What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Clickover.cn Google Redirect, No access to Microsoft.c

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've read over a few of the threads in this forum and I've seen some similiar problems but not all in the same thread. The topic title is essentially a long-story-short, but recently I have noticed that certain Google links will redirect me to a website clickover.cn and then return me back to the Google Search Results. I tried doing searches through both Yahoo! and Bing, and certain links would redirect me to clickover.cn and then take me back to Google's Search Results rather than Yahoo! or Bing. I tried to see what the virus was and, it was at that time, I noticed I couldn't access websites like Microsoft.com or Symantec.com. I was able to download some anti-virus/spyware/malware programs (Ad-Aware, AVG, Avira, Malwarebytes) through download.com but only Malwarebytes was able to connect to the internet. The others just came back with error's about not being about to connect.

My hosts file used to contain 127.0.0.1 jl.chura.pl at the very top of the file and to eliminate it, I deleted it from the Notepad file and then after saving, made my hosts file a read-only file. I'm not sure if that eliminates jl.chura.pl from my laptop, but it no longer appears in my hosts file.

I've also noticed over the last 2 weeks or so that my laptop can't hybernate, or at least not like it should. My laptop acts as though it is going to hybernate but it does not save my Windows session and my laptop stays on.

My laptop is a Gateway 7330GZ with a Pentium 4 CPU, 3.06GHz, and 480 MB of RAM. It's running on Microsoft Windows XP Home Edition Version 2002 Service Pack 3, if that matters. I've read some of the threads here and it seems like the service is quite exquisite and I'd love to have my laptop running normally again. Here is the log from HJT…
————————————————————————————————————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:03 PM, on 8/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe
C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SunKist] C:\Program Files\Digital Media Reader\shwicon2k.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [StxTrayMenu] "C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: AutoBackup Launcher.lnk = C:\Program Files\Memeo\AutoBackup\MemeoLauncher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {571CB303-4267-4D92-B45C-9B79ACC18632} (PotWeb Control) - http://potplayer.daum.net/PotPlayer/v2/PotWeb.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AutoBackup (BMUService) - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee AntiSpyware Real-Time Scanner (McAfeeAntiSpyware) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 11482 bytes
Post #2
Hi,

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done two logs should open:
  • DDS.txt
  • Attach.txt
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Right-click gmer.exe and select Run As Administrator. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
Post the contents of GMER.txt in your next reply.
Post #3 last edited
I was running GMER and a blue screen appeared with this message and I have no clue what to do now: —————————————————————————————- A problem has been detected and Windows has been shut down to prevent damage to your computer. DRIVER_IRQL_NOT_LESS_OR_EQUAL If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps: Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need. If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode. Technical Information: *** STOP: 0x000000D1 (0xE198C000, 0x00000002, 0x00000000, 0xEE35DA4B) Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group for further assistance.
Post #4
Try running it in Safe Mode (restart computer and tap F8 before Windows loads). If that still doesn't work, give this one a go instead:

Please download RootRepeal to your desktop
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
  • Click the Report tab at the bottom and then the Scan button.
  • A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
  • Reconnect to the internet.
  • Post the log here in your reply.

