What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan win32 TDSS on my machine

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Download SysProt by Swatkat from here and save it to your Desktop.
You will need to unzip it before you run it.

To do this: Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

Shut any open programs and then open the folder(s) until you get to SysProt.exe and tyhen double click it to begin - OK any Windows confirmation that you get.
  • Select the Log Tab at the top.
  • Check all the boxes in the Write to log section near the top.
  • Check the Hidden Objects Only box and the bottom.
  • Click Create Log and then leave the PC idle.
  • When a window pops up asking about []Scanning for hidden files and folders, select Scan all drives and then click Start - again leave the PC idle.
  • You will be informed when the scan completes.
Let me have the contents of the file SysProtLog.txt which will appear alongside SysProt.exe in the SysProt folder.

Also, did you download a fresh copy of ComboFix when I asked you to, or did you already have one onboard?
Post #32
I loaded combofix when you asked; never had if before. Here ya go: SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** No Hidden Processes found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \systemroot\system32\drivers\geyekrowbrpbib.sys Service Name: geyekrowoparrv Module Base: — Module End: — Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_diskdump.sys Service Name: — Module Base: A7C69000 Module End: A7C6D000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_viaraid.sys Service Name: — Module Base: A78D8000 Module End: A78EA000 Hidden: Yes ******************************************************************************** ********** ******************************************************************************** ********** No SSDT Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Hooks: Hooked Function: ZwYieldExecution At Address: 80515A6A Jump To: A798E9D8 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnmapViewOfSection At Address: 8057DEF1 Jump To: A798EA04 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnloadKey At Address: 80654DD6 Jump To: A798EB0C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwTerminateProcess At Address: 8058E695 Jump To: A798EA1D Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetValueKey At Address: 8058228C Jump To: A798EA9B Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetInformationProcess At Address: 8057CFC0 Jump To: A798E986 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetContextThread At Address: 80635967 Jump To: A798E99A Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSaveKeyEx At Address: 80656259 Jump To: 8A1CE55A Module Name: _unknown_ Hooked Function: ZwSaveKey At Address: 8065616E Jump To: 8A06E29A Module Name: _unknown_ Hooked Function: ZwRestoreKey At Address: 8065606D Jump To: A798EB36 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwReplaceKey At Address: 806564D8 Jump To: A798EB4A Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwRenameKey At Address: 80655B78 Jump To: A798EA6F Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryValueKey At Address: 80573037 Jump To: A798EAB1 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryMultipleValueKey At Address: 806556FC Jump To: A798EAC7 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryKey At Address: 80578A14 Jump To: A798EB5E Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwProtectVirtualMemory At Address: 80581889 Jump To: A798E9C2 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenThread At Address: 805E1939 Jump To: A798E948 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenProcess At Address: 80581702 Jump To: A798E934 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenKey At Address: 80572BF4 Jump To: A798EA31 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwNotifyChangeKey At Address: 805E218F Jump To: A798EB22 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwMapViewOfSection At Address: 8057E369 Jump To: A798E9EE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwFlushInstructionCache At Address: 80587BFB Jump To: 89FF90F4 Module Name: _unknown_ Hooked Function: ZwEnumerateValueKey At Address: 80587693 Jump To: A798EADD Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwEnumerateKey At Address: 80578E14 Jump To: 89FF80F4 Module Name: _unknown_ Hooked Function: ZwDeleteValueKey At Address: 80591F8B Jump To: A798EA85 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwDeleteKey At Address: 80593334 Jump To: A798EA59 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcessEx At Address: 8058B7CD Jump To: A798E970 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcess At Address: 805B0470 Jump To: A798E95C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateKey At Address: 8057791D Jump To: A798EA45 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateFile At Address: 8057C328 Jump To: A798E9AE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: PsGetProcessWin32WindowStation At Address: 804F41EC Jump To: FD806070 Module Name: _unknown_ Hooked Function: PsGetProcessJob At Address: 804F41EC Jump To: FD806070 Module Name: _unknown_ Hooked Function: IofCompleteRequest At Address: 804E17BD Jump To: 8A0D8E0B Module Name: _unknown_ Hooked Function: IofCallDriver At Address: 804E13A7 Jump To: 8A0E624B Module Name: _unknown_ ******************************************************************************** ********** ******************************************************************************** ********** No IRP Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: BAREBONE:1498 Remote Address: STATIC.91.213.46.78.CLIENTS.YOUR-SERVER.DE:HTTPS Type: TCP Process: C:\WINDOWS\System32\SVCHOST.EXE State: CLOSE_WAIT Local Address: BAREBONE:1496 Remote Address: PV-IN-F83.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1481 Remote Address: PX-IN-F139.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1480 Remote Address: SCALER01-CTS.NETLINE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1474 Remote Address: F99-045.OPERA-MINI.NET:HTTP Type: TCP Process: 3676 (PID) State: FIN_WAIT1 Local Address: BAREBONE:1258 Remote Address: WEBCS108.MSG.SP1.YAHOO.COM:5050 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1052 Remote Address: GEEK15.GEEKSTOGO.COM:HTTP Type: TCP Process: 3676 (PID) State: FIN_WAIT1 Local Address: BAREBONE:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BAREBONE:5152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Java\JRE6\BIN\JQS.EXE State: LISTENING Local Address: BAREBONE:1030 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\System32\ALG.EXE State: LISTENING Local Address: BAREBONE:6646 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe State: LISTENING Local Address: BAREBONE:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BAREBONE:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\System32\SVCHOST.EXE State: LISTENING Local Address: BAREBONE:6646 Remote Address: NA Type: UDP Process: C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe State: NA Local Address: BAREBONE:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: BAREBONE:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: BAREBONE:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:68 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1491 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1037 Remote Address: NA Type: UDP Process: C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MIM.EXE State: NA Local Address: BAREBONE:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:4500 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\LSASS.EXE State: NA Local Address: BAREBONE:500 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\LSASS.EXE State: NA Local Address: BAREBONE:MICROSOFT-DS Remote Address: NA Type: UDP Process: System State: NA ******************************************************************************** ********** ******************************************************************************** ********** Hidden files/folders: Object: E:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: E:\System Volume Information\tracking.log Status: Access denied Object: E:\System Volume Information\_restore{9AECCF28-7E96-4462-B1E9-29D42B076851} Status: Access denied Object: C:\WINDOWS\SYSTEM32\DRIVERS\geyekrowbrpbib.sys Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrresntjlk.dll Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrsdjjsxtn.dat Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrboyvpriv.dll Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrrduyvtqp.dat Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\( Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\c:\windo.ws\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\c:\windo.ws\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\uninstal.lSt Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\& Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\=   lh Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\F   A Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\anpjí¦. Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00003\BM6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ <.x10 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\.2"> . < Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\vice id=."My Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\mander"/.> Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\y TV" ty.pe= Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\me="con/.Loc Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ess" val.="6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\e> Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\type="ty.pe/ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\" model=."" Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\on/Local./my Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\> Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\. . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\nk" val=."My Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00006\[schedul.emg Status: Hidden Object: C:\WINDOWS\TEMP\MCE00006\R\\WinDV.r Status: Hidden Object: C:\WINDOWS\TEMP\MCE00006\grName=W.ind Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\r Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\F   6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\r Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\F   6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\á   C Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\w Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\á   C Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\w Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\ü +)«]S.mô Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\ö=±fù .|˜1 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\¦u˜>$¦.=fF Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\-e+÷{+ .P-¦ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\bq¦-yµ·. ¬ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\v¿v0i|»q.0+ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\bn¦^jse.$4 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\lp¦m¢+. ªx Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\a'.+-v.