[Resolved] Unable to run anti malware progs - is fulldtofind redi

I'm trying to fix a laptop for a friend. They've had it for 8 months and recently started getting a BSOD error which stopped the PC from starting (the error message stated there was an unmountable drive). I changed the HDD operating mode from SATA to IDE which let me get round the BSOD but I can't install/run any AV or malware tools exce[t for McAfee's Stinger (it detected the PAV trojan). I've tried Spybot, AdawareAE, MBAM, SuperAntiSpyware and the latest version of HJT. Occasionally I think I'm getting somwhere then BSOD appears and the laptop restarts. I managed after several attempts to get HJT to install (log file attached underneath) but it doesn't want to let me access the Hosts file. Not sure if it's running correctly or not.

Specs are as follows:

Windows Vista Home Basic 32-bit
Service Pack 1

Acer Aspire 5315
Intel Celeron 350 @ 2GHz
1GB RAM

I've managed to install a couple of Windows updates (finally) but am getting plagued by IE windows cropping up every now and again which always redirect to one of the three following sites:

a7search.net
fulldotfind.com
canfind.org

Any Google searches result in an oversized blank page with nothing at all in it. I can navigate directly to sites through the address bar but online scans are also failing or causing a system crash.

Anybody out there got any thoughts on what my next step should be? This one's got me well and truly stumped!

Thanks

Buggyman

————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:31:22, on 14/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\igfxsrvc.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Users\JOYYMC~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Security\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Security\AdAware\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7363 bytes

Hi CatByte

Thanks for the speedy response. I've managed to run all the programs you asked and have attached the files requested below. While trying to run SysProt, I got the message 'hotiron hotfix installer has stopped working and was closed'. I don't know if this is related to any of the programs being run, but thought I'd mention it anyway!

Look forward to hearing from you.

Cheers

Buggyman

:-)

First DDS log:


DDS (Ver_09-07-30.01) - NTFSx86 NETWORK
Run by [removed] at 20:43:59.20 on 15/08/2009
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.1013.338 [GMT 1:00]

AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Security\AdAware\aawservice.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Users\joy\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://en.uk.acer.yahoo.com
mDefault_Page_URL = hxxp://en.uk.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.0\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.0\CoIEPlg.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ALaunch] c:\acer\alaunch\AlaunchClient.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [eRecoveryService]
mRun: [SetPanel] c:\acer\apanel\APanel.cmd
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} - hxxp://www.bebo.com/files/BeboUploader.5.1.4.cab
Notify: igfxcui - igfxdev.dll

============= SERVICES / DRIVERS ===============

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-2-26 180736]
S2 ALaunchService;ALaunch Service;c:\acer\alaunch\ALaunchSvc.exe [2008-2-25 51200]
S3 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\ipsdefs\20070823.002\IDSvix86.sys [2008-2-26 180272]
S4 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-8-24 149864]

=============== Created Last 30 ================

2009-08-14 22:06 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-14 22:06 97,800 a——- c:\windows\system32\infocardapi.dll
2009-08-14 22:06 622,080 a——- c:\windows\system32\icardagt.exe
2009-08-14 22:06 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-08-14 22:06 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-08-14 22:06 11,264 a——- c:\windows\system32\icardres.dll
2009-08-14 22:06 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-08-14 22:06 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-08-14 21:56 96,760 a——- c:\windows\system32\dfshim.dll
2009-08-14 21:56 282,112 a——- c:\windows\system32\mscoree.dll
2009-08-14 21:56 41,984 a——- c:\windows\system32\netfxperf.dll
2009-08-14 21:56 158,720 a——- c:\windows\system32\mscorier.dll
2009-08-14 21:56 83,968 a——- c:\windows\system32\mscories.dll
2009-08-14 20:59 499,712 a——- c:\windows\system32\kerberos.dll
2009-08-14 20:59 213,504 a——- c:\windows\system32\msv1_0.dll
2009-08-14 20:59 175,104 a——- c:\windows\system32\wdigest.dll
2009-08-14 20:59 1,256,448 a——- c:\windows\system32\lsasrv.dll
2009-08-14 20:59 270,848 a——- c:\windows\system32\schannel.dll
2009-08-14 20:59 439,896 a——- c:\windows\system32\drivers\ksecdd.sys
2009-08-14 20:59 72,704 a——- c:\windows\system32\secur32.dll
2009-08-14 20:59 9,728 a——- c:\windows\system32\lsass.exe
2009-08-14 20:52 –d—– c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
2009-08-13 22:26 –d—– c:\programdata\Spybot - Search & Destroy
2009-08-13 22:26 –d—– c:\progra~2\Spybot - Search & Destroy
2009-08-12 22:16 a-d—– c:\programdata\TEMP
2009-08-12 22:10 –d—– c:\programdata\Lavasoft
2009-08-12 22:05 160,256 a——- c:\windows\system32\wkssvc.dll
2009-08-12 22:05 2,066,432 a——- c:\windows\system32\mstscax.dll
2009-08-12 22:05 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 22:05 91,136 a——- c:\windows\system32\avifil32.dll
2009-08-12 22:05 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-08-12 22:05 –d—– c:\programdata\Malwarebytes
2009-08-12 22:05 –d—– c:\progra~2\Malwarebytes
2009-08-12 22:05 –d—– c:\program files\Security
2009-08-12 22:04 313,344 a——- c:\windows\system32\wmpdxm.dll
2009-08-12 22:04 7,680 a——- c:\windows\system32\spwmp.dll
2009-08-12 22:04 4,096 a——- c:\windows\system32\msdxm.ocx
2009-08-12 22:04 4,096 a——- c:\windows\system32\dxmasf.dll
2009-08-12 22:04 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-08-12 22:04 18,432 a——- c:\windows\system32\amcompat.tlb
2009-08-12 22:04 43,520 a——- c:\windows\system32\msdxm.tlb
2009-08-12 21:55 –d—– c:\program files\common files\Wise Installation Wizard
2009-07-19 11:12 289,792 a——- c:\windows\system32\atmfd.dll
2009-07-19 11:12 156,672 a——- c:\windows\system32\t2embed.dll
2009-07-19 11:12 72,704 a——- c:\windows\system32\fontsub.dll
2009-07-19 11:12 10,240 a——- c:\windows\system32\dciman32.dll