I would still like the DDS logs as well.
Post #5
I tried running GMER in safe mode and after taking forever to complete, it froze my computer. I'll try that other method you posted above. For now, here are the DDS and Attach documents. DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 12:49:58.89 on Wed 08/05/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.88 [GMT -4:00] AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\igfxtray.exe C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.google.com/ie uSearch Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: CNisExtBho Class: {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar4.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton internet security\norton antivirus\NavShExt.dll TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll TB: Norton Internet Security: {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton internet security\norton antivirus\NavShExt.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar4.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [Aim6] uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\mcupdate.exe mRun: [_AntiSpyware] c:\program files\mcafee\mcafee antispyware\MssCli.exe mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE mRun: [] mRun: [SunKist] c:\program files\digital media reader\shwicon2k.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Symantec NetDriver Monitor] c:\progra~1\symnet~1\SNDMon.exe /Consumer mRun: [McRegWiz] c:\progra~1\mcafee.com\agent\McRegWiz.exe /autorun mRun: [Pure Networks Port Magic] "c:\progra~1\purene~1\portma~1\PortAOL.exe" -Run mRun: [StxTrayMenu] "c:\program files\seagate\systemtray\StxMenuMgr.exe" mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide StartupFolder: c:\docume~1\owner\startm~1\programs\startup\autoba~1.lnk - c:\program files\memeo\autobackup\MemeoLauncher.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ciscos~1.lnk - c:\program files\cisco systems\vpn client\vpngui.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\device~1.lnk - c:\program files\olympus\devicedetector\DevDtct2.exe IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_02\bin\npjpi150_02.dll IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab DPF: {571CB303-4267-4D92-B45C-9B79ACC18632} - hxxp://potplayer.daum.net/PotPlayer/v2/PotWeb.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {D821DC4A-0814-435E-9820-661C543A4679} - hxxp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: McAfee AntiSpyware Shell Extension: {f2a0229a-c4ca-4789-b606-973d24dcdd1c} - c:\program files\mcafee\mcafee antispyware\MssShell.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\tb57uy2h.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en FF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\tb57uy2h.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071302000002.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava11.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava12.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava13.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava14.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJava32.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJPI150_02.dll FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-3 64160] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-7-28 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-7-28 72944] R1 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\SAVRT.SYS [2004-7-23 336008] R1 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\SAVRTPEL.SYS [2004-7-23 50312] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCEVTMGR.EXE [2004-8-27 198256] R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\CCPROXY.EXE [2004-8-27 235120] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSETMGR.EXE [2004-8-27 165488] R2 McAfeeAntiSpyware;McAfee AntiSpyware Real-Time Scanner;c:\program files\mcafee\mcafee antispyware\Msssrv.exe [2004-11-17 110592] R2 navapsvc;Norton AntiVirus Auto-Protect Service;c:\program files\norton internet security\norton antivirus\NAVAPSVC.EXE [2004-8-30 177264] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-2-16 45056] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20051130.006\NAVENG.Sys [2005-11-30 77816] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20051130.006\NavEx15.Sys [2005-11-30 750424] S2 SBService;ScriptBlocking Service;c:\progra~1\common~1\symant~1\script~1\SBServ.exe [2004-8-30 67184] S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-8-27 79472] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456] S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2005-5-21 270336] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-7-28 7408] S3 SAVScan;SAVScan;c:\program files\norton internet security\norton antivirus\SAVSCAN.EXE [2004-7-23 198368] S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2006-9-3 280344] =============== Created Last 30 ================ 2009-08-05 12:14 –d—– c:\program files\Trend Micro 2009-08-04 02:47 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2009-08-04 02:46 –d—– c:\program files\SUPERAntiSpyware 2009-08-04 02:46 –d—– c:\docume~1\owner\applic~1\SUPERAntiSpyware.com 2009-08-04 02:46 –d—– c:\program files\common files\Wise Installation Wizard 2009-08-04 01:18 –d—– c:\docume~1\owner\applic~1\Malwarebytes 2009-08-04 01:17 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-04 01:17 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-08-04 01:17 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-08-04 01:17 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-08-03 03:20 –d—– c:\docume~1\owner\applic~1\AVG8 2009-08-03 03:18 15,688 a——- c:\windows\system32\lsdelete.exe 2009-08-03 02:49 64,160 a——- c:\windows\system32\drivers\Lbd.sys 2009-08-03 02:46 -cd-h— c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864} 2009-08-03 02:45 –d—– c:\program files\Lavasoft 2009-08-02 20:52 –dsh— c:\documents and settings\owner\IECompatCache 2009-07-28 11:32 –d—– c:\docume~1\owner\applic~1\Logs 2009-07-17 00:55 3,248 a——- c:\windows\system32\wbem\Outlook_01ca069ac9b3636c.mof 2009-07-13 20:18 –d—– c:\documents and settings\owner\.dvdcss 2009-07-13 20:14 –d—– C:\Next DVD Ripper 2009-07-13 20:14 –d—– c:\program files\Next DVD Ripper ==================== Find3M ==================== 2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll 2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll 2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll 2009-05-13 01:15 915,456 a——- c:\windows\system32\wininet.dll 2006-09-02 16:30 8,146 a——- c:\docume~1\owner\applic~1\wklnhst.dat 2005-08-31 04:17 0 a–sh— c:\windows\sminst\HPCD.sys 2008-09-26 22:11 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092620080927\index.dat ============= FINISH: 12:52:20.84 ===============