ƒ`Ç Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\u+=Bf¦+._Fj Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\¦c¦8=¦T.¿-¥ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\o\+v¦+4£.ºrÅ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\nP r+,`+.ú6æ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\]+·x.^öà.¡¦- Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\}mc¼ ¦.°¬ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\¦p+¦ƒÆr.¥_ë Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\K˜>nF #B.t- Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\T Status: Hidden Object: C:\WINDOWS\TEMP\MCE0000a\ Status: Hidden Object: C:\WINDOWS\TEMP\geyekrxbesmqbvfv.tmp Status: Hidden Object: C:\WINDOWS\TEMP\geyekrfptntibpxc.tmp Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ontent-T.ype Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ charset.=UT Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\UIV="Exp.ire Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ec 1994.16: Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\TTP-EQUI.v=" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\over scr.ipt Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\age(); . va Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rc = "im.age Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\unction.swa Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\document..im Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\f(name,.sta Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\es[name]..sr Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\} f.unc Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ate){ . do Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rc = box.on. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ swap_of.f(n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\c } . < Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ == -1) .// Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\? { . Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ "rc_opt.ion Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\) wi.ndo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ehighlig.ht( Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\inal use.r n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ocument..cop Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\Y_USER f.iel Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ (docume.nt. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ull) { . p Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\opts.PRO.xy_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ functio.n t Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\p_window. = Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\.html",".hel Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\400,scro.llb Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\esno(fla.g,k Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ ret.urn Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\n key +."=n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\.copts.a.gen Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\x")) { . Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\&& . ( Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\PASSWD.v.alu Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\password. fo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\n."); . Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ar posta.rgs Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\gs/SEND_.int Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\pts.SEND._IN Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\args +=."&" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e(docume.nt. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e); p.ost Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\settings./AG Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\lobalSet.tin Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ape(docu.men Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\lue); . if Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\y_passwd. != Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\SSWD=" +. es Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\n.href =. "/ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\anges ha.ve Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\color="#.fff Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\pt:windo.wDi Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ TOPMARG.in= Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\s" metho.d=" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ <.img Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ges_butt.on. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\)" onmou.seo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rrow_off..gi Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rrow2"><.img Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ton.gif". al Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\a>. < Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e=1>chan.ge Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ click t.he Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\NG=1 CEL.LSP Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\a5a" wid.th= Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ Connect.ion Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\
<.img Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ar.gif".WID Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e="admin." n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\"/images./1x Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ZE=2>pas.swo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e=passwo.rd Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\xxxx" na.me= Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ACE="ARI.al" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\pport< Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ize=15 v.alu Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\G SRC="/.ima Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\AL" SIZE.=2> Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\put type.=pa Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\
. * Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\cated pr.oxy Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\r> Ch Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\nt to co.nne Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\IGHT=30>.O.· Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ ÷+zc#d.¥¼ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\n¯¦æ-ñ.¦+¬ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¦¦S=e.¦Ä Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\±ñlç¦j.èv Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+£ë˜^$£.:|· Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\atÄi(!½5.+7æ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\µnû¦o¦7-.£p1 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ì±ì8Çd++.-çT Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\)+á+ .¥\H Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\QGadPëÉ.6vƒ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\b+¦àÄÆ.cP Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\é-=( Æ-.-û Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\a˜=sH¦É+.c-_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\@¦¦-0t+f.«y Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\/K^¬N7v.òSæ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\–º=+Gñ.vt+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\WUp->m8[.l¦- Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+¦nï$f-. +° Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\n+V+¦o.+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\àh&(1s·.¦¥; Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+gf #e".ëg Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+-]+=ÅÄ.Ä} Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\î--byh¦.dX. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¦+Pi ¦F+.¿g Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ÿg+~}²r.ÆJ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\Ѧ8{ƒ- (.e)n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\/¦k-ikr.údÜ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+˜7n¯]t.[¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\e gkOK.le_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\:+q¦à+.#¦A Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\R-k£!sb8.ƒ°0 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\"nz`+%¥.-WP Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\£nÇoë+c.-) Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\F¢ùdïëX.urx Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+ o±¦+,c. # Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ôܦ+#`¦. Ö¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\P^+S_.+V« Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\8¦¼jñái.+»- Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\-GÑF^G£.u+s Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\J ê+ £¯¦.îF+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\e+¦¦¢+z5.ö+h Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\O+è8J&á.?\< Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\. ç+»TÖ+.o`¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ókx+ù+c.i¦+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\s{Çÿt߯.èh Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ß+[tF+¦ç.dè3 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\<++ó+j-.pû+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\rbä½ysy. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\n(ó=P%˜^.`fú Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ t-áu!0U.}+¿ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¦cBóñ%.4ù< Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\lrS¿,¼+ .é+_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+p¬_p¦Ä.\1ü Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¬sc+i¥~.ßvL Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\êó>¢p Ǧ.ö80 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\l¿ct÷g.úÖ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+¦_¦8i.¦¥ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\u"gët=+.yz" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\-˜vG£++h.=¦+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¥O¯é-+.·Jl Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+a¿-*+¦e. ç¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+<<=Ѧ.-^u Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\)(++ü¦.½¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\FßQdN+Ö.#j+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\=w:+HQú.-+1 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\Ö)z²-ë;.° Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\oû?Oí+£.¬µ+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ñ+@»pªßU.rt° Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\++=(ky.gen Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\iÇ(mx=zä. P{ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Mozilla\Firefox\Profiles\qihqpyw9.default\extensions\[removed]\chrome\content\¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Mozilla\Firefox\Profiles\qihqpyw9.default\extensions\[removed]\chrome\content\+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Mozilla\Firefox\Profiles\qihqpyw9.default\extensions\[removed]\chrome\content\- Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\[info] .Dat Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\e Post M.ax. Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\s=0 [ev.ent Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\re recor.ds Status: Hidden
