katiescarlet
Topic Starter
I posted the following but cannot attach the attach.txt I am only getting initializing attachments at the bottom of the page and have left the computer for over 30 minutes but still has not loaded.
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/31 18:44
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP1
==================================================
Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\Windows\System32\Drivers\dump_atapi.sys
Address: 0x8B9D2000 Size: 32768 File Visible: No Signed: -
Status: -
Name: dump_dumpata.sys
Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
Address: 0x8B3F5000 Size: 45056 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xA8387000 Size: 49152 File Visible: No Signed: -
Status: -
Name: splx.sys
Image Path: C:\Windows\System32\Drivers\splx.sys
Address: 0x86891000 Size: 1036288 File Visible: No Signed: -
Status: -
Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Processes
——————-
Path: System
PID: 4 Status: Locked to the Windows API!
SSDT
——————-
#: 194 Function Name: NtOpenProcess
Status: Hooked by "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys" at address 0x8bbdb8ac
#: 334 Function Name: NtTerminateProcess
Status: Hooked by "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys" at address 0x8bbdb812
==EOF==
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 18:33:00.23 on Mon 08/31/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.1525.707 [GMT -4:00]
AV: CA Anti-Virus *On-access scanning enabled* (Outdated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}
SP: AdwareAlert *enabled* (Updated) {DD6A9531-8D11-4005-ABD6-FA964F70CC43}
SP: SpywareBot *disabled* (Updated) {C0BC5A68-A468-4E47-9800-C555C688A8BF}
SP: AVG Anti-Spyware *disabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: AntispywareBot *enabled* (Updated) {F0008CD1-8B0C-4162-B71F-BFEC8E0F17D0}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\CTsvcCDA.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Windows\sttray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\IObit\Game Booster\gbtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\jennbry\Downloads\dds(2).scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.bluerodeo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=W3609
uInternet Settings,ProxyOverride = ;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=W3609
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uURLSearchHooks: H - No File
BHO: Media Access Startup: {25b8d58c-b0cb-46b0-ba64-05b3804e4e86} - c:\program files\media access startup\1.5.0.850\HPIEAddOn.dll
BHO: NP Helper Class: {35b8d58c-b0cb-46b0-ba64-05b3804e4e86} - c:\program files\internet saving optimizer\3.4.0.4340\NPIEAddOn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: System Search Dispatcher: {cdbfb47b-58a8-4111-bf95-06178dce326d} - c:\program files\system search dispatcher\1.3.0.840\ssd.dll
TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6261\SiteAdv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - No File
TB: {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No File
TB: {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - No File
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SiteAdvisor] "c:\program files\siteadvisor\6261\SiteAdv.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [!AVG Anti-Spyware] "c:\program files\grisoft\avg anti-spyware 7.5\avgas.exe" /minimized
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\users\jennbry\appdata\roaming\microsoft\windows\start menu\programs\startup\OneNote Table Of Contents.onetoc2
uPolicies-explorer: NoWindowsUpdate = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6261\SiteAdv.dll
Notify: igfxcui - igfxdev.dll
Notify: PFW - UmxWnp.Dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
SEH: CShellExecuteHookImpl Object: {57b86673-276a-48b2-bae7-c6dbb3020eb8} - c:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
================= FIREFOX ===================
FF - ProfilePath - c:\users\jennbry\appdata\roaming\mozilla\firefox\profiles\xx48hezv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|http://www.tattoodle.com?v=18&tid={AB9839B8-C5C9-AE6D-3A0C-2437AEB97365}
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={AB9839B8-C5C9-AE6D-3A0C-2437AEB97365}&q=
FF - component: c:\program files\internet saving optimizer\3.4.0.4340\ff\components\NPFFAddOn.dll
FF - component: c:\program files\media access startup\1.5.0.850\ff\components\HPFFAddOn.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true);user_pref(general.useragent.extra.zencast,
============= SERVICES / DRIVERS ===============
R0 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [2007-10-18 103952]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-5-29 114768]
R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2007-5-18 61960]
R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [2007-5-18 45064]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-5-29 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-5-29 51792]
R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2007-10-18 138768]
R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [2007-11-2 65552]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-8-7 92008]
R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2007-9-13 88840]
S3 MovRVDrv32;MovRVDrv32;c:\windows\system32\drivers\MovRVDrv32.sys [2008-3-25 3768]
S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184]
=============== Created Last 30 ================
2009-08-31 18:21 0 a——- c:\windows\system32\settings.dat
2009-08-27 03:01 2,048 a——- c:\windows\system32\tzres.dll
2009-08-26 03:53 28,672 a——- c:\windows\system32\Apphlpdm.dll
2009-08-26 03:53 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-24 12:48 –d—– c:\program files\Bonjour
2009-08-23 22:45 –d—– c:\users\jennbry\appdata\roaming\IObit
2009-08-23 22:45 –d—– c:\program files\IObit
2009-08-19 19:20 –d—– c:\programdata\Blizzard Entertainment
2009-08-19 19:20 –d—– c:\progra~2\Blizzard Entertainment
2009-08-14 03:09 97,800 a——- c:\windows\system32\infocardapi.dll
2009-08-14 03:09 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-14 03:09 622,080 a——- c:\windows\system32\icardagt.exe
2009-08-14 03:09 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-08-14 03:09 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-08-14 03:09 11,264 a——- c:\windows\system32\icardres.dll
2009-08-14 03:09 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-08-14 03:09 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-08-14 03:01 96,760 a——- c:\windows\system32\dfshim.dll
2009-08-14 03:01 282,112 a——- c:\windows\system32\mscoree.dll
2009-08-14 03:01 41,984 a——- c:\windows\system32\netfxperf.dll
2009-08-14 03:01 158,720 a——- c:\windows\system32\mscorier.dll
2009-08-14 03:01 83,968 a——- c:\windows\system32\mscories.dll
2009-08-12 18:08 71,680 a——- c:\windows\system32\atl.dll
2009-08-12 18:08 160,256 a——- c:\windows\system32\wkssvc.dll
2009-08-12 18:08 2,066,432 a——- c:\windows\system32\mstscax.dll
2009-08-12 18:08 91,136 a——- c:\windows\system32\avifil32.dll
2009-08-12 18:07 313,344 a——- c:\windows\system32\wmpdxm.dll
2009-08-12 18:07 7,680 a——- c:\windows\system32\spwmp.dll
2009-08-12 18:07 4,096 a——- c:\windows\system32\msdxm.ocx
2009-08-12 18:07 4,096 a——- c:\windows\system32\dxmasf.dll
2009-08-12 18:07 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-08-12 18:07 43,520 a——- c:\windows\system32\msdxm.tlb
2009-08-12 18:07 18,432 a——- c:\windows\system32\amcompat.tlb
2009-08-04 10:19 774,144 a——- c:\windows\system32\NEROINSTAEC43759.DB
2009-08-04 10:19 1,414,440 a——- c:\windows\system32\ShellManager310E2D762.dll
2009-08-04 10:17 0 a——- c:\windows\Irremote.ini
2009-08-03 05:35 268 a—h— C:\sqmdata01.sqm
2009-08-03 05:35 244 a—h— C:\sqmnoopt01.sqm
2009-08-03 05:25 –d—– c:\program files\Media Access Startup
2009-08-03 05:25 –d—– c:\program files\Internet Saving Optimizer
2009-08-03 05:24 –d—– c:\program files\System Search Dispatcher
2009-08-03 05:24 –d—– c:\program files\DoubleD
==================== Find3M ====================
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k7
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k6
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k5
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k4
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k3
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k2
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k1
2009-08-29 02:34 64 a——- c:\windows\system32\drivers\kmxcfg.u2k0
2009-08-24 12:52 51,200 a——- c:\windows\inf\infpub.dat
2009-08-24 12:52 86,016 a——- c:\windows\inf\infstor.dat
2009-08-24 12:52 86,016 a——- c:\windows\inf\infstrng.dat
2009-07-18 12:06 827,904 a——- c:\windows\system32\wininet.dll
2009-07-18 12:01 78,336 a——- c:\windows\system32\ieencode.dll
2009-07-18 05:46 26,624 a——- c:\windows\system32\ieUnatt.exe
2009-06-15 11:24 156,672 a——- c:\windows\system32\t2embed.dll
2009-06-15 11:20 72,704 a——- c:\windows\system32\fontsub.dll
2009-06-15 11:20 10,240 a——- c:\windows\system32\dciman32.dll
2009-06-15 08:52 289,792 a——- c:\windows\system32\atmfd.dll
2009-06-05 08:34 173,056 a——- c:\windows\apppatch\AcXtrnal.dll
2009-06-05 08:33 459,776 a——- c:\windows\apppatch\AcSpecfc.dll
2009-06-05 08:33 541,696 a——- c:\windows\apppatch\AcLayers.dll
2009-06-05 08:33 2,153,984 a——- c:\windows\apppatch\AcGenral.dll
2009-03-28 03:32 174 a–sh— c:\program files\desktop.ini
2009-03-28 03:21 665,600 a——- c:\windows\inf\drvindex.dat
2009-03-21 14:38 34 a——- c:\users\jennbry\jagex_runescape_preferences.dat
2008-12-21 22:02 1,198 a——- c:\users\jennbry\appdata\roaming\wklnhst.dat
2008-06-03 11:29 1,556,480 a——- c:\users\jennbry\viaraildesktop.exe
2008-05-29 14:16 212,896 a——- c:\users\jennbry\ymsgr_vista_us_setup.exe
2008-05-29 14:14 449,784 a——- c:\users\jennbry\msgr8us.exe
2008-05-18 10:06 10,992,617 a——- c:\users\jennbry\yt2dvd.exe
2008-05-16 13:55 194,146,304 a——- c:\users\jennbry\Nero-8.3.2.1_eng_trial.exe
2006-11-02 08:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 18:34:01.24 ===============