==================== Find3M ====================

2009-07-18 17:06 827,904 a——- c:\windows\system32\wininet.dll
2009-07-18 17:01 78,336 a——- c:\windows\system32\ieencode.dll
2009-07-18 10:46 26,624 a——- c:\windows\system32\ieUnatt.exe
2009-07-17 15:35 71,680 a——- c:\windows\system32\atl.dll
2009-04-08 18:37 143,360 a——- c:\windows\inf\infstrng.dat
2009-04-08 18:37 51,200 a——- c:\windows\inf\infpub.dat
2009-04-07 21:51 86,016 a——- c:\windows\inf\infstor.dat
2008-10-23 20:11 60,968 a——- c:\users\joy\GoToAssistDownloadHelper.exe
2008-10-22 22:38 665,600 a——- c:\windows\inf\drvindex.dat
2008-01-21 03:57 174 a–sh— c:\program files\desktop.ini
2006-11-02 13:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2008-10-23 19:29 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2008-10-23 19:29 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2008-10-23 19:29 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat

============= FINISH: 20:45:25.25 ===============

Attach.txt attached to post as instructed within DDS

———

GMER logfile:

GMER 1.0.15.15020 [remg.com] - http://www.gmer.net
Rootkit scan 2009-08-15 21:00:59
Windows 6.0.6001 Service Pack 1


—- System - GMER 1.0.15 —-

Code 84A92438







ZwEnumerateKey
Code 84A92400







ZwFlushInstructionCache
Code 84A9246D







IofCallDriver
Code 84A902DE







IofCompleteRequest
Code 84A923C5







ZwSaveKey
Code 84A9238D







ZwSaveKeyEx

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\fastfat \Fat







fltmgr.sys (Microsoft Filesystem Filter

Manager/Microsoft Corporation)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @ C:\Program

Files\Internet Explorer\Iexplore.exe [652]



0x01760000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [716]



0x011C0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [788]



0x005C0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\System32\svchost.exe [820]



0x00CE0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\System32\svchost.exe [908]



0x005C0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [936]



0x00940000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\System32\svchost.exe [980]



0x005B0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [1100]



0x005B0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [1128]



0x00940000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [1740]



0x005B0000


Library \\?\globalroot\systemroot\system32

\UACkyvtbcheaydbtps.dll (*** hidden *** ) @

C:\Windows\system32\svchost.exe [1840]



0x005D0000



—- Services - GMER 1.0.15 —-

Service C:\Windows\system32

\drivers\UACxcpveoqjtcabexv.sys (*** hidden *** )





[SYSTEM]

UACd.sys

<– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys








Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start







1
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type







1
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group







file system
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules








Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd







\\?\globalroot\systemroot\system32

\drivers\UACxcpveoqjtcabexv.sys
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc







\\?\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr







\\?\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog







\\?\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmas

k





\\?\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacser

f





\\?\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr







\\?\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACpro

c





\\?\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurl

s





\\?\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg

HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerr

ors





\\?\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet002

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet003

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet004

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet005\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet005

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet006\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet006

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet007\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet007

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet008\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet008

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet009\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet009

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet010\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet010

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet011\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet011

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet012\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet012

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet013\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet013

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet014\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet014

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet015\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet015

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet016\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet016

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log
Reg HKLM\SYSTEM\ControlSet017\Services\UACd.sys

(not active ControlSet)






Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys@start





1
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys@type





1
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys@imagepath







\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys@group





file system
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules (not active ControlSet)






Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@UACd





\\?

\globalroot\systemroot\system32\drivers\UACxcpveoqjtcabexv.sys
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@UACc





\\?

\globalroot\systemroot\system32\UACiwfnvcupidrvmhr.dll
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uacsr





\\?

\globalroot\systemroot\system32\UACrtpyeslyxespcld.dat
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uaclog





\\?

\globalroot\systemroot\system32\UACxtxqnxfnovlkrcj.dll
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uacmask





\\?

\globalroot\systemroot\system32\UACsianxiirvtsxylt.dll
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uacserf





\\?

\globalroot\systemroot\system32\UAChmbkvnpedmsiywt.dll
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uacbbr





\\?

\globalroot\systemroot\system32\UACkyvtbcheaydbtps.dll
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@UACproc





\\?

\globalroot\systemroot\system32\UACcgxtnkmauoteoxs.log
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uacurls





\\?

\globalroot\systemroot\system32\UACxoxrmilmbmfqobw.log
Reg HKLM\SYSTEM\ControlSet017

\Services\UACd.sys\modules@uacerrors





\\?

\globalroot\systemroot\system32\UACsjiaidykthknthk.log

—- Files - GMER 1.0.15 —-

File

C:\Users\joy\AppData\Local\Microsoft\Windows\Temporary

Internet Files\Low\Content.IE5

\4Y22RUYQ\UACA46GEUDCANVTOEDCAJL7Z3SCAEAT0PUCAOUDF8XCADKV80LCA

YD0PI9CAT8F63UCAUCLZZ0CAFBDTY7CAMUV45SCA8AG76TCAPYQZOHCA59BBK8

CA82FSZ0CAIB3YRQCA9A63EACA1AJIDU.gif 43 bytes
File

C:\Users\joy\AppData\Local\Microsoft\Windows\Temporary

Internet Files\Low\Content.IE5

\4Y22RUYQ\UACACHG1BOCA5KH2X9CALZYDOQCA5PE6CACA3VPK3XCARVIK23CA

N1UI0DCA8MF7SXCAIORL7TCACGB4QCCA8Y7DFECAUAZLFDCACYJD1BCAVNQAET

CASH5LBRCA9IV0ZPCA6P6H2CCAVRWLW6.gif 42 bytes
File C:\Users\joy\AppData\Local\Temp\UAC9890.tmp







680448 bytes executable
File C:\Windows\System32

\drivers\UACxcpveoqjtcabexv.sys





54784 bytes

executable

<– ROOTKIT !!!
File C:\Windows\System32\UACcgxtnkmauoteoxs.log







217475 bytes
File C:\Windows\System32\UAChmbkvnpedmsiywt.dll







19456 bytes executable
File C:\Windows\System32\uacinit.dll







6186 bytes
File C:\Windows\System32\UACiwfnvcupidrvmhr.dll







26624 bytes executable
File C:\Windows\System32\UACkyvtbcheaydbtps.dll







74240 bytes executable
File C:\Windows\System32\UACrtpyeslyxespcld.dat







310 bytes
File C:\Windows\System32\UACsianxiirvtsxylt.dll







18432 bytes executable
File C:\Windows\System32\UACxtxqnxfnovlkrcj.dll







19968 bytes executable
File C:\Windows\Temp\UAC339d.tmp







66560 bytes
File C:\Windows\Temp\UAC368a.tmp







4096 bytes
File C:\Windows\Temp\UAC4d35.tmp







40960 bytes executable
File C:\Windows\Temp\UAC4e2e.tmp







8192 bytes
File C:\Windows\Temp\UAC5d99.tmp







4096 bytes executable
File C:\Windows\Temp\UAC81db.tmp







74240 bytes executable
File C:\Windows\Temp\UAC9185.tmp







49152 bytes executable
File C:\Windows\Temp\UACad6d.tmp







8192 bytes executable
File C:\Windows\Temp\UACe677.tmp







28672 bytes
File C:\Windows\Temp\UACf556.tmp







66560 bytes
File C:\Windows\Temp\UACfd42.tmp







12288 bytes executable

—- EOF - GMER 1.0.15 —-


—–

SysProt log

SysProt AntiRootkit v1.0.1.0
by swatkat

**************************************************************

****************************
**************************************************************

****************************

No Hidden Processes found

**************************************************************

****************************
**************************************************************

****************************
Kernel Modules:
Module Name: \systemroot\system32

\drivers\UACxcpveoqjtcabexv.sys
Service Name: UACd.sys
Module Base: —
Module End: —
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_dumpata.sys
Service Name: —
Module Base: 8B50F000
Module End: 8B51A000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: —
Module Base: 8B51A000
Module End: 8B522000
Hidden: Yes

**************************************************************

****************************
**************************************************************

****************************
No SSDT Hooks found

**************************************************************

****************************
**************************************************************

****************************
Kernel Hooks:
Hooked Function: ZwFlushInstructionCache
At Address: 821EE1C2
Jump To: 858068DC
Module Name: _unknown_

Hooked Function: ZwEnumerateKey
At Address: 8221958C
Jump To: 8570A08C
Module Name: _unknown_

Hooked Function: PsGetCurrentThread
At Address: 8208C169
Jump To: 8571AA2A
Module Name: _unknown_

Hooked Function: KeGetCurrentThread
At Address: 8208C169
Jump To: 8571AA2A
Module Name: _unknown_

Hooked Function: IofCompleteRequest
At Address: 8208C1D6
Jump To: 857A085B
Module Name: _unknown_

Hooked Function: IofCallDriver
At Address: 8208C169
Jump To: 8571AA2A
Module Name: _unknown_

**************************************************************

****************************
**************************************************************

****************************
No IRP Hooks found

**************************************************************

****************************
**************************************************************

****************************
Ports:
Local Address: JOYMCENHILL:49203
Remote Address: 65.55.27.220:HTTPS
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: ESTABLISHED

Local Address: JOYMCENHILL:NETBIOS-SSN
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: JOYMCENHILL:27015
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
State: LISTENING

Local Address: JOYMCENHILL:5354
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Program Files\Bonjour\mDNSResponder.exe
State: LISTENING

Local Address: JOYMCENHILL:49175
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\services.exe
State: LISTENING

Local Address: JOYMCENHILL:49159
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: JOYMCENHILL:49154
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\lsass.exe
State: LISTENING

Local Address: JOYMCENHILL:49153
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: JOYMCENHILL:49152
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\wininit.exe
State: LISTENING

Local Address: JOYMCENHILL:5357
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: JOYMCENHILL:MICROSOFT-DS
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: JOYMCENHILL:EPMAP
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: JOYMCENHILL:54298
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:SSDP
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:138
Remote Address: NA
Type: UDP
Process: System
State: NA

Local Address: JOYMCENHILL:NETBIOS-NS
Remote Address: NA
Type: UDP
Process: System
State: NA

Local Address: 192.168.1.8:54297
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: 192.168.1.8:SSDP
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:56848
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:54299
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:SSDP
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:63525
Remote Address: NA
Type: UDP
Process: C:\Program Files\Bonjour\mDNSResponder.exe
State: NA

Local Address: JOYMCENHILL:62588
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:60215
Remote Address: NA
Type: UDP
Process: C:\Program Files\Bonjour\mDNSResponder.exe
State: NA

Local Address: JOYMCENHILL:LLMNR
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:IPSEC-MSFT
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:UPNP-DISCOVERY
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:UPNP-DISCOVERY
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:500
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: JOYMCENHILL:123
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

**************************************************************

****************************
**************************************************************

****************************
Hidden files/folders:
Object: C:\System Volume

Information\MountPointManagerRemoteDatabase
Status: Access denied

Object: C:\System Volume Information\SPP
Status: Access denied

Object: C:\System Volume Information\tracking.log
Status: Access denied

Object: C:\System Volume Information\{3808876b-c176-4e48-b7ae

-04046e6cc752}
Status: Access denied

Object: C:\System Volume Information\{423a5b77-89d7-11de-8359

-001b38da9940}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Access denied

Object: C:\System Volume Information\{8232aab5-890d-11de-ad77

-001b38da9940}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Access denied

Object: C:\System Volume Information\{8232aabb-890d-11de-ad77

-001b38da9940}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Access denied

Object: C:\System Volume Information\{8dd4a02a-8912-11de-bef8

-001b38da9940}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Access denied

Object: C:\System Volume Information\{ae969636-890a-11de-b22b

-001b38da9940}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Access denied

Object: C:\System Volume Information\{fd49901c-8910-11de-ab5e

-001b38da9940}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Access denied

Object: C:\Users\joy\AppData\Local\Microsoft\Windows\Temporary

Internet Files\Low\Content.IE5

\4Y22RUYQ\UACA46GEUDCANVTOEDCAJL7Z3SCAEAT0PUCAOUDF8XCADKV80LCA

YD0PI9CAT8F63UCAUCLZZ0CAFBDTY7CAMUV45SCA8AG76TCAPYQZOHCA59BBK8

CA82FSZ0CAIB3YRQCA9A63EACA1AJIDU.gif
Status: Hidden

Object: C:\Users\joy\AppData\Local\Microsoft\Windows\Temporary

Internet Files\Low\Content.IE5

\4Y22RUYQ\UACACHG1BOCA5KH2X9CALZYDOQCA5PE6CACA3VPK3XCARVIK23CA

N1UI0DCA8MF7SXCAIORL7TCACGB4QCCA8Y7DFECAUAZLFDCACYJD1BCAVNQAET

CASH5LBRCA9IV0ZPCA6P6H2CCAVRWLW6.gif
Status: Hidden

Object: C:\Users\joy\AppData\Local\Microsoft\Windows\Temporary

Internet Files\Low\Content.IE5\HH1N7UB4\UACqXr%2FB%

3DepjjMdmSuyI-%2FJ%3D1246648741709594%2FK%

3DdZrtOO1cX.zLMefmSSQUlw%2FA%3D200784840%2FR%3D0%2F%2A%

24,http%3A%2F%2Fwww.bebo.com%2Fprofile[1].h
Status: Hidden

Object: C:\Users\joy\AppData\Local\Temp\UAC9890.tmp
Status: Hidden

Object: C:\Windows\System32\drivers\UACxcpveoqjtcabexv.sys
Status: Hidden

Object: C:\Windows\System32

\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
Status: Access denied

Object: C:\Windows\System32

\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
Status: Access denied

Object: C:\Windows\System32

\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
Status: Access denied

Object: C:\Windows\System32

\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
Status: Access denied

Object: C:\Windows\System32

\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl
Status: Access denied

Object: C:\Windows\System32\UACcgxtnkmauoteoxs.log
Status: Hidden

Object: C:\Windows\System32\UAChmbkvnpedmsiywt.dll
Status: Hidden

Object: C:\Windows\System32\uacinit.dll
Status: Hidden

Object: C:\Windows\System32\UACiwfnvcupidrvmhr.dll
Status: Hidden

Object: C:\Windows\System32\UACkyvtbcheaydbtps.dll
Status: Hidden

Object: C:\Windows\System32\UACrtpyeslyxespcld.dat
Status: Hidden

Object: C:\Windows\System32\UACsianxiirvtsxylt.dll
Status: Hidden

Object: C:\Windows\System32\UACxtxqnxfnovlkrcj.dll
Status: Hidden

Object: C:\Windows\Temp\UAC339d.tmp
Status: Hidden

Object: C:\Windows\Temp\UAC368a.tmp
Status: Hidden

Object: C:\Windows\Temp\UAC4d35.tmp
Status: Hidden

Object: C:\Windows\Temp\UAC4e2e.tmp
Status: Hidden

Object: C:\Windows\Temp\UAC5d99.tmp
Status: Hidden

Object: C:\Windows\Temp\UAC8ddd.tmp
Status: Hidden

Object: C:\Windows\Temp\UAC9185.tmp
Status: Hidden

Object: C:\Windows\Temp\UACad6d.tmp
Status: Hidden

Object: C:\Windows\Temp\UACe677.tmp
Status: Hidden

Object: C:\Windows\Temp\UACf556.tmp
Status: Hidden

Object: C:\Windows\Temp\UACfd42.tmp
Status: Hidden


—

Hi CatByte

Has to uninstall a bunch of stuff before I could uninstall Norton - Acer certainly do like bundling about a ton of useless guff with their PC's! Anyway, finally managed it after 4 reboots.

During the process I got a warning message about rootkit activity - the contents of which I've included here:

—

ComboFix has detected the presence of rootkit activity and needs to reboot the machine. Kindly note down on paper the name of each file. You may need it later.

C:\Windows\System32\drivers\UACxcpveoqjtcabexv.sys
C:\Windows\System32\UACiwfnvcupidrvmhr.dll
C:\Windows\System32\UACrtpyeslyxespcld.dat
C:\Windows\System32\UACxtxqnxfnovlkrcj.dll
C:\Windows\System32\UACsianxiirvtsxylt.dll
C:\Windows\System32\UAChmbkvnpedmsiywt.dll
C:\Windows\System32\UACkyvtbcheaydbtps.dll
C:\Windows\System32\UACcgxtnkmauoteoxs.log
C:\Windows\System32\UACxoxrmilmbmfqobw.log
C:\Windows\System32\UACsjiaidykthknthk.log

—

Here's the actual logfile generated by Combofix as well.

Thanks again for all your help - look forward to finding out some more about what's infested this PC!

Cheers

Buggyman



————

ComboFix 09-08-10.06 - joy 16/08/2009 20:32.1.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.1013.111 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\Combo-Fix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3151040566-2565585055-2273284138-500
c:\windows\Installer\abf96.msp
c:\windows\system32\drivers\UACxcpveoqjtcabexv.sys
c:\windows\system32\UACcgxtnkmauoteoxs.log
c:\windows\system32\UAChmbkvnpedmsiywt.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACiwfnvcupidrvmhr.dll
c:\windows\system32\UACkyvtbcheaydbtps.dll
c:\windows\system32\UACrtpyeslyxespcld.dat
c:\windows\system32\UACsianxiirvtsxylt.dll
c:\windows\system32\UACsjiaidykthknthk.log
c:\windows\system32\UACxoxrmilmbmfqobw.log
c:\windows\system32\UACxtxqnxfnovlkrcj.dll


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys
——-\Legacy_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-07-16 to 2009-08-16 )))))))))))))))))))))))))))))))
.

2009-08-16 19:41 . 2009-08-16 19:45 ——– d—–w- c:\users\joy\AppData\Local\temp
2009-08-16 19:41 . 2009-08-16 19:41 ——– d—–w- c:\users\Guest\AppData\Local\temp
2009-08-16 19:41 . 2009-08-16 19:41 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-08-14 21:06 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-14 21:06 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-08-14 21:06 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-14 21:06 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-08-14 21:06 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-08-14 21:06 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-14 21:06 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-08-14 20:56 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-08-14 20:56 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-08-14 20:56 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-08-14 20:56 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-08-14 20:56 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-08-14 19:59 . 2009-06-15 15:24 175104 —-a-w- c:\windows\system32\wdigest.dll
2009-08-14 19:59 . 2009-06-15 15:22 213504 —-a-w- c:\windows\system32\msv1_0.dll
2009-08-14 19:59 . 2009-06-15 15:21 499712 —-a-w- c:\windows\system32\kerberos.dll
2009-08-14 19:59 . 2009-06-15 15:24 270848 —-a-w- c:\windows\system32\schannel.dll
2009-08-14 19:59 . 2009-06-15 15:23 1256448 —-a-w- c:\windows\system32\lsasrv.dll
2009-08-14 19:59 . 2009-06-15 18:20 439896 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-14 19:59 . 2009-06-15 15:24 72704 —-a-w- c:\windows\system32\secur32.dll
2009-08-14 19:59 . 2009-06-15 12:57 9728 —-a-w- c:\windows\system32\lsass.exe
2009-08-13 21:26 . 2009-08-13 21:26 ——– d—–w- c:\progra~2\Spybot - Search & Destroy
2009-08-12 21:10 . 2009-08-12 21:14 ——– d—–w- c:\progra~2\Lavasoft
2009-08-12 21:05 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll
2009-08-12 21:05 . 2009-06-04 12:34 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-08-12 21:05 . 2009-08-12 21:05 ——– d—–w- c:\progra~2\Malwarebytes
2009-08-12 21:05 . 2009-06-10 12:07 91136 —-a-w- c:\windows\system32\avifil32.dll
2009-08-12 21:05 . 2009-08-16 19:18 ——– d—–w- c:\program files\Security
2009-08-12 21:04 . 2009-07-14 13:00 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2009-08-12 21:04 . 2009-07-14 12:58 7680 —-a-w- c:\windows\system32\spwmp.dll
2009-08-12 21:04 . 2009-07-14 12:59 4096 —-a-w- c:\windows\system32\dxmasf.dll
2009-08-12 21:04 . 2009-07-14 10:59 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2009-08-12 19:38 . 2009-08-13 19:52 1356 —-a-w- c:\users\joy\AppData\Local\d3d9caps.dat
2009-07-19 10:12 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-19 10:12 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-19 10:12 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-19 10:12 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-16 19:31 . 2008-02-26 03:20 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-16 18:56 . 2008-02-26 03:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-14 20:33 . 2008-10-17 18:42 70104 —-a-w- c:\users\joy\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-14 20:23 . 2008-02-26 03:14 ——– d—–w- c:\progra~2\Microsoft Help
2009-08-14 20:21 . 2008-02-26 03:16 ——– d—–w- c:\program files\Microsoft Works
2009-08-13 20:05 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-08-12 20:33 . 2008-02-26 03:45 ——– d—–w- c:\progra~2\CyberLink
2009-08-12 20:30 . 2008-02-26 03:49 ——– d—–w- c:\program files\Acer GameZone
2009-07-18 16:06 . 2009-08-12 21:06 827904 —-a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-08-12 21:06 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-08-12 21:06 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-12 21:06 71680 —-a-w- c:\windows\system32\atl.dll
2009-05-20 17:54 . 2009-05-20 17:54 70104 —-a-w- c:\users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-22 133656]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-01-04 768520]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-07-21 159744]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-09-03 4702208]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-2-26 535336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DF60EEC8-0880-4246-9F1B-E1A10310EF84}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{64BC88D6-9B44-490A-BC4D-A944E6E3591F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{13ADE3BD-099C-44B2-A160-5484D6802808}"= c:\program files\Acer\Acer Arcade\PowerCinema.exe:CyberLink PowerCinema
"{B6B81CF0-2AE4-455F-98A8-CA8E19F5FCDD}"= c:\program files\Acer\Acer Arcade\PCMService.exe:CyberLink PowerCinema Resident Program
"{20859917-0498-405B-A496-2F5D40E2B014}"= c:\program files\Acer\Acer Arcade\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{0123652C-844A-43DE-831A-EA7BA4B67C78}"= c:\program files\Acer\Acer Arcade\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{AB2CA533-4D4A-4EAB-98B3-BACD35DA0665}"= c:\program files\Acer\HomeMedia\HomeMedia.exe:HomeMedia
"{03C7B6F9-BF69-47A4-B1E9-D16684047839}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{80C95E18-1A37-44F6-B98B-3A87F2A711EB}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9663C9F0-5419-4FB3-B00B-21A1D0910F74}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{63CF039F-9CD8-4D72-8AAE-ECE8441BC313}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8137FA1A-57AA-4BAF-8C41-6AFC671097CC}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{F67A803A-C4C7-4B2B-B516-0C7695918C85}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{8CEBB774-0673-4D32-9619-554D92AE0A0D}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{29DB65F5-1059-46FF-A37B-2469AC1D205A}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{2669DF39-4FA9-41A1-A36B-89C621B1008F}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{FF434FA0-6F1F-404F-B295-066C9913CAAB}"= UDP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{648A9B6C-56CC-42D7-85EA-38ADC2C1F2A7}"= TCP:c:\program files\Virgin Broadband Wireless\Wireless Manager.exe:Wireless Manager
"{2F745BD6-8D38-4ABF-9AA3-482D92731976}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{7CAB76AE-874E-4448-BBB9-EBF5D088D6CA}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

R2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [25/02/2008 20:04 51200]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [26/02/2008 02:41 180736]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
HKLM-Run-eRecoveryService - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://en.uk.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
IE: &Windows; Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-16 20:45
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\windows\System32\drivers\XAudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Launch Manager\LManager.exe
c:\windows\System32\igfxsrvc.exe
c:\windows\System32\igfxext.exe
c:\windows\System32\igfxsrvc.exe
c:\acer\Empowering Technology\eRecovery\eRAgent.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Completion time: 2009-08-16 20:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-16 19:51

Pre-Run: 5,094,952,960 bytes free
Post-Run: 6,058,078,208 bytes free

203 — E O F — 2009-08-15 20:21

Hi CatByte

I've attached the most recent logs below. I've managed to install and run Avast (showed up some items quarantined by Combofix), Spybot (showed nothing), AdAwareAE (showed nothing but one cookie) and have also since installede SpywareBlaster as well.

So fart, I seem to be getting no further pop up windows and my browser sections aren't getting redirected any more. Looks like your assistance has helped clear thigns up!

Let me know if my last logs show up clear.

Many thanks for all your help and time.

Buggyman



—


DDS (Ver_09-07-30.01) - NTFSx86
Run by [removed] at 21:35:40.06 on 19/08/2009
Internet Explorer: 8.0.6001.18813
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.1013.270 [GMT 1:00]

SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
D:\Security Programs\Avast\aswUpdSv.exe
D:\Security Programs\Avast\ashServ.exe
D:\Security Programs\Adaware\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Acer\ALaunch\ALaunchSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
D:\Security Programs\Spybot\SDWinSec.exe
D:\Security Programs\Avast\ashMaiSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
D:\Security Programs\Avast\ashWebSv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Security Programs\Avast\ashDisp.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Users\JOYYMC~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\joy\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://en.uk.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\securi~1\spybot\SDHelper.dll
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avast!] d:\securi~1\avast\ashDisp.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Windows; Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\securi~1\spybot\SDHelper.dll
DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} - hxxp://www.bebo.com/files/BeboUploader.5.1.4.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Notify: igfxcui - igfxdev.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-19 64160]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-8-18 114768]
R2 ALaunchService;ALaunch Service;c:\acer\alaunch\ALaunchSvc.exe [2008-2-25 51200]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-18 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-8-18 53328]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-2-26 180736]

=============== Created Last 30 ================

2009-08-19 21:33 15,688 a——- c:\windows\system32\lsdelete.exe
2009-08-19 20:46 64,160 a——- c:\windows\system32\drivers\Lbd.sys
2009-08-19 20:46 -cd-h— c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}
2009-08-19 20:46 -cd-h— c:\progra~2\{EF63305C-BAD7-4144-9208-D65528260864}
2009-08-19 19:45 –d—– c:\windows\system32\x64
2009-08-19 19:41 72,704 a——- c:\windows\system32\admparse.dll
2009-08-18 22:02 53,328 a——- c:\windows\system32\drivers\aswMonFlt.sys
2009-08-17 19:46 411,368 a——- c:\windows\system32\deploytk.dll
2009-08-17 19:43 –ds—- c:\windows\Downloaded Program Files
2009-08-17 19:29 –d—– c:\users\joyymc~1\appdata\roaming\Malwarebytes
2009-08-17 19:29 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-17 19:29 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-08-17 19:29 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-08-16 20:50 –dsh— C:\$RECYCLE.BIN
2009-08-16 20:19 216,064 a——- c:\windows\PEV.exe
2009-08-16 20:19 161,792 a——- c:\windows\SWREG.exe
2009-08-16 20:19 98,816 a——- c:\windows\sed.exe
2009-08-14 22:06 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-14 22:06 97,800 a——- c:\windows\system32\infocardapi.dll
2009-08-14 22:06 622,080 a——- c:\windows\system32\icardagt.exe
2009-08-14 22:06 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-08-14 22:06 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-08-14 22:06 11,264 a——- c:\windows\system32\icardres.dll
2009-08-14 22:06 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-08-14 22:06 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-08-14 21:56 96,760 a——- c:\windows\system32\dfshim.dll
2009-08-14 21:56 282,112 a——- c:\windows\system32\mscoree.dll
2009-08-14 21:56 41,984 a——- c:\windows\system32\netfxperf.dll
2009-08-14 21:56 158,720 a——- c:\windows\system32\mscorier.dll
2009-08-14 21:56 83,968 a——- c:\windows\system32\mscories.dll
2009-08-14 20:59 499,712 a——- c:\windows\system32\kerberos.dll
2009-08-14 20:59 213,504 a——- c:\windows\system32\msv1_0.dll
2009-08-14 20:59 175,104 a——- c:\windows\system32\wdigest.dll
2009-08-14 20:59 1,256,448 a——- c:\windows\system32\lsasrv.dll
2009-08-14 20:59 270,848 a——- c:\windows\system32\schannel.dll
2009-08-14 20:59 439,896 a——- c:\windows\system32\drivers\ksecdd.sys
2009-08-14 20:59 72,704 a——- c:\windows\system32\secur32.dll
2009-08-14 20:59 9,728 a——- c:\windows\system32\lsass.exe
2009-08-13 22:26 –d—– c:\programdata\Spybot - Search & Destroy
2009-08-13 22:26 –d—– c:\progra~2\Spybot - Search & Destroy
2009-08-12 22:16 a-d—– c:\programdata\TEMP
2009-08-12 22:10 –d—– c:\programdata\Lavasoft
2009-08-12 22:06 71,680 a——- c:\windows\system32\atl.dll
2009-08-12 22:05 160,256 a——- c:\windows\system32\wkssvc.dll
2009-08-12 22:05 2,066,432 a——- c:\windows\system32\mstscax.dll
2009-08-12 22:05 91,136 a——- c:\windows\system32\avifil32.dll
2009-08-12 22:05 –d—– c:\programdata\Malwarebytes
2009-08-12 22:05 –d—– c:\progra~2\Malwarebytes
2009-08-12 22:05 –d—– c:\program files\Security
2009-08-12 22:04 313,344 a——- c:\windows\system32\wmpdxm.dll
2009-08-12 22:04 7,680 a——- c:\windows\system32\spwmp.dll
2009-08-12 22:04 4,096 a——- c:\windows\system32\msdxm.ocx
2009-08-12 22:04 4,096 a——- c:\windows\system32\dxmasf.dll
2009-08-12 22:04 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-08-12 22:04 18,432 a——- c:\windows\system32\amcompat.tlb
2009-08-12 22:04 43,520 a——- c:\windows\system32\msdxm.tlb

==================== Find3M ====================

2009-08-19 19:46 143,360 a——- c:\windows\inf\infstrng.dat
2009-08-19 19:46 51,200 a——- c:\windows\inf\infpub.dat
2009-08-19 19:46 86,016 a——- c:\windows\inf\infstor.dat
2009-07-21 22:52 915,456 a——- c:\windows\system32\wininet.dll
2009-07-21 22:47 109,056 a——- c:\windows\system32\iesysprep.dll
2009-07-21 22:47 71,680 a——- c:\windows\system32\iesetup.dll
2009-07-21 21:13 133,632 a——- c:\windows\system32\ieUnatt.exe
2009-06-15 16:24 156,672 a——- c:\windows\system32\t2embed.dll
2009-06-15 16:20 72,704 a——- c:\windows\system32\fontsub.dll
2009-06-15 16:20 10,240 a——- c:\windows\system32\dciman32.dll
2009-06-15 13:52 289,792 a——- c:\windows\system32\atmfd.dll
2008-10-23 20:11 60,968 a——- c:\users\joy\GoToAssistDownloadHelper.exe
2008-10-22 22:38 665,600 a——- c:\windows\inf\drvindex.dat
2008-01-21 03:57 174 a–sh— c:\program files\desktop.ini
2006-11-02 13:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2008-10-23 19:29 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2008-10-23 19:29 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2008-10-23 19:29 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat

============= FINISH: 21:36:55.45 ===============