Post #33
I loaded combofix when you asked; never had if before. Here ya go: SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** No Hidden Processes found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \systemroot\system32\drivers\geyekrowbrpbib.sys Service Name: geyekrowoparrv Module Base: — Module End: — Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_diskdump.sys Service Name: — Module Base: A7C69000 Module End: A7C6D000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_viaraid.sys Service Name: — Module Base: A78D8000 Module End: A78EA000 Hidden: Yes ******************************************************************************** ********** ******************************************************************************** ********** No SSDT Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Hooks: Hooked Function: ZwYieldExecution At Address: 80515A6A Jump To: A798E9D8 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnmapViewOfSection At Address: 8057DEF1 Jump To: A798EA04 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnloadKey At Address: 80654DD6 Jump To: A798EB0C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwTerminateProcess At Address: 8058E695 Jump To: A798EA1D Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetValueKey At Address: 8058228C Jump To: A798EA9B Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetInformationProcess At Address: 8057CFC0 Jump To: A798E986 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetContextThread At Address: 80635967 Jump To: A798E99A Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSaveKeyEx At Address: 80656259 Jump To: 8A1CE55A Module Name: _unknown_ Hooked Function: ZwSaveKey At Address: 8065616E Jump To: 8A06E29A Module Name: _unknown_ Hooked Function: ZwRestoreKey At Address: 8065606D Jump To: A798EB36 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwReplaceKey At Address: 806564D8 Jump To: A798EB4A Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwRenameKey At Address: 80655B78 Jump To: A798EA6F Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryValueKey At Address: 80573037 Jump To: A798EAB1 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryMultipleValueKey At Address: 806556FC Jump To: A798EAC7 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryKey At Address: 80578A14 Jump To: A798EB5E Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwProtectVirtualMemory At Address: 80581889 Jump To: A798E9C2 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenThread At Address: 805E1939 Jump To: A798E948 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenProcess At Address: 80581702 Jump To: A798E934 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenKey At Address: 80572BF4 Jump To: A798EA31 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwNotifyChangeKey At Address: 805E218F Jump To: A798EB22 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwMapViewOfSection At Address: 8057E369 Jump To: A798E9EE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwFlushInstructionCache At Address: 80587BFB Jump To: 89FF90F4 Module Name: _unknown_ Hooked Function: ZwEnumerateValueKey At Address: 80587693 Jump To: A798EADD Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwEnumerateKey At Address: 80578E14 Jump To: 89FF80F4 Module Name: _unknown_ Hooked Function: ZwDeleteValueKey At Address: 80591F8B Jump To: A798EA85 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwDeleteKey At Address: 80593334 Jump To: A798EA59 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcessEx At Address: 8058B7CD Jump To: A798E970 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcess At Address: 805B0470 Jump To: A798E95C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateKey At Address: 8057791D Jump To: A798EA45 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateFile At Address: 8057C328 Jump To: A798E9AE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: PsGetProcessWin32WindowStation At Address: 804F41EC Jump To: FD806070 Module Name: _unknown_ Hooked Function: PsGetProcessJob At Address: 804F41EC Jump To: FD806070 Module Name: _unknown_ Hooked Function: IofCompleteRequest At Address: 804E17BD Jump To: 8A0D8E0B Module Name: _unknown_ Hooked Function: IofCallDriver At Address: 804E13A7 Jump To: 8A0E624B Module Name: _unknown_ ******************************************************************************** ********** ******************************************************************************** ********** No IRP Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: BAREBONE:1498 Remote Address: STATIC.91.213.46.78.CLIENTS.YOUR-SERVER.DE:HTTPS Type: TCP Process: C:\WINDOWS\System32\SVCHOST.EXE State: CLOSE_WAIT Local Address: BAREBONE:1496 Remote Address: PV-IN-F83.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1481 Remote Address: PX-IN-F139.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1480 Remote Address: SCALER01-CTS.NETLINE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1474 Remote Address: F99-045.OPERA-MINI.NET:HTTP Type: TCP Process: 3676 (PID) State: FIN_WAIT1 Local Address: BAREBONE:1258 Remote Address: WEBCS108.MSG.SP1.YAHOO.COM:5050 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1052 Remote Address: GEEK15.GEEKSTOGO.COM:HTTP Type: TCP Process: 3676 (PID) State: FIN_WAIT1 Local Address: BAREBONE:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BAREBONE:5152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Java\JRE6\BIN\JQS.EXE State: LISTENING Local Address: BAREBONE:1030 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\System32\ALG.EXE State: LISTENING Local Address: BAREBONE:6646 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe State: LISTENING Local Address: BAREBONE:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BAREBONE:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\System32\SVCHOST.EXE State: LISTENING Local Address: BAREBONE:6646 Remote Address: NA Type: UDP Process: C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe State: NA Local Address: BAREBONE:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: BAREBONE:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: BAREBONE:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:68 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1491 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1037 Remote Address: NA Type: UDP Process: C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MIM.EXE State: NA Local Address: BAREBONE:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:4500 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\LSASS.EXE State: NA Local Address: BAREBONE:500 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\LSASS.EXE State: NA Local Address: BAREBONE:MICROSOFT-DS Remote Address: NA Type: UDP Process: System State: NA ******************************************************************************** ********** ******************************************************************************** ********** Hidden files/folders: Object: E:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: E:\System Volume Information\tracking.log Status: Access denied Object: E:\System Volume Information\_restore{9AECCF28-7E96-4462-B1E9-29D42B076851} Status: Access denied Object: C:\WINDOWS\SYSTEM32\DRIVERS\geyekrowbrpbib.sys Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrresntjlk.dll Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrsdjjsxtn.dat Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrboyvpriv.dll Status: Hidden Object: C:\WINDOWS\SYSTEM32\geyekrrduyvtqp.dat Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\( Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\c:\windo.ws\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\c:\windo.ws\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\uninstal.lSt Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\& Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\=   lh Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\F   A Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\anpjí¦. Status: Hidden Object: C:\WINDOWS\TEMP\MCE00007\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00003\BM6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ <.x10 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\.2"> . < Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\vice id=."My Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\mander"/.> Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\y TV" ty.pe= Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\me="con/.Loc Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ess" val.="6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\e> Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\type="ty.pe/ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\" model=."" Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\on/Local./my Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\> Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\. . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\nk" val=."My Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ . Status: Hidden Object: C:\WINDOWS\TEMP\MCE00005\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00006\[schedul.emg Status: Hidden Object: C:\WINDOWS\TEMP\MCE00006\R\\WinDV.r Status: Hidden Object: C:\WINDOWS\TEMP\MCE00006\grName=W.ind Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\r Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\F   6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\i Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\r Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\m Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\F   6 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\á   C Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\w Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\\ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\á   C Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\e Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\w Status: Hidden Object: C:\WINDOWS\TEMP\MCE00008\+   vk Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\ü +)«]S.mô Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\ö=±fù .|˜1 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\¦u˜>$¦.=fF Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\-e+÷{+ .P-¦ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\bq¦-yµ·. ¬ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\v¿v0i|»q.0+ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\bn¦^jse.$4 Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\lp¦m¢+. ªx Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\a'.+-v.ƒ`Ç Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\u+=Bf¦+._Fj Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\¦c¦8=¦T.¿-¥ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\o\+v¦+4£.ºrÅ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\nP r+,`+.ú6æ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\]+·x.^öà.¡¦- Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\}mc¼ ¦.°¬ Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\¦p+¦ƒÆr.¥_ë Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\K˜>nF #B.t- Status: Hidden Object: C:\WINDOWS\TEMP\MCE00009\T Status: Hidden Object: C:\WINDOWS\TEMP\MCE0000a\ Status: Hidden Object: C:\WINDOWS\TEMP\geyekrxbesmqbvfv.tmp Status: Hidden Object: C:\WINDOWS\TEMP\geyekrfptntibpxc.tmp Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ontent-T.ype Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ charset.=UT Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\UIV="Exp.ire Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ec 1994.16: Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\TTP-EQUI.v=" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\over scr.ipt Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\age(); . va Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rc = "im.age Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\unction.swa Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\document..im Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\f(name,.sta Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\es[name]..sr Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\} f.unc Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ate){ . do Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rc = box.on. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ swap_of.f(n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\c } . < Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ == -1) .// Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\? { . Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ "rc_opt.ion Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\) wi.ndo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ehighlig.ht( Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\inal use.r n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ocument..cop Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\Y_USER f.iel Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ (docume.nt. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ull) { . p Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\opts.PRO.xy_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ functio.n t Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\p_window. = Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\.html",".hel Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\400,scro.llb Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\esno(fla.g,k Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ ret.urn Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\n key +."=n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\.copts.a.gen Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\x")) { . Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\&& . ( Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\PASSWD.v.alu Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\password. fo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\n."); . Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ar posta.rgs Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\gs/SEND_.int Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\pts.SEND._IN Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\args +=."&" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e(docume.nt. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e); p.ost Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\settings./AG Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\lobalSet.tin Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ape(docu.men Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\lue); . if Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\y_passwd. != Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\SSWD=" +. es Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\n.href =. "/ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\anges ha.ve Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\color="#.fff Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\pt:windo.wDi Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ TOPMARG.in= Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\s" metho.d=" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ <.img Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ges_butt.on. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\)" onmou.seo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rrow_off..gi Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\rrow2"><.img Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ton.gif". al Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\a>. < Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e=1>chan.ge Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ click t.he Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\NG=1 CEL.LSP Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\a5a" wid.th= Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ Connect.ion Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\
<.img Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ar.gif".WID Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e="admin." n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\"/images./1x Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ZE=2>pas.swo Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\e=passwo.rd Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\xxxx" na.me= Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ACE="ARI.al" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\pport< Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\ize=15 v.alu Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\G SRC="/.ima Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\AL" SIZE.=2> Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\put type.=pa Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\
. * Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\cated pr.oxy Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\r> Ch Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\nt to co.nne Status: Hidden Object: C:\Documents and Settings\Rick Deno\Local Settings\Temp\WPDNSE\IGHT=30>.O.· Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ ÷+zc#d.¥¼ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\n¯¦æ-ñ.¦+¬ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¦¦S=e.¦Ä Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\±ñlç¦j.èv Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+£ë˜^$£.:|· Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\atÄi(!½5.+7æ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\µnû¦o¦7-.£p1 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ì±ì8Çd++.-çT Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\)+á+ .¥\H Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\QGadPëÉ.6vƒ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\b+¦àÄÆ.cP Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\é-=( Æ-.-û Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\a˜=sH¦É+.c-_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\@¦¦-0t+f.«y Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\/K^¬N7v.òSæ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\–º=+Gñ.vt+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\WUp->m8[.l¦- Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+¦nï$f-. +° Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\n+V+¦o.+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\àh&(1s·.¦¥; Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+gf #e".ëg Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+-]+=ÅÄ.Ä} Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\î--byh¦.dX. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¦+Pi ¦F+.¿g Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ÿg+~}²r.ÆJ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\Ѧ8{ƒ- (.e)n Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\/¦k-ikr.údÜ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+˜7n¯]t.[¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\e gkOK.le_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\:+q¦à+.#¦A Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\R-k£!sb8.ƒ°0 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\"nz`+%¥.-WP Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\£nÇoë+c.-) Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\F¢ùdïëX.urx Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+ o±¦+,c. # Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ôܦ+#`¦. Ö¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\P^+S_.+V« Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\8¦¼jñái.+»- Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\-GÑF^G£.u+s Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\J ê+ £¯¦.îF+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\e+¦¦¢+z5.ö+h Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\O+è8J&á.?\< Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\. ç+»TÖ+.o`¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ókx+ù+c.i¦+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\s{Çÿt߯.èh Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ß+[tF+¦ç.dè3 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\<++ó+j-.pû+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\rbä½ysy. Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\n(ó=P%˜^.`fú Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ t-áu!0U.}+¿ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¦cBóñ%.4ù< Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\lrS¿,¼+ .é+_ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+p¬_p¦Ä.\1ü Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¬sc+i¥~.ßvL Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\êó>¢p Ǧ.ö80 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\l¿ct÷g.úÖ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+¦_¦8i.¦¥ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\u"gët=+.yz" Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\-˜vG£++h.=¦+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\¥O¯é-+.·Jl Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+a¿-*+¦e. ç¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\+<<=Ѧ.-^u Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\)(++ü¦.½¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\FßQdN+Ö.#j+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\=w:+HQú.-+1 Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\Ö)z²-ë;.° Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\oû?Oí+£.¬µ+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\ñ+@»pªßU.rt° Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\++=(ky.gen Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com\iÇ(mx=zä. P{ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Mozilla\Firefox\Profiles\qihqpyw9.default\extensions\[removed]\chrome\content\¦ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Mozilla\Firefox\Profiles\qihqpyw9.default\extensions\[removed]\chrome\content\+ Status: Hidden Object: C:\Documents and Settings\Rick Deno\Application Data\Mozilla\Firefox\Profiles\qihqpyw9.default\extensions\[removed]\chrome\content\- Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\[info] .Dat Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\e Post M.ax. Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\s=0 [ev.ent Status: Hidden Object: C:\System Volume Information\_restore{2AFCC581-D9B7-4CC1-AE24-45740B05BC99}(2)\RP453(2)\snapshot\re recor.ds Status: Hidden
Post #34
I'm still not sure why CF didn't pick this one up, but never mind. Work through the following and see if you can get some results:

1) Download a fresh copy of Combofix from the link I posted previously.
2) Run SysProt and select the Kernel Modules tab.
3) Locate C:\WINDOWS\system32\drivers\mfehidk.sys, click it and then Disable.
4) Reboot the PC.
5) Repeat steps 2 , 3 and 4 again - this is important.
6) Run ComboFix as before.

The only possibility that I can come up with is that you didn't allow the installation of the Recovery Console and this has resulted in CF running in a limited way. If you did install it, then this isn't the issue. If you didn't, then I suggest you do this time.

Let me have the CF log and fresh HJT log and let em know if the PC is behaving any better now.
Post #35
Noviciate,
YOU DID IT!!!!
Amazing! Thank you so much…this puppy is all fixed!
I can't thank you enough. If I could, I'd buy ya a beer!!!!

Thanks so much!

Rick

ComboFix 09-08-25.02 - Rick Deno 08/25/2009 20:50.7.2 - FAT32x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))
.

2009-08-26 03:38 . 2009-08-26 03:38 84 —ha-w- c:\windows\system32\x10prod.sys
2009-08-26 03:02 . 2009-08-26 03:02 ——– d-sh–w- C:\FOUND.000
2009-08-22 21:37 . 2009-08-26 01:50 54 —-a-w- c:\windows\system32\rp_stats.dat
2009-08-22 21:37 . 2009-08-26 01:50 39 —-a-w- c:\windows\system32\rp_rules.dat
2009-08-22 16:29 . 2009-08-22 16:29 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-08-21 03:02 . 2009-08-21 03:02 9994240 ——w- c:\documents and settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.livejasmin.com
2009-08-20 04:58 . 2009-08-20 04:58 7667712 ——w- c:\documents and settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
2009-08-18 13:56 . 2009-08-18 13:56 65536 ——w- c:\documents and settings\Rick Deno\Application Data\Macromedia\Flash Player\#SharedObjects\93WXZ86S\chase.com
2009-08-18 13:56 . 2009-08-18 13:56 32768 ——w- c:\documents and settings\Rick Deno\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chase.com
2009-08-18 13:23 . 2009-08-18 13:23 32768 ——w- c:\documents and settings\Rick Deno\Application Data\Macromedia\Flash Player\#SharedObjects\93WXZ86S\mail.google.com
2009-08-18 06:52 . 2008-04-14 12:41 167936 —-a-w- c:\windows\system32\appmgmts.dll
2009-08-13 13:52 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-08-12 06:08 . 2009-08-12 06:08 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
2009-08-12 05:24 . 2009-08-12 05:24 ——– d—–w- C:\Rooter$
2009-08-11 02:09 . 2009-08-11 02:09 ——– d—–w- c:\program files\Defraggler
2009-08-11 02:00 . 2009-08-11 02:00 ——– d—–w- c:\program files\CCleaner
2009-08-11 01:19 . 2009-08-11 01:19 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-09 17:53 . 2009-08-09 17:53 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\Opera
2009-08-09 17:53 . 2009-08-09 17:53 ——– d—–w- c:\program files\Opera
2009-08-09 15:31 . 2009-08-09 15:31 ——– d—–w- c:\windows\system32\NtmsData
2009-08-09 14:15 . 2009-08-09 14:15 ——– d—–w- c:\program files\Trend Micro
2009-08-09 14:11 . 2009-08-03 20:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-09 14:10 . 2009-08-09 14:11 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-09 14:10 . 2009-08-03 20:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-08 21:27 . 2009-08-08 21:27 ——– d—–w- c:\program files\MSXML 4.0
2009-08-08 16:21 . 2009-08-08 16:21 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\Downloaded Installations
2009-08-08 15:08 . 2009-08-08 15:08 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\AskToolbar
2009-08-08 15:08 . 2009-08-08 15:08 ——– d—–w- c:\windows\LastGood(2)
2009-08-08 15:01 . 2009-08-08 15:01 ——– d—–w- c:\program files\Ask.com
2009-08-08 15:00 . 2009-08-08 15:00 ——– d—–w- c:\program files\MSSOAP
2009-08-08 15:00 . 2009-08-08 15:00 ——– d—–w- c:\program files\Webroot
2009-08-08 14:59 . 2009-08-08 14:59 164 —-a-w- c:\windows\install.dat
2009-08-08 06:44 . 2009-08-08 06:44 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2009-08-08 06:44 . 2009-08-08 06:44 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\SUPERAntiSpyware.com
2009-08-08 05:11 . 2009-08-08 05:11 ——– d—–w- c:\program files\Windows Defender
2009-08-07 06:14 . 2009-08-07 06:14 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\Uniblue
2009-08-07 01:29 . 2009-08-07 01:29 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2009-08-07 01:29 . 2009-08-07 01:29 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-07 01:29 . 2009-08-07 01:29 ——– d—–w- c:\program files\MSBuild
2009-08-07 01:29 . 2009-08-07 01:29 ——– d—–w- c:\program files\Reference Assemblies
2009-08-07 01:28 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-07 01:28 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-07 01:28 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-07 01:28 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-07 01:28 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-07 01:28 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-07 01:28 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-05 09:01 . 2009-08-05 09:01 204800 ——w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-22 15:49 . 2008-09-06 06:21 1924440 —-a-w- c:\documents and settings\Rick Deno\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-08-07 12:42 . 2005-07-02 06:55 90440 —-a-w- c:\documents and settings\Rick Deno\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:01 . 2005-07-02 03:10 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 08:05 . 2006-03-05 23:05 21840 —-a-w- c:\windows\system32\SIntfNT.dll
2009-08-03 08:05 . 2006-03-05 23:05 17212 —-a-w- c:\windows\system32\SIntf32.dll
2009-08-03 08:05 . 2006-03-05 23:05 12067 —-a-w- c:\windows\system32\SIntf16.dll
2009-07-25 06:40 . 2009-07-25 06:40 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\vlc
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\MozillaControl
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\program files\Mozilla ActiveX Control v1.7.12
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\program files\VideoLAN
2009-07-25 05:02 . 2009-07-25 05:02 ——– d—–w- c:\program files\Graboid
2009-07-17 19:01 . 2005-07-02 03:09 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 06:43 . 2004-08-04 07:56 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2005-04-27 17:54 915456 ——w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2005-07-02 03:11 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2005-07-02 03:09 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2005-07-02 03:11 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 16:19 . 2005-07-02 03:21 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2005-07-02 03:09 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2005-07-02 03:11 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2005-07-02 03:10 1291264 —-a-w- c:\windows\system32\quartz.dll
2005-07-01 03:37 . 2005-07-01 03:37 11079 —h–w- c:\program files\folder.htt
.

((((((((((((((((((((((((((((( SnapShot@2009-08-13_01.28.49 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-07-02 03:11 . 2008-04-14 00:12 82432 c:\windows\SYSTEM32\ws2_32.dll
+ 2005-07-02 03:11 . 2008-04-14 12:42 82432 c:\windows\SYSTEM32\ws2_32.dll
+ 2009-05-30 14:48 . 2008-04-14 12:42 82432 c:\windows\SYSTEM32\dllcache\ws2_32.dll
- 2009-05-30 14:48 . 2008-04-14 00:12 82432 c:\windows\SYSTEM32\dllcache\ws2_32.dll
+ 2009-06-12 12:31 . 2009-06-12 12:31 76288 c:\windows\SYSTEM32\dllcache\telnet.exe
+ 2009-06-10 14:13 . 2009-06-10 14:13 84992 c:\windows\SYSTEM32\dllcache\avifil32.dll
+ 2009-07-17 19:01 . 2009-07-17 19:01 58880 c:\windows\SYSTEM32\dllcache\atl.dll
+ 2005-07-02 03:26 . 2009-08-26 01:49 49152 c:\windows\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-08-21 22:15 . 2009-08-21 22:14 32768 c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009082120090822\index.dat
- 2005-07-02 03:26 . 2009-08-13 01:04 32768 c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-07-02 03:26 . 2009-08-26 01:49 32768 c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-08-21 22:16 . 2009-08-21 22:16 16384 c:\windows\SYSTEM32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
+ 2005-07-02 03:26 . 2009-08-26 01:49 32768 c:\windows\SYSTEM32\config\systemprofile\Cookies\index.dat
- 2005-07-02 03:26 . 2009-08-13 01:04 32768 c:\windows\SYSTEM32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 07:56 . 2008-04-14 12:42 82432 c:\windows\ServicePackFiles\i386\ws2_32.dll
- 2004-08-04 07:56 . 2008-04-14 00:12 82432 c:\windows\ServicePackFiles\i386\ws2_32.dll
+ 2004-08-04 07:56 . 2009-07-14 06:43 286208 c:\windows\SYSTEM32\dllcache\wmpdxm.dll
+ 2009-06-10 06:14 . 2009-06-10 06:14 132096 c:\windows\SYSTEM32\dllcache\wkssvc.dll
- 2009-06-06 17:59 . 2009-08-13 01:04 245760 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
+ 2009-06-06 17:59 . 2009-08-26 01:49 245760 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
+ 2008-08-28 13:56 . 2004-08-04 06:14 131072 c:\windows\$NtServicePackUninstall$\netbt.sys
+ 2009-06-10 16:19 . 2009-06-10 16:19 2066432 c:\windows\SYSTEM32\dllcache\mstscax.dll
+ 2004-08-04 07:56 . 2009-07-14 06:43 10841088 c:\windows\SYSTEM32\wmp.dll
+ 2009-04-16 05:16 . 2009-07-30 00:49 24281536 c:\windows\SYSTEM32\MRT.exe
+ 2004-08-04 07:56 . 2009-07-14 06:43 10841088 c:\windows\SYSTEM32\dllcache\wmp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 22:06 764296 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2008-06-17 18:02 8461312 —-a-w- c:\windows\SYSTEM32\shell32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
"PPWebCap"="c:\progra~1\ScanSoft\PAPERP~1\PPWebCap.exe" [2001-08-10 40960]
"Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-11-06 101064]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-05-02 49152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 68856]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-04 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\Smax4pnp.exe" [2003-05-29 790528]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-02 65536]
"RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-12-01 868352]
"RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-07-15 319488]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 11776]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592]
"PDUiP6000DMon"="c:\program files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe" [2004-05-31 57344]
"PDUiP6000DTskbr"="c:\program files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe" [2004-05-28 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2003-05-02 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-05-02 4640768]
"tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2007-03-07 1773568]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"NVIDIA Remote Control Panel"="NVAREM.EXE" - c:\windows\SYSTEM32\nvarem.exe [2003-07-08 139264]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2003-05-02 323584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2009-03-15 136768]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2005-6-30 155715]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2005-6-30 565248]
3Com Connection Assistant.lnk - c:\program files\3com\Connection Assistant\bin\matcli.exe [2005-7-1 208896]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-6-26 114688]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-8-5 113664]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-10-9 122880]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"SoundMax"="c:\program files\ANALOG DEVICES\SOUNDMAX\SMAX4.EXE" /tray
"ASUS Probe"=c:\program files\ASUS\Probe\AsusProb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\LucasArts\\Star Wars Battlefront II\\GameData\\BattlefrontII.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\day of defeat source\\hl2.exe"=
"c:\\Program Files\\THQ\\Dawn of War DEMO\\W40k.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\WINDOWS\\System32\\WBEM\\unsecapp.exe"=

R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
R2 gupdate1c9a5ad82bf7822;Google Update Service (gupdate1c9a5ad82bf7822);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 133104]
S0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2003-10-21 72192]
S2 3ComDMIService;3Com DMI Agent;c:\windows\System32\3Com_DMI\3CDMINIC.EXE [2003-03-04 114688]
S2 BCAITDI;3Com BCAITDI DMI TDI;c:\windows\system32\DRIVERS\BCAItdi.sys [2002-03-14 19470]
S2 IOPort;IOPort;c:\windows\System32\DRIVERS\IOPORT.SYS [1998-11-28 6144]
S2 nvTUNEP;nVidia WDM TVTuner;c:\windows\system32\DRIVERS\nvtunep.sys [2003-09-08 20640]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\DRIVERS\nvtvsnd.sys [2003-09-08 22640]
S2 ppsio2;PPDevice; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-04 13592]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/explore.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Search - ?p=ZUfox000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: musicmatch.com\online
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - hxxp://www.swissquake.ch/chumbalum-soft/files/MS3DViewerOCX.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-25 20:55
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3252)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-08-26 20:57
ComboFix-quarantined-files.txt 2009-08-26 03:57
ComboFix2.txt 2009-08-26 03:15
ComboFix3.txt 2009-08-19 02:01
ComboFix4.txt 2009-08-18 07:11
ComboFix5.txt 2009-08-26 03:49

Pre-Run: 104,376,958,976 bytes free
Post-Run: 104,337,440,768 bytes free

259 — E O F — 2009-08-24 18:16


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:06 PM, on 8/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\system32\NVAREM.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
C:\Program Files\Analog Devices\SoundMAX\smagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\x10nets.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [NVIDIA Remote Control Panel] "NVAREM.EXE" /S /Q /R /L /A1 /B0 /C0 /D2 /E0
O4 - HKLM\..\Run: [MimBoot] "C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [PDUiP6000DMon] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe"
O4 - HKLM\..\Run: [PDUiP6000DTskbr] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe"
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - ?p=ZUfox000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - http://www.swissquake.ch/chumbalum-soft/fi…3DViewerOCX.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c9a5ad82bf7822) (gupdate1c9a5ad82bf7822) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Canon PIXMA iP6000D Memory Card Manager (PDUiP6000DMemCrdMgr) - CANON INC. - C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\smagent.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\WINDOWS\system32\x10nets.exe

–
End of file - 14881 bytes
Post #36
I'd like you to run SysProt again and let me have the log that it produces. The driver that you disabled appears to be a McAfee creation that has been linked to issues in other posts i've seen. You may still have malware onboard, but we should be able to deal with that relatively easily - fingers crossed. You may also need to reinstall McAfee as well, but we'll cross this bridge when we get to it.
Post #37
Here's the log. FYI, I scanned with Malwarebites and Spybot and found nothing. McAfee was running initially "unprotected mode" but after rebooting, it now seems fine. SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** No Hidden Processes found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \SystemRoot\System32\Drivers\dump_diskdump.sys Service Name: — Module Base: A6672000 Module End: A6676000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_viaraid.sys Service Name: — Module Base: A6244000 Module End: A6256000 Hidden: Yes ******************************************************************************** ********** ******************************************************************************** ********** No SSDT Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Kernel Hooks: Hooked Function: ZwYieldExecution At Address: 80515A6A Jump To: A62FA9D8 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnmapViewOfSection At Address: 8057DEF1 Jump To: A62FAA04 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnloadKey At Address: 80654DD6 Jump To: A62FAB09 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwTerminateProcess At Address: 8058E695 Jump To: A62FAA1D Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetValueKey At Address: 8058228C Jump To: A62FAA9B Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetInformationProcess At Address: 8057CFC0 Jump To: A62FA986 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetContextThread At Address: 80635967 Jump To: A62FA99A Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwRestoreKey At Address: 8065606D Jump To: A62FAB33 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwReplaceKey At Address: 806564D8 Jump To: A62FAB47 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwRenameKey At Address: 80655B78 Jump To: A62FAA6F Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryValueKey At Address: 80573037 Jump To: A62FAAB1 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryMultipleValueKey At Address: 806556FC Jump To: A62FAAC7 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwQueryKey At Address: 80578A14 Jump To: A62FAB5B Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwProtectVirtualMemory At Address: 80581889 Jump To: A62FA9C2 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenThread At Address: 805E1939 Jump To: A62FA948 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenProcess At Address: 80581702 Jump To: A62FA934 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenKey At Address: 80572BF4 Jump To: A62FAA31 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwNotifyChangeKey At Address: 805E218F Jump To: A62FAB1F Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwMapViewOfSection At Address: 8057E369 Jump To: A62FA9EE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwEnumerateValueKey At Address: 80587693 Jump To: A62FAADD Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwEnumerateKey At Address: 80578E14 Jump To: A62FAAF3 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwDeleteValueKey At Address: 80591F8B Jump To: A62FAA85 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwDeleteKey At Address: 80593334 Jump To: A62FAA59 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcessEx At Address: 8058B7CD Jump To: A62FA970 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcess At Address: 805B0470 Jump To: A62FA95C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateKey At Address: 8057791D Jump To: A62FAA45 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateFile At Address: 8057C328 Jump To: A62FA9AE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: PsGetProcessWin32WindowStation At Address: 804F41EC Jump To: FD806070 Module Name: _unknown_ Hooked Function: PsGetProcessJob At Address: 804F41EC Jump To: FD806070 Module Name: _unknown_ ******************************************************************************** ********** ******************************************************************************** ********** No IRP Hooks found ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: BAREBONE:2096 Remote Address: SPYNETTEST.MICROSOFT.COM:HTTPS Type: TCP Process: C:\Program Files\Windows Defender\MSASCui.exe State: ESTABLISHED Local Address: BAREBONE:2095 Remote Address: PV-IN-F18.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:2090 Remote Address: PV-IN-F18.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:2086 Remote Address: PV-IN-F113.GOOGLE.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:2085 Remote Address: A96-17-107-18.DEPLOY.AKAMAITECHNOLOGIES.COM:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:1931 Remote Address: WEBCS103.MSG.SP1.YAHOO.COM:5050 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BAREBONE:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BAREBONE:5152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Java\JRE6\BIN\JQS.EXE State: LISTENING Local Address: BAREBONE:1028 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\System32\ALG.EXE State: LISTENING Local Address: BAREBONE:6646 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe State: LISTENING Local Address: BAREBONE:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BAREBONE:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\System32\SVCHOST.EXE State: LISTENING Local Address: BAREBONE:6646 Remote Address: NA Type: UDP Process: C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe State: NA Local Address: BAREBONE:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: BAREBONE:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: BAREBONE:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:1035 Remote Address: NA Type: UDP Process: C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MIM.EXE State: NA Local Address: BAREBONE:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\SVCHOST.EXE State: NA Local Address: BAREBONE:4500 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\LSASS.EXE State: NA Local Address: BAREBONE:500 Remote Address: NA Type: UDP Process: C:\WINDOWS\System32\LSASS.EXE State: NA Local Address: BAREBONE:MICROSOFT-DS Remote Address: NA Type: UDP Process: System State: NA ******************************************************************************** ********** ******************************************************************************** ********** No hidden files/folders found
Post #38
I'd love to take the credit for this, but i've got no idea what happened! :wacko: Oh well, not to worry. A few things to tidy away and that should be that.

1) Delete the following files, if you can find them:

C:\WINDOWS\SYSTEM32\DRIVERS\geyekrowbrpbib.sys
C:\WINDOWS\SYSTEM32\geyekrresntjlk.dll
C:\WINDOWS\SYSTEM32\geyekrsdjjsxtn.dat
C:\WINDOWS\SYSTEM32\geyekrboyvpriv.dll
C:\WINDOWS\SYSTEM32\geyekrrduyvtqp.dat

If you find them but they won't delete, let me know.

2) Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

3) Download ATF Cleaner by Atribune from here and save it to your Desktop.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:
Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Java Cache
The rest are optional - if you want to remove the lot, check "Select All". Bear in mind that if you select the Cookies option that this will prevent the automatic logging in to any site that uses cookies to achieve this.
Finally click Empty Selected. When you get the "Done Cleaning" message, click OK.

If you use the Firefox or Opera browsers, you can use this program as a quick way to tidy those up as well.
When you have finished, click on the Exit button in the Main menu.

4) Your logs hows remnants of a previous installation of Symantec security software. This isn't unusual as it has something of a reputation for leaving traces when removed.
Download the Norton removal tool from here and follow the appropriate instructions.

This should clear out whatever junk might have been left behind. You can re-enable Spybot's Tea Timer function now.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1) Your copy of Adobe Reader is out of date. You can get the latest version here.

2) Your version of Sun Java needs updating:

A) Go here and click on the Windows XP/Vista/2000/2003 Offline link in the Windows section near the top and save it to your Desktop.

B ) Download JavaRa from here and save it to your Desktop.
You will need to extract the file(s):
Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

***Please close any instances of Internet Explorer before continuing!***
  • Double-click JavaRa.exe to begin.
  • Pick your prefered language from the drop-down menu and click Select.
  • Click on Remove Older Versions to remove older version of Java - obvious really, isn't it!
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location, just in case you have any problems with Java afterwards.
C) Run the installer that you downloaded earlier.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I think that's about it, so off you go and don't do whatever it was that you did before, as i'm too old to do this again! :o
Post #39
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI