 18:13 . 2007-01-18 12:00 3968 ----a-w- c:\windows

\system32\drivers\AvgArCln.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report

))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-12 13:27 . 2011-06-29 18:41 414368 ----a-w- c:\windows

\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:22 . 2001-08-18 14:00 1860096 ----a-w- c:\windows

\system32\win32k.sys
2012-01-11 19:06 . 2012-02-16 22:14 3072 ------w- c:\windows

\system32\iacenc.dll
2012-01-09 16:20 . 2009-07-10 01:17 139784 ----a-w- c:\windows

\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points

))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security

\prxtbZon2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-

5964de3ab546}]
2011-05-09 09:49 176936 ----a-w- c:\program files

\ZoneAlarm_Security\prxtbZon2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security

\prxtbZon2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security

\prxtbZon2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2005-06-21 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2005-06-21 126976]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08

69632]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-11-10 73360]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-11-03

738944]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Zoom Wireless-G USB.lnk - c:\program files\Zoom Wireless-G USB\WLANUTL.exe [2009

-7-9 770048]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer

\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop

Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"Midi2"=ma_cmidn.dll
"Midi3"=evolusbn.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^Tyra Ross^Start

Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\documents and settings\Tyra Ross\Start Menu\Programs\Startup\Logitech .

Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe

ARM]
2012-01-02 15:07 843712 ----a-r- c:\program files\Common Files

\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe

Reader Speed Launcher]
2012-01-04 03:51 37296 ----a-w- c:\program files\Adobe\Reader

9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2011-04-01 16:25 2228536 ----a-w- c:\program files\CCleaner

\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2005-07-25 10:01 1397760 ------w- c:\program files\Ahead\InCD

\InCD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark

5600-6600 Series Fax Server]
2008-05-30 01:04 311976 ----a-w- c:\program files\Lexmark 5600-

6600 Series\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech

Vid]
2009-04-30 20:39 5472016 ----a-w- c:\program files\Logitech

\Logitech Vid\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-08-12 17:18 205336 ----a-w- c:\program files\Logitech\LWS

\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxduamon]
2008-05-30 01:04 16040 ----a-w- c:\program files\Lexmark 5600-

6600 Series\lxduamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\lxdumon.exe]
2008-05-30 01:04 676520 ----a-w- c:\program files\Lexmark 5600-

6600 Series\lxdumon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger

\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-10-12 00:25 1961984 ------w- c:\program files\Ahead\Nero

BackItUp\NBJ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\NeroFilterCheck]
2006-01-12 21:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg

\SunJavaUpdateSched]
2010-02-18 16:43 248040 ----a-w- c:\program files\Common Files

\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-14 22:07 39408 ----a-w- c:\program files\Google

\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-19 01:05 204288 ------w- c:\program files\Windows Media

Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"gusvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring

\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile

\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\lxducoms.exe"=
"c:\\Program Files\\Lexmark 5600-6600 Series\\lxduamon.exe"=
"c:\\Program Files\\Lexmark 5600-6600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark 5600-6600 Series\\lxdufax.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [10/14/2010 5:08 PM 11352]
R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField

\ISWKL.sys [10/19/2011 5:18 AM 27016]
R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField

\ISWSVC.exe [10/19/2011 5:18 AM 497280]
R2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe -service --> c:

\windows\system32\lxducoms.exe -service [?]
R2 lxduCATSCustConnectService;lxduCATSCustConnectService;c:\windows

\system32\spool\drivers\w32x86\3\lxduserv.exe [7/10/2009 10:58 AM 98984]
R2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe

[8/19/2011 4:26 AM 450848]
R3 dalwdmservice;dal service;c:\windows\system32\drivers\Dalwdm.sys [5/3/2011

5:36 PM 70144]
R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [11/3/2011

9:44 AM 36744]
R3 XG762NXP;Zoom 802.11g XG762 Driver;c:\windows\system32\drivers\WlanUZXP.SYS

[7/9/2009 8:28 PM 519168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN

v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

[3/18/2010 1:16 PM 130384]
S2 EvoInstallerService;M-Audio Installer;c:\program files\M-Audio\Install

\EvoInst.exe --> c:\program files\M-Audio\Install\EvoInst.exe [?]
S3 EVOLUSB;%EVOL_USB.SvcDesc%;c:\windows\system32\drivers\evolusb.sys --> c:

\windows\system32\drivers\evolusb.sys [?]
S3 RDID1078;Roland Fantom G;c:\windows\system32\drivers\RDWM1078.sys [9/16/2009

2:28 PM 136320]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:

\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010

1:16 PM 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update

\GoogleUpdate.exe [2/16/2011 1:17 PM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update

\GoogleUpdate.exe [2/16/2011 1:17 PM 136176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-16 18:17]
.
2012-03-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-16 18:17]
.
2012-03-30 c:\windows\Tasks\User_Feed_Synchronization-{59444A25-747E-4BAF-A5E4-

2C86DC53B954}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

http://www.gmer.net
Rootkit scan 2012-03-30 16:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1202660629-2049760794-682003330-1003\Software\SecuROM\!

CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:43,f0,f8,e3,58,ca,9e,fc,f0,14,4e,ce,dd,6b,b2,3c,3a,36,31,7e,54,60,2a,
c7,40,1b,b3,de,79,36,81,18,a5,4f,da,db,b4,b9,0b,bb,78,fd,f5,12,b3,f8,59,ac,\
"??"=hex:22,ef,c9,6c,1e,ab,c5,22,3d,c7,49,51,c1,4d,c3,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(676)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
.
- - - - - - - > 'lsass.exe'(732)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
.
- - - - - - - > 'explorer.exe'(3708)
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-

ww_44262b86\MSVCR80.dll
c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
c:\program files\CheckPoint\ZoneAlarm\MailFrontier\mlfhook.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
- - - - - - - > 'csrss.exe'(652)
c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
.
Completion time: 2012-03-30 16:21:50
ComboFix-quarantined-files.txt 2012-03-30 21:21
ComboFix2.txt 2012-03-30 18:37
ComboFix3.txt 2012-03-27 22:36
.
Pre-Run: 67,660,042,240 bytes free
Post-Run: 67,645,476,864 bytes free
.
- - End Of File - - 59DE8359B038B405CE37DAEFD996682B
_________________________________________________________
TDS Killer log

2012/03/27 14:12:03.0140 TDSS rootkit removing tool 2.4.13.0 Jan 12 2011

09:51:11
2012/03/27 14:12:03.0156

================================================================================
2012/03/27 14:12:03.0156 SystemInfo:
2012/03/27 14:12:03.0156
2012/03/27 14:12:03.0156 OS Version: 5.1.2600 ServicePack: 3.0
2012/03/27 14:12:03.0156 Product type: Workstation
2012/03/27 14:12:03.0156 ComputerName: TYRA-PC
2012/03/27 14:12:03.0156 UserName: Tyra Ross
2012/03/27 14:12:03.0156 Windows directory: C:\WINDOWS
2012/03/27 14:12:03.0156 System windows directory: C:\WINDOWS
2012/03/27 14:12:03.0156 Processor architecture: Intel x86
2012/03/27 14:12:03.0156 Number of processors: 1
2012/03/27 14:12:03.0156 Page size: 0x1000
2012/03/27 14:12:03.0156 Boot type: Normal boot
2012/03/27 14:12:03.0156

================================================================================
2012/03/27 14:12:03.0859 Initialize success
2012/03/27 14:12:07.0156

================================================================================
2012/03/27 14:12:07.0156 Scan started
2012/03/27 14:12:07.0156 Mode: Manual;
2012/03/27 14:12:07.0156

================================================================================
2012/03/27 14:12:08.0171 ACPI

(8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2012/03/27 14:12:08.0265 ACPIEC

(9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2012/03/27 14:12:08.0437 aeaudio

(e696e749bedcda8b23757b8b5ea93780) C:\WINDOWS\system32\drivers\aeaudio.sys
2012/03/27 14:12:08.0593 aec

(8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2012/03/27 14:12:08.0687 AFD

(1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
2012/03/27 14:12:09.0343 AsyncMac

(b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2012/03/27 14:12:09.0562 atapi

(9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2012/03/27 14:12:09.0703 Atmarpc

(9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2012/03/27 14:12:09.0812 audstub

(d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2012/03/27 14:12:09.0875 Beep

(da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2012/03/27 14:12:10.0078 cbidf2k

(90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2012/03/27 14:12:10.0187 CCDECODE

(0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2012/03/27 14:12:10.0359 Cdaudio

(c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2012/03/27 14:12:10.0468 Cdfs

(c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2012/03/27 14:12:10.0578 Cdrom

(1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2012/03/27 14:12:11.0109 dalwdmservice

(5346bca8a12c00a409d16d2d249ea2cd) C:\WINDOWS\system32\drivers\dalwdm.sys
2012/03/27 14:12:11.0218 Disk

(044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2012/03/27 14:12:11.0359 dmboot

(d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2012/03/27 14:12:11.0500 dmio

(7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2012/03/27 14:12:11.0562 dmload

(e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2012/03/27 14:12:11.0687 DMusic

(8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2012/03/27 14:12:11.0875 drmkaud

(8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2012/03/27 14:12:12.0031 E100B

(ac9cf17ee2ae003c98eb4f5336c38058) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2012/03/27 14:12:12.0281 Fastfat

(38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2012/03/27 14:12:12.0359 Fdc

(92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2012/03/27 14:12:12.0468 Fips

(d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2012/03/27 14:12:12.0562 Flpydisk

(9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2012/03/27 14:12:12.0656 FltMgr

(b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2012/03/27 14:12:13.0015 Fs_Rec

(3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2012/03/27 14:12:13.0062 Ftdisk

(6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2012/03/27 14:12:13.0265 Gpc

(0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2012/03/27 14:12:13.0421 hidusb

(ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2012/03/27 14:12:13.0640 HTTP

(f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2012/03/27 14:12:13.0875 i8042prt

(4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2012/03/27 14:12:14.0000 ialm

(44b7d5a4f2bd9fe21aea0bb0bace38c4) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2012/03/27 14:12:14.0218 icsak

(670ef65b025e10826c83e79cba252144) C:\Program Files\CheckPoint\ZAForceField\AK

\icsak.sys
2012/03/27 14:12:14.0359 Imapi

(083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\drivers\Imapi.sys
2012/03/27 14:12:14.0468 InCDfs

(d075ec26f410e5fe1cc3688bcf78609f) C:\WINDOWS\system32\drivers\InCDfs.sys
2012/03/27 14:12:14.0531 InCDPass

(1267811f30ceccb72e97dc33742abea2) C:\WINDOWS\system32\DRIVERS\InCDPass.sys
2012/03/27 14:12:14.0609 InCDrec

(bb4e2c719b745e27e55edbcb1230c205) C:\WINDOWS\system32\drivers\InCDrec.sys
2012/03/27 14:12:14.0687 incdrm

(9589d693b003d2a4d044a2476a827e11) C:\WINDOWS\system32\drivers\incdrm.sys
2012/03/27 14:12:14.0937 intelppm

(8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2012/03/27 14:12:15.0000 ip6fw

(3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2012/03/27 14:12:15.0062 IpFilterDriver

(731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2012/03/27 14:12:15.0125 IpInIp

(b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2012/03/27 14:12:15.0218 IpNat

(cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2012/03/27 14:12:15.0296 IPSec

(23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2012/03/27 14:12:15.0359 IRENUM

(c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2012/03/27 14:12:15.0437 isapnp

(05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2012/03/27 14:12:15.0562 ISWKL

(08a811bfd207dfdec588881c18bacbaa) C:\Program Files\CheckPoint\ZAForceField

\ISWKL.sys
2012/03/27 14:12:15.0718 Kbdclass

(463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2012/03/27 14:12:15.0812 kbdhid

(9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2012/03/27 14:12:15.0906 KL1

(94d67d49bd9503bb1d838405d80f2058) C:\WINDOWS\system32\DRIVERS\kl1.sys
2012/03/27 14:12:15.0968 kl2

(713576569667ac9e0f8556076004a96b) C:\WINDOWS\system32\DRIVERS\kl2.sys
2012/03/27 14:12:16.0062 KLIF

(f934de04ac53b08457b92db6e4dee2e5) C:\WINDOWS\system32\DRIVERS\klif.sys
2012/03/27 14:12:16.0234 kmixer

(692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2012/03/27 14:12:16.0328 KSecDD

(b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2012/03/27 14:12:16.0640 LVRS

(7521c0c58ee91be90b6cc33e792d10c7) C:\WINDOWS\system32\DRIVERS\lvrs.sys
2012/03/27 14:12:16.0906 LVUVC

(37e57c48af530df01cdd4e8a2ad77b51) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
2012/03/27 14:12:17.0828 mnmdd

(4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2012/03/27 14:12:18.0093 Modem

(dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2012/03/27 14:12:18.0390 Mouclass

(35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2012/03/27 14:12:18.0703 mouhid

(b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2012/03/27 14:12:18.0984 MountMgr

(a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2012/03/27 14:12:19.0359 MRxDAV

(11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2012/03/27 14:12:19.0703 MRxSmb

(7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2012/03/27 14:12:19.0828 Msfs

(c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2012/03/27 14:12:20.0171 MSKSSRV

(d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2012/03/27 14:12:20.0515 MSPCLOCK

(325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2012/03/27 14:12:20.0781 MSPQM

(bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2012/03/27 14:12:21.0093 mssmbios

(af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2012/03/27 14:12:21.0390 MSTEE

(e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2012/03/27 14:12:21.0593 Mup

(de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2012/03/27 14:12:21.0890 NABTSFEC

(5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2012/03/27 14:12:22.0109 NDIS

(1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2012/03/27 14:12:22.0453 NdisIP

(7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2012/03/27 14:12:22.0671 NdisTapi

(0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2012/03/27 14:12:22.0875 Ndisuio

(f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2012/03/27 14:12:23.0171 NdisWan

(edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2012/03/27 14:12:23.0640 NDProxy

(9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2012/03/27 14:12:23.0906 NetBIOS

(5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2012/03/27 14:12:24.0406 NetBT

(74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2012/03/27 14:12:24.0734 Npfs

(3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2012/03/27 14:12:25.0031 Ntfs

(78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2012/03/27 14:12:25.0484 Null

(73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2012/03/27 14:12:25.0953 NwlnkFlt

(b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2012/03/27 14:12:26.0078 NwlnkFwd

(c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2012/03/27 14:12:26.0343 Parport

(5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2012/03/27 14:12:26.0843 PartMgr

(beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2012/03/27 14:12:27.0296 ParVdm

(70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2012/03/27 14:12:27.0625 PCI

(a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2012/03/27 14:12:28.0015 PCIIde

(ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2012/03/27 14:12:28.0296 Pcmcia

(9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2012/03/27 14:12:29.0390 PptpMiniport

(efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2012/03/27 14:12:29.0875 Processor

(a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2012/03/27 14:12:30.0203 PSched

(09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2012/03/27 14:12:30.0640 Ptilink

(80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2012/03/27 14:12:31.0171 RasAcd

(fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2012/03/27 14:12:31.0562 Rasl2tp

(11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2012/03/27 14:12:31.0828 RasPppoe

(5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2012/03/27 14:12:32.0187 Raspti

(fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2012/03/27 14:12:32.0515 Rdbss

(7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2012/03/27 14:12:32.0859 RDID1078

(0bbd4451a94585c05db12d6a36c8b8a0) C:\WINDOWS\system32\Drivers\rdwm1078.sys
2012/03/27 14:12:33.0046 RDPCDD

(4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2012/03/27 14:12:33.0343 rdpdr

(15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2012/03/27 14:12:33.0703 RDPWD

(5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
2012/03/27 14:12:34.0000 redbook

(f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2012/03/27 14:12:34.0312 RimUsb

(0f6756ef8bda6dfa7be50465c83132bb) C:\WINDOWS\system32\Drivers\RimUsb.sys
2012/03/27 14:12:34.0421 RimVSerPort

(d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
2012/03/27 14:12:34.0656 ROOTMODEM

(d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2012/03/27 14:12:34.0953 Secdrv

(90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2012/03/27 14:12:35.0265 serenum

(0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2012/03/27 14:12:35.0578 Serial

(cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2012/03/27 14:12:35.0953 Sfloppy

(8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2012/03/27 14:12:36.0296 SLIP

(866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2012/03/27 14:12:36.0468 smwdm

(fa3368a7039f5abaa4b933703ac34763) C:\WINDOWS\system32\drivers\smwdm.sys
2012/03/27 14:12:36.0875 splitter

(ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2012/03/27 14:12:37.0125 sr

(76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2012/03/27 14:12:37.0593 Srv

(47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2012/03/27 14:12:37.0890 streamip

(77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2012/03/27 14:12:38.0046 swenum

(3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2012/03/27 14:12:38.0359 swmidi

(8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2012/03/27 14:12:39.0031 sysaudio

(8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2012/03/27 14:12:39.0375 Tcpip

(9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2012/03/27 14:12:39.0750 TDPIPE

(6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2012/03/27 14:12:40.0093 TDTCP

(c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2012/03/27 14:12:40.0437 TermDD

(88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2012/03/27 14:12:40.0890 Udfs

(5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2012/03/27 14:12:41.0218 Update

(402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2012/03/27 14:12:41.0593 usbaudio

(e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2012/03/27 14:12:41.0734 usbccgp

(173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2012/03/27 14:12:42.0031 usbehci

(65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2012/03/27 14:12:42.0312 usbhub

(1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2012/03/27 14:12:42.0640 usbprint

(a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2012/03/27 14:12:42.0937 usbscan

(a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2012/03/27 14:12:43.0234 usbstor

(a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2012/03/27 14:12:43.0562 usbuhci

(26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2012/03/27 14:12:43.0890 usbvideo

(63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2012/03/27 14:12:44.0187 VgaSave

(0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2012/03/27 14:12:44.0562 VolSnap

(4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2012/03/27 14:12:44.0890 Vsdatant

(558cee3d9c470651f1843d51b42d761b) C:\WINDOWS\system32\vsdatant.sys
2012/03/27 14:12:45.0250 Wanarp

(e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2012/03/27 14:12:45.0640 wdmaud

(6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2012/03/27 14:12:46.0078 WpdUsb

(cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2012/03/27 14:12:46.0484 WSTCODEC

(c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2012/03/27 14:12:46.0671 WudfPf

(f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2012/03/27 14:12:46.0968 WudfRd

(28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2012/03/27 14:12:47.0218 XG762NXP

(a25a32a5b54b4c57d3d9da90024db37e) C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys
2012/03/27 14:12:47.0531 ZDCNDIS5

(1e206ae7b474b393e97a14c7769ba9a4) C:\WINDOWS\System32\ZDCNDIS5.sys
2012/03/27 14:12:47.0765

================================================================================
2012/03/27 14:12:47.0765 Scan finished
2012/03/27 14:12:47.0765

================================================================================
2012/03/27 14:13:20.0703 Deinitialize success


I appreciate your help in advance.

Attached File  MGlogs.zip   99.34KB   0 downloads
"We are what we think, All that we are arises in our thoughts; with our thoughts, we make the world. You can make your world or break your world by your thinking." Buddha~

BC AdBot (Login to Remove)

 


#2 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,768 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:04:13 AM

Posted 09 April 2012 - 06:49 AM

Hi,

I see you are getting help elsewhere: http://www.geekstogo.com/forum/topic/316526-not-a-v-virus%3B-file-a0021019dl-cannot-be-found-update-progress-me/
http://www.spywareinfoforum.com/index.php?/topic/133464-virus-with-update-progress-aborted-another-installer-or-an-update-installations-is-currently-running/

therefore I will go ahead and close this thread.

regards myrti

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users