Attachments:

Post #6
Here is the log from Root Repeal: ——————————————————— ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/05 16:03 Program Version: Version 1.3.3.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xEE352000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7DCB000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP9500 Image Path: \Driver\PCI_PNP9500 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xECB15000 Size: 49152 File Visible: No Signed: - Status: - Name: spse.sys Image Path: spse.sys Address: 0xF76E8000 Size: 1048576 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: Volume C:\ Status: MBR Rootkit Detected! Path: Volume C:\, Sector 2 Status: Sector mismatch Path: Volume C:\, Sector 3 Status: Sector mismatch Path: Volume C:\, Sector 5 Status: Sector mismatch Path: Volume C:\, Sector 6 Status: Sector mismatch Path: Volume C:\, Sector 7 Status: Sector mismatch Path: Volume C:\, Sector 10 Status: Sector mismatch Path: Volume C:\, Sector 11 Status: Sector mismatch Path: Volume C:\, Sector 12 Status: Sector mismatch Path: Volume C:\, Sector 15 Status: Sector mismatch Path: Volume C:\, Sector 19 Status: Sector mismatch Path: Volume C:\, Sector 22 Status: Sector mismatch Path: Volume C:\, Sector 24 Status: Sector mismatch Path: Volume C:\, Sector 25 Status: Sector mismatch Path: Volume C:\, Sector 26 Status: Sector mismatch Path: Volume C:\, Sector 27 Status: Sector mismatch Path: Volume C:\, Sector 28 Status: Sector mismatch Path: Volume C:\, Sector 29 Status: Sector mismatch Path: Volume C:\, Sector 30 Status: Sector mismatch Path: Volume C:\, Sector 31 Status: Sector mismatch Path: Volume C:\, Sector 32 Status: Sector mismatch Path: Volume C:\, Sector 34 Status: Sector mismatch Path: Volume C:\, Sector 37 Status: Sector mismatch Path: Volume C:\, Sector 38 Status: Sector mismatch Path: Volume C:\, Sector 42 Status: Sector mismatch Path: Volume C:\, Sector 43 Status: Sector mismatch Path: Volume C:\, Sector 44 Status: Sector mismatch Path: Volume C:\, Sector 45 Status: Sector mismatch Path: Volume C:\, Sector 47 Status: Sector mismatch Path: Volume C:\, Sector 50 Status: Sector mismatch Path: Volume C:\, Sector 55 Status: Sector mismatch Path: Volume C:\, Sector 58 Status: Sector mismatch Path: Volume C:\, Sector 61 Status: Sector mismatch Path: Volume C:\, Sector 62 Status: Sector mismatch Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: c:\program files\superantispyware\sasinst.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntuninstallkb896358$\hh.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntuninstallkb896423$\spoolsv.exe Status: Allocation size mismatch (API: 57344, Raw: 49152) Path: c:\windows\$ntuninstallkb896688$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb905915$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb912812$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb916281$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb918899$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb920213$\agentsvr.exe Status: Allocation size mismatch (API: 196608, Raw: 188416) Path: c:\windows\$ntuninstallkb922582$\fltmc.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntuninstallkb922760$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb923561$\wordpad.exe Status: Allocation size mismatch (API: 151552, Raw: 131072) Path: c:\windows\$ntuninstallkb925454$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb928090$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb931768$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb933566$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb937143$\iedw.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallkb938828$\explorer.exe Status: Allocation size mismatch (API: 634880, Raw: 618496) Path: c:\windows\$ntuninstallkb939683$\unregmp2.exe Status: Allocation size mismatch (API: 184320, Raw: 172032) Path: c:\windows\$ntservicepackuninstall$\accwiz.exe Status: Allocation size mismatch (API: 106496, Raw: 98304) Path: c:\windows\$ntservicepackuninstall$\actmovie.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\cmdl32.exe Status: Allocation size mismatch (API: 57344, Raw: 40960) Path: c:\windows\$ntservicepackuninstall$\conime.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\dllhost.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\extrac32.exe Status: Allocation size mismatch (API: 61440, Raw: 40960) Path: c:\windows\$ntservicepackuninstall$\ftp.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntservicepackuninstall$\ss3dfo.scr Status: Allocation size mismatch (API: 512000, Raw: 495616) Path: c:\windows\$ntservicepackuninstall$\ssbezier.scr Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\ssmarque.scr Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\ssmypics.scr Status: Allocation size mismatch (API: 57344, Raw: 36864) Path: c:\windows\$ntservicepackuninstall$\ssmyst.scr Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\sspipes.scr Status: Allocation size mismatch (API: 409600, Raw: 389120) Path: c:\windows\$ntservicepackuninstall$\ssstars.scr Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\qprocess.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\rasphone.exe Status: Allocation size mismatch (API: 57344, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\rcimlby.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\rcp.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\notepad.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\nppagent.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\nslookup.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\icwconn1.exe Status: Allocation size mismatch (API: 122880, Raw: 102400) Path: c:\windows\$ntservicepackuninstall$\icwconn2.exe Status: Allocation size mismatch (API: 73728, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\icwrmind.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\iexpress.exe Status: Allocation size mismatch (API: 98304, Raw: 81920) Path: c:\windows\$ntservicepackuninstall$\cisvc.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\cleanmgr.exe Status: Allocation size mismatch (API: 65536, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\cliconfg.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\clipbrd.exe Status: Allocation size mismatch (API: 90112, Raw: 69632) Path: c:\windows\$ntservicepackuninstall$\clipsrv.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\userinit.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\utilman.exe Status: Allocation size mismatch (API: 57344, Raw: 40960) Path: c:\windows\$ntservicepackuninstall$\verclsid.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\msiexec.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\wmiprvse.exe Status: Allocation size mismatch (API: 147456, Raw: 126976) Path: c:\windows\$ntservicepackuninstall$\winhlp32.exe Status: Allocation size mismatch (API: 233472, Raw: 212992) Path: c:\windows\$ntservicepackuninstall$\winlogon.exe Status: Allocation size mismatch (API: 389120, Raw: 368640) Path: c:\windows\$ntservicepackuninstall$\winver.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\vssvc.exe Status: Allocation size mismatch (API: 180224, Raw: 159744) Path: c:\windows\$ntservicepackuninstall$\wab.exe Status: Allocation size mismatch (API: 53248, Raw: 32768) Path: c:\windows\$ntservicepackuninstall$\wabmig.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\tourstart.exe Status: Allocation size mismatch (API: 212992, Raw: 192512) Path: c:\windows\$ntservicepackuninstall$\tracert.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\tzchange.exe Status: Allocation size mismatch (API: 65536, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\sysocmgr.exe Status: Allocation size mismatch (API: 77824, Raw: 57344) Path: c:\windows\$ntservicepackuninstall$\taskmgr.exe Status: Allocation size mismatch (API: 110592, Raw: 90112) Path: c:\windows\$ntservicepackuninstall$\telnet.exe Status: Allocation size mismatch (API: 73728, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\stimon.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\svchost.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\scardsvr.exe Status: Allocation size mismatch (API: 86016, Raw: 65536) Path: c:\windows\$ntservicepackuninstall$\scrcons.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntservicepackuninstall$\scrnsave.scr Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\sdbinst.exe Status: Allocation size mismatch (API: 77824, Raw: 57344) Path: c:\windows\$ntservicepackuninstall$\skeys.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\smbinst.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\smlogsvc.exe Status: Allocation size mismatch (API: 81920, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\sndrec32.exe Status: Allocation size mismatch (API: 114688, Raw: 94208) Path: c:\windows\$ntservicepackuninstall$\sort.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\spider.exe Status: Allocation size mismatch (API: 397312, Raw: 376832) Path: c:\windows\$ntservicepackuninstall$\spnpinst.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\spoolsv.exe Status: Allocation size mismatch (API: 57344, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\shmgrate.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntservicepackuninstall$\shrpubw.exe Status: Allocation size mismatch (API: 53248, Raw: 32768) Path: c:\windows\$ntservicepackuninstall$\shutdown.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\sigverif.exe Status: Allocation size mismatch (API: 53248, Raw: 32768) Path: c:\windows\$ntservicepackuninstall$\rsh.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\rstrui.exe Status: Allocation size mismatch (API: 241664, Raw: 233472) Path: c:\windows\$ntservicepackuninstall$\rtcshare.exe Status: Allocation size mismatch (API: 81920, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\rundll32.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\runonce.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\rdsaddin.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\rdshost.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\reg.exe Status: Allocation size mismatch (API: 53248, Raw: 36864) Path: c:\windows\$ntservicepackuninstall$\oobebaln.exe Status: Allocation size mismatch (API: 57344, Raw: 40960) Path: c:\windows\$ntservicepackuninstall$\osk.exe Status: Allocation size mismatch (API: 147456, Raw: 126976) Path: c:\windows\$ntservicepackuninstall$\packager.exe Status: Allocation size mismatch (API: 65536, Raw: 57344) Path: c:\windows\$ntservicepackuninstall$\perfmon.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\oemig50.exe Status: Allocation size mismatch (API: 65536, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\ntvdm.exe Status: Allocation size mismatch (API: 339968, Raw: 319488) Path: c:\windows\$ntservicepackuninstall$\odbcad32.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\odbcconf.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\net1.exe Status: Allocation size mismatch (API: 114688, Raw: 106496) Path: c:\windows\$ntservicepackuninstall$\netdde.exe Status: Allocation size mismatch (API: 98304, Raw: 81920) Path: c:\windows\$ntservicepackuninstall$\netsetup.exe Status: Allocation size mismatch (API: 331776, Raw: 311296) Path: c:\windows\$ntservicepackuninstall$\netsh.exe Status: Allocation size mismatch (API: 57344, Raw: 36864) Path: c:\windows\$ntservicepackuninstall$\netstat.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\narrator.exe Status: Allocation size mismatch (API: 61440, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\nddeapir.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\mstinit.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\mstsc.exe Status: Allocation size mismatch (API: 245760, Raw: 225280) Path: c:\windows\$ntservicepackuninstall$\moviemk.exe Status: Allocation size mismatch (API: 2293760, Raw: 2273280) Path: c:\windows\$ntservicepackuninstall$\mplay32.exe Status: Allocation size mismatch (API: 106496, Raw: 98304) Path: c:\windows\$ntservicepackuninstall$\mplayer2.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\msdtc.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\migload.exe Status: Allocation size mismatch (API: 94208, Raw: 73728) Path: c:\windows\$ntservicepackuninstall$\migwiz.exe Status: Allocation size mismatch (API: 139264, Raw: 118784) Path: c:\windows\$ntservicepackuninstall$\mmc.exe Status: Allocation size mismatch (API: 544768, Raw: 524288) Path: c:\windows\$ntservicepackuninstall$\mnmsrvc.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\mobsync.exe Status: Allocation size mismatch (API: 122880, Raw: 102400) Path: c:\windows\$ntservicepackuninstall$\mofcomp.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\rdpclip.exe Status: Allocation size mismatch (API: 65536, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\lsass.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\magnify.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\makecab.exe Status: Allocation size mismatch (API: 86016, Raw: 65536) Path: c:\windows\$ntservicepackuninstall$\ipconfig.exe Status: Allocation size mismatch (API: 53248, Raw: 45056) Path: c:\windows\$ntservicepackuninstall$\ipv6.exe Status: Allocation size mismatch (API: 65536, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\ipxroute.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\grpconv.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntservicepackuninstall$\help.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\helpctr.exe Status: Allocation size mismatch (API: 512000, Raw: 491520) Path: c:\windows\$ntservicepackuninstall$\helpsvc.exe Status: Allocation size mismatch (API: 495616, Raw: 475136) Path: c:\windows\$ntservicepackuninstall$\hh.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\hscupd.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\findstr.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\fltmc.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\fontview.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\forcedos.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\fsquirt.exe Status: Allocation size mismatch (API: 98304, Raw: 94208) Path: c:\windows\$ntservicepackuninstall$\dplaysvr.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\dpnsvr.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\dpvsetup.exe Status: Allocation size mismatch (API: 81920, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\dmadmin.exe Status: Allocation size mismatch (API: 184320, Raw: 163840) Path: c:\windows\$ntservicepackuninstall$\dmremote.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\dfrgfat.exe Status: Allocation size mismatch (API: 81920, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\dfrgntfs.exe Status: Allocation size mismatch (API: 98304, Raw: 77824) Path: c:\windows\$ntservicepackuninstall$\dialer.exe Status: Allocation size mismatch (API: 303104, Raw: 282624) Path: c:\windows\$ntservicepackuninstall$\diantz.exe Status: Allocation size mismatch (API: 86016, Raw: 65536) Path: c:\windows\$ntservicepackuninstall$\diskpart.exe Status: Allocation size mismatch (API: 135168, Raw: 114688) Path: c:\windows\$ntservicepackuninstall$\dcomcnfg.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\ddeshare.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\defrag.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\cscript.exe Status: Allocation size mismatch (API: 77824, Raw: 57344) Path: c:\windows\$ntservicepackuninstall$\ctfmon.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\cmmon32.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntservicepackuninstall$\cmstp.exe Status: Allocation size mismatch (API: 65536, Raw: 61440) Path: c:\windows\$ntservicepackuninstall$\comrepl.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\comrereg.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\windows\$ntservicepackuninstall$\conf.exe Status: Allocation size mismatch (API: 544768, Raw: 528384) Path: c:\windows\$ntservicepackuninstall$\attrib.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\auditusr.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\blastcln.exe Status: Allocation size mismatch (API: 73728, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\agentsvr.exe Status: Allocation size mismatch (API: 196608, Raw: 188416) Path: c:\windows\$ntservicepackuninstall$\pinball.exe Status: Allocation size mismatch (API: 200704, Raw: 180224) Path: c:\windows\$ntservicepackuninstall$\ping.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\powercfg.exe Status: Allocation size mismatch (API: 57344, Raw: 40960) Path: c:\windows\$ntservicepackuninstall$\progman.exe Status: Allocation size mismatch (API: 65536, Raw: 45056) Path: c:\windows\$ntservicepackuninstall$\proquota.exe Status: Allocation size mismatch (API: 61440, Raw: 45056) Path: c:\windows\$ntservicepackuninstall$\proxycfg.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\msmsgs.exe Status: Allocation size mismatch (API: 1183744, Raw: 1175552) Path: c:\windows\$ntservicepackuninstall$\msoobe.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\mspaint.exe Status: Allocation size mismatch (API: 249856, Raw: 229376) Path: c:\windows\$ntservicepackuninstall$\dumprep.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\dvdupgrd.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\dwwin.exe Status: Allocation size mismatch (API: 155648, Raw: 139264) Path: c:\windows\$ntservicepackuninstall$\dxdiag.exe Status: Allocation size mismatch (API: 667648, Raw: 655360) Path: c:\windows\$ntservicepackuninstall$\eudcedit.exe Status: Allocation size mismatch (API: 151552, Raw: 147456) Path: c:\windows\$ntservicepackuninstall$\explorer.exe Status: Allocation size mismatch (API: 626688, Raw: 614400) Path: c:\windows\$ntservicepackuninstall$\wscntfy.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\wscript.exe Status: Allocation size mismatch (API: 90112, Raw: 73728) Path: c:\windows\$ntservicepackuninstall$\wbemtest.exe Status: Allocation size mismatch (API: 98304, Raw: 81920) Path: c:\windows\$ntservicepackuninstall$\wiaacmgr.exe Status: Allocation size mismatch (API: 299008, Raw: 278528) Path: c:\windows\$ntservicepackuninstall$\imapi.exe Status: Allocation size mismatch (API: 126976, Raw: 106496) Path: c:\windows\$ntservicepackuninstall$\inetwiz.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\logonui.exe Status: Allocation size mismatch (API: 274432, Raw: 266240) Path: c:\windows\$ntservicepackuninstall$\net.exe Status: Allocation size mismatch (API: 53248, Raw: 32768) Path: c:\windows\$ntservicepackuninstall$\at.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\atmadm.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\msconfig.exe Status: Allocation size mismatch (API: 122880, Raw: 102400) Path: c:\windows\$ntservicepackuninstall$\uploadm.exe Status: Allocation size mismatch (API: 122880, Raw: 102400) Path: c:\windows\$ntservicepackuninstall$\upnpcont.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\ups.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\services.exe Status: Allocation size mismatch (API: 102400, Raw: 77824) Path: c:\windows\$ntservicepackuninstall$\sessmgr.exe Status: Allocation size mismatch (API: 114688, Raw: 94208) Path: c:\windows\$ntservicepackuninstall$\sethc.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\setup.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntservicepackuninstall$\setup50.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\windows\$ntservicepackuninstall$\locator.exe Status: Allocation size mismatch (API: 73728, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\logman.exe Status: Allocation size mismatch (API: 61440, Raw: 53248) Path: c:\windows\$ntservicepackuninstall$\logon.scr Status: Allocation size mismatch (API: 90112, Raw: 69632) Path: c:\windows\$ntservicepackuninstall$\ahui.exe Status: Allocation size mismatch (API: 94208, Raw: 73728) Path: c:\windows\$ntservicepackuninstall$\alg.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntservicepackuninstall$\wordpad.exe Status: Allocation size mismatch (API: 151552, Raw: 126976) Path: c:\windows\$ntservicepackuninstall$\wpabaln.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\wpnpinst.exe Status: Allocation size mismatch (API: 45056, Raw: 24576) Path: c:\windows\$ntservicepackuninstall$\cacls.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\xcopy.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntservicepackuninstall$\savedump.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\windows\$ntservicepackuninstall$\sstext3d.scr Status: Allocation size mismatch (API: 483328, Raw: 462848) Path: c:\windows\$ntservicepackuninstall$\regedit.exe Status: Allocation size mismatch (API: 114688, Raw: 94208) Path: c:\windows\$ntservicepackuninstall$\regsvr32.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntservicepackuninstall$\rexec.exe Status: Allocation size mismatch (API: 28672, Raw: 8192) Path: c:\windows\$ntuninstallkb887472$\msmsgs.exe Status: Allocation size mismatch (API: 1159168, Raw: 1138688) Path: c:\windows\$ntuninstallkb951978$\cscript.exe Status: Allocation size mismatch (API: 114688, Raw: 94208) Path: c:\windows\$ntuninstallkb951978$\wscript.exe Status: Allocation size mismatch (API: 118784, Raw: 98304) Path: c:\windows\$ntuninstallkb952069_wm9$\logagent.exe Status: Allocation size mismatch (API: 94208, Raw: 73728) Path: c:\windows\$ntuninstallkb956572$\sc.exe Status: Allocation size mismatch (API: 40960, Raw: 20480) Path: c:\windows\$ntuninstallkb956572$\services.exe Status: Allocation size mismatch (API: 98304, Raw: 77824) Path: c:\windows\$ntuninstallkb956572$\wmiprvse.exe Status: Allocation size mismatch (API: 147456, Raw: 126976) Path: C:\WINDOWS\system32\vsfocejkvtqpxe.dat Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\vsfoceltenqrfr.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\vsfocervtkjapu.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\vsfoceuurjnswy.dat Status: Invisible to the Windows API! Path: c:\windows\$ntuninstallwmfdist11$\logagent.exe Status: Allocation size mismatch (API: 94208, Raw: 73728) Path: c:\windows\$ntuninstallwmfdist11$\uwdf.exe Status: Allocation size mismatch (API: 53248, Raw: 36864) Path: c:\windows\$ntuninstallwmfdist11$\wdfmgr.exe Status: Allocation size mismatch (API: 49152, Raw: 28672) Path: c:\windows\$ntuninstallwmfdist11$\wmsetsdk.exe Status: Allocation size mismatch (API: 499712, Raw: 479232) Path: c:\windows\$ntuninstallwmp11$\setup_wm.exe Status: Allocation size mismatch (API: 499712, Raw: 479232) Path: c:\windows\$ntuninstallwmp11$\unregmp2.exe Status: Allocation size mismatch (API: 126976, Raw: 122880) Path: c:\windows\$ntuninstallwmp11$\wmlaunch.exe Status: Allocation size mismatch (API: 102400, Raw: 94208) Path: c:\windows\$ntuninstallwmp11$\wmpenc.exe Status: Allocation size mismatch (API: 36864, Raw: 16384) Path: c:\windows\$ntuninstallwmp11$\wmplayer.exe Status: Allocation size mismatch (API: 69632, Raw: 49152) Path: c:\system volume information\_restore{d23eff2a-bfef-46a5-8364-d064e372df2b}\rp1188\a0208504.exe Status: Allocation size mismatch (API: 24576, Raw: 4096) Path: c:\system volume information\_restore{d23eff2a-bfef-46a5-8364-d064e372df2b}\rp1193\a0210018.exe Status: Allocation size mismatch (API: 32768, Raw: 12288) Path: c:\system volume information\_restore{d23eff2a-bfef-46a5-8364-d064e372df2b}\rp1193\a0210024.exe Status: Allocation size mismatch (API: 65536, Raw: 45056) Path:==EOF==
Post #7
Hi,

Looks like you've got a nasty Rootkit on board.

If you have ComboFix on your machine already, please delete it.

Please download ComboFix to your desktop from one of these locations. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]
  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #8
I downloaded Combofix and followed the steps and when I tried to run it, I got a message saying:
———————-


!! ALERT !! It is NOT SAFE to continue!

The contents of the ComboFix package has been compromised. Please download a fresh copy from:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Note: You may be infected with a file patching virus 'Virut'

———————-

I then tried to download Combofix from Link 2 and was unable to connect to their server much like how I can't connect to microsoft.com, symantec.com and others. I was able to download Combofix from Link 3, but when I tried to run it, I got the same message that I have written above. I haven't gone to the site listed in the message and I wanted to know how you want me to proceed. Thank you again!
Post #9
OK, we need to check whether or not you indeed have Virut.
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page

    C:\WINDOWS\system32\svchost.exe

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.
  • Please repeat for the following file:
    C:\WINDOWS\system32\userinit.exe
I also want to check out another possible area for concern. Please download mbr.exe by GMER. Save it to your desktop.
  • Double click on mbr.exe to execute.
    If you recieve the "Publisher could not be verified" security warning, please press Run.
  • A black CMD prompt window will open and close quickly, this is expected and normal.
    Upon completion, a file will be created on your desktop named "mbr.log"
  • Double click the "mbr.log" file and Notepad should open.
  • Copy and paste the contents of the files mbr.log in your next reply.
Thanks.
Post #11
Bad news I'm afraid, the VirScan report confirmed what ComboFix was reporting.

You have a real nasty infection on your system. Virut/Virtob is a file infector virus with IRC bot functionality which infects all .exe and .scr files, downloads more malicious files to your system, and opens a back door that compromises your computer. In many cases the infected files cannot be deleted and anti-malware scanners cannot disinfect them properly. When disinfection is attempted, the files become corrupted and the system may become irreparable.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS. Please read "When should I re-format?" and "Reformatting the computer or troubleshooting; which is best?".

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

Virut/Virtob is contracted and spread by visiting remote, crack and keygen sites. Those who attempt to get software for free may end up with a computer system so badly damaged that recovery is not possible and a Repair Install will NOT help! Reinstalling Windows without first wiping the entire hard drive with a repartition and/or format will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system will still be there afterwards. Starting over, reformatting the drive and performing a clean install removes everything.

Right now, the best thing you can do is to backup, preferably to CD, all your important data, documents, pictures, movies, and songs.

DO NOT backup any applications or installers and DO NOT backup any files with the following extensions:
  • .exe
  • .scr
  • .htm
  • .html
  • .xml
  • .zip
  • .rar
For more information on Virut, and why you need to reformat, have a read of miekiemoes blog here.

To find out how to carry out a Reformat and Reinstall, please see this page.

Any questions just let me know. I am sorry there is nothing more we could do.
Post #12 last edited
Hey jpshortstuff, While that's obviously not the news I wanted to hear, I knew it was definitely a possibility I would have to reformat and reinstall the OS. A few months ago, I picked up an external hardrive to backup some my files. Most of my essential files are on there however so are some .exe, .html, .zip, and .rar files. Is there a way to determine if my external hard drive has Virut or is compromised in any way? Also, I noticed you said to back up the files to preferably CD. I'm not trying to call you out or anything but why CD and not DVD? Thanks again, jpshortstuff.
Post #13
Hi,

My recommendation for checking the external drive is to have Kaspersky Online Virusscan scan you external drive. You could either do this from the infected computer before formatting (if it is usable to that extent), or after formatting. If you choose after fomatting, ensure that autorun of external drives is disabled.

CD and DVD are both as good as each other. The reason they are often considered safer than USB or external harddrives when dealing with this infection is that they cannot be compromised by the infection. As long as you are safe and proceed with caution when using your external drive however, you should be fine. Just make sure everything is scanned before loading it onto a clean computer.

Hope that helps you.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI