hijackd
Topic Starter
This computer has an issue where it continually puts up prompts to reinstall the McAfee Security Suite. We cannot uninstall the version we find in Add/Remove Programs, nor can we reinstall the software from scratch. It becomes so annoying we cannot perform any tasks with this machine; it took several attempts to save the requisite programs and log files for this post. Any assistance you can give would be a tremendous help. I had great luck with HijackThis in the past, so I decided to try this route first – NOTHING has been attempted to correct the problem at the current time.
RootRepeal.txt :
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/12/01 17:00
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================
Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xAA504000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF79F9000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA7961000 Size: 49152 File Visible: No Signed: -
Status: -
SSDT
——————-
#: 000 Function Name: NtAcceptConnectPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057f38e
#: 001 Function Name: NtAccessCheck
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80578c0c
#: 002 Function Name: NtAccessCheckAndAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058a83a
#: 003 Function Name: NtAccessCheckByType
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058f870
#: 004 Function Name: NtAccessCheckByTypeAndAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058f68a
#: 005 Function Name: NtAccessCheckByTypeResultList
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80636850
#: 006 Function Name: NtAccessCheckByTypeResultListAndAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806389e1
#: 007 Function Name: NtAccessCheckByTypeResultListAndAuditAlarmByHandle
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80638a2a
#: 008 Function Name: NtAddAtom
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057468b
#: 009 Function Name: NtAddBootEntry
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472bf
#: 010 Function Name: NtAdjustGroupsToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8063600f
#: 011 Function Name: NtAdjustPrivilegesToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058ec11
#: 012 Function Name: NtAlertResumeThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062e154
#: 013 Function Name: NtAlertThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057aeb1
#: 014 Function Name: NtAllocateLocallyUniqueId
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058bcb2
#: 015 Function Name: NtAllocateUserPhysicalPages
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80625269
#: 016 Function Name: NtAllocateUuids
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805dbfb0
#: 017 Function Name: NtAllocateVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056801d
#: 018 Function Name: NtAreMappedFilesTheSame
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d8b51
#: 019 Function Name: NtAssignProcessToJobObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a1c40
#: 021 Function Name: NtCancelDeviceWakeupRequest
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472ab
#: 022 Function Name: NtCancelIoFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805c92bc
#: 024 Function Name: NtClearEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805686c9
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80566dc9
#: 026 Function Name: NtCloseObjectAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058f07f
#: 027 Function Name: NtCompactKeys
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064d2cf
#: 028 Function Name: NtCompareTokens
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058e981
#: 029 Function Name: NtCompleteConnectPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805802b1
#: 030 Function Name: NtCompressKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064d53d
#: 031 Function Name: NtConnectPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058a88c
#: 033 Function Name: NtCreateDebugObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80658280
#: 034 Function Name: NtCreateDirectoryObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a1fe8
#: 035 Function Name: NtCreateEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056ad30
#: 036 Function Name: NtCreateEventPair
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647910
#: 037 Function Name: NtCreateFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056fc78
#: 038 Function Name: NtCreateIoCompletion
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058fc7b
#: 039 Function Name: NtCreateJobObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805aa986
#: 040 Function Name: NtCreateJobSet
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062e5fd
#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056e829
#: 042 Function Name: NtCreateMailslotFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d8a42
#: 043 Function Name: NtCreateMutant
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057b281
#: 044 Function Name: NtCreateNamedPipeFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80580135
#: 045 Function Name: NtCreatePagingFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805bafd8
#: 046 Function Name: NtCreatePort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80597571
#: 047 Function Name: NtCreateProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805b0b34
#: 048 Function Name: NtCreateProcessEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80581f0e
#: 049 Function Name: NtCreateProfile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647f47
#: 051 Function Name: NtCreateSemaphore
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805738bf
#: 052 Function Name: NtCreateSymbolicLinkObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a0cf9
#: 053 Function Name: NtCreateThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057c52b
#: 054 Function Name: NtCreateTimer
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059c2fa
#: 055 Function Name: NtCreateToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a82ed
#: 056 Function Name: NtCreateWaitablePort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a257a
#: 057 Function Name: NtDebugActiveProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806593fd
#: 058 Function Name: NtDebugContinue
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80659557
#: 060 Function Name: NtDeleteAtom
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80589e6a
#: 061 Function Name: NtDeleteBootEntry
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472ab
#: 062 Function Name: NtDeleteFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d7427
#: 063 Function Name: NtDeleteKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805951c2
#: 064 Function Name: NtDeleteObjectAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80638a81
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80593b38
#: 066 Function Name: NtDeviceIoControlFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057d2e1
#: 067 Function Name: NtDisplayString
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805be6e9
#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80572ba6
#: 069 Function Name: NtDuplicateToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057e69a
#: 070 Function Name: NtEnumerateBootEntries
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472bf
#: 071 Function Name: NtEnumerateKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056ef30
#: 072 Function Name: NtEnumerateSystemEnvironmentValuesEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647297
#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057fc04
#: 074 Function Name: NtExtendSection
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80624090
#: 075 Function Name: NtFilterToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805b0317
#: 076 Function Name: NtFindAtom
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058f9d4
#: 077 Function Name: NtFlushBuffersFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80589fe7
#: 078 Function Name: NtFlushInstructionCache
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80576a6a
#: 079 Function Name: NtFlushKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059a988
#: 080 Function Name: NtFlushVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805dcf1e
#: 081 Function Name: NtFlushWriteBuffer
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80625acb
#: 082 Function Name: NtFreeUserPhysicalPages
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062561e
#: 083 Function Name: NtFreeVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80568948
#: 084 Function Name: NtFsControlFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057ad99
#: 085 Function Name: NtGetContextThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805dfa3d
#: 086 Function Name: NtGetDevicePowerState
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062a93f
#: 087 Function Name: NtGetPlugPlayEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059f89c
#: 089 Function Name: NtImpersonateAnonymousToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80597595
#: 090 Function Name: NtImpersonateClientOfPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058e3ed
#: 091 Function Name: NtImpersonateThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057a92e
#: 092 Function Name: NtInitializeRegistry
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a3031
#: 093 Function Name: NtInitiatePowerAction
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062a70b
#: 094 Function Name: NtIsProcessInJob
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062e4b3
#: 095 Function Name: NtIsSystemResumeAutomatic
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062a926
#: 096 Function Name: NtListenPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805aa416
#: 097 Function Name: NtLoadDriver
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a410a
#: 098 Function Name: NtLoadKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805ae510
#: 099 Function Name: NtLoadKey2
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805ae35e
#: 100 Function Name: NtLockFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058c4f2
#: 101 Function Name: NtLockProductActivationKeys
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805b04e7
#: 102 Function Name: NtLockRegistryKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d4063
#: 103 Function Name: NtLockVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805af954
#: 104 Function Name: NtMakePermanentObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a0fca
#: 105 Function Name: NtMakeTemporaryObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a11b7
#: 106 Function Name: NtMapUserPhysicalPages
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80624755
#: 107 Function Name: NtMapUserPhysicalPagesScatter
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80624c29
#: 108 Function Name: NtMapViewOfSection
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805723ec
#: 109 Function Name: NtModifyBootEntry
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472ab
#: 110 Function Name: NtNotifyChangeDirectoryFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80591159
#: 111 Function Name: NtNotifyChangeKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80590ea2
#: 112 Function Name: NtNotifyChangeMultipleKeys
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80590f6b
#: 113 Function Name: NtOpenDirectoryObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057ffcf
#: 114 Function Name: NtOpenEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058051e
#: 115 Function Name: NtOpenEventPair
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647a03
#: 116 Function Name: NtOpenFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056fc13
#: 117 Function Name: NtOpenIoCompletion
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80615157
#: 118 Function Name: NtOpenJobObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062e855
#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80567d7b
#: 120 Function Name: NtOpenMutant
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057b32f
#: 121 Function Name: NtOpenObjectAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059e516
#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80572d86
#: 123 Function Name: NtOpenProcessToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056c0c1
#: 124 Function Name: NtOpenProcessTokenEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056c2ba
#: 125 Function Name: NtOpenSection
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057678b
#: 126 Function Name: NtOpenSemaphore
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805db0f2
#: 127 Function Name: NtOpenSymbolicLinkObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057fe9b
#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058c892
#: 129 Function Name: NtOpenThreadToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056bb5e
#: 130 Function Name: NtOpenThreadTokenEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056bacc
#: 131 Function Name: NtOpenTimer
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647839
#: 132 Function Name: NtPlugPlayControl
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805996de
#: 133 Function Name: NtPowerInformation
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059d2bc
#: 134 Function Name: NtPrivilegeCheck
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059b208
#: 135 Function Name: NtPrivilegeObjectAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805dbe1f
#: 136 Function Name: NtPrivilegedServiceAuditAlarm
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805aa72a
#: 137 Function Name: NtProtectVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80573135
#: 138 Function Name: NtPulseEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a24d2
#: 139 Function Name: NtQueryAttributesFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805704f3
#: 140 Function Name: NtQueryBootEntryOrder
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472bf
#: 141 Function Name: NtQueryBootOptions
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472bf
#: 143 Function Name: NtQueryDefaultLocale
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80565faa
#: 144 Function Name: NtQueryDefaultUILanguage
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80580e19
#: 145 Function Name: NtQueryDirectoryFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80573595
#: 146 Function Name: NtQueryDirectoryObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80586a3b
#: 147 Function Name: NtQueryEaFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806155e0
#: 148 Function Name: NtQueryEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058004c
#: 149 Function Name: NtQueryFullAttributesFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80579a01
#: 150 Function Name: NtQueryInformationAtom
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d6e50
#: 151 Function Name: NtQueryInformationFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805714fe
#: 152 Function Name: NtQueryInformationJobObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80582ff7
#: 153 Function Name: NtQueryInformationPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80621b63
#: 154 Function Name: NtQueryInformationProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056bcfc
#: 155 Function Name: NtQueryInformationThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805664f7
#: 156 Function Name: NtQueryInformationToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056c82b
#: 157 Function Name: NtQueryInstallUILanguage
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058072e
#: 158 Function Name: NtQueryIntervalProfile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806483f7
#: 159 Function Name: NtQueryIoCompletion
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80615218
#: 160 Function Name: NtQueryKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056ec39
#: 161 Function Name: NtQueryMultipleValueKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064ccf0
#: 162 Function Name: NtQueryMutant
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647d7c
#: 163 Function Name: NtQueryObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80581750
#: 164 Function Name: NtQueryOpenSubKeys
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064cef6
#: 165 Function Name: NtQueryPerformanceCounter
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80566831
#: 166 Function Name: NtQueryQuotaInformationFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80615eab
#: 167 Function Name: NtQuerySection
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80579e19
#: 168 Function Name: NtQuerySecurityObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059b0a3
#: 169 Function Name: NtQuerySemaphore
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80646b5f
#: 170 Function Name: NtQuerySymbolicLinkObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057fd0c
#: 171 Function Name: NtQuerySystemEnvironmentValue
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472e7
#: 172 Function Name: NtQuerySystemEnvironmentValueEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647284
#: 173 Function Name: NtQuerySystemInformation
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057d812
#: 174 Function Name: NtQuerySystemTime
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058fb5c
#: 175 Function Name: NtQueryTimer
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805908e3
#: 176 Function Name: NtQueryTimerResolution
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058627f
#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056b183
#: 178 Function Name: NtQueryVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056c3b8
#: 179 Function Name: NtQueryVolumeInformationFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056febb
#: 180 Function Name: NtQueueApcThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058f71b
#: 182 Function Name: NtRaiseHardError
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064689b
#: 183 Function Name: NtReadFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80570158
#: 184 Function Name: NtReadFileScatter
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d9efc
#: 185 Function Name: NtReadRequestData
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058e732
#: 186 Function Name: NtReadVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057a5c5
#: 187 Function Name: NtRegisterThreadTerminatePort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057cc78
#: 189 Function Name: NtReleaseSemaphore
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8058a51e
#: 190 Function Name: NtRemoveIoCompletion
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805662f2
#: 191 Function Name: NtRemoveProcessDebug
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806594d2
#: 192 Function Name: NtRenameKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064d137
#: 193 Function Name: NtReplaceKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064d62a
#: 194 Function Name: NtReplyPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057e393
#: 195 Function Name: NtReplyWaitReceivePort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80569f16
#: 196 Function Name: NtReplyWaitReceivePortEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80569a2e
#: 197 Function Name: NtReplyWaitReplyPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80621c42
#: 198 Function Name: NtRequestDeviceWakeup
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062a8b3
#: 199 Function Name: NtRequestPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80589ab8
#: 200 Function Name: NtRequestWaitReplyPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80575faa
#: 201 Function Name: NtRequestWakeupLatency
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062a6ac
#: 202 Function Name: NtResetEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059c7e3
#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064c148
#: 205 Function Name: NtResumeProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062e0f4
#: 206 Function Name: NtResumeThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057cb9e
#: 207 Function Name: NtSaveKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064c1ef
#: 208 Function Name: NtSaveKeyEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064c287
#: 209 Function Name: NtSaveMergedKeys
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064c35b
#: 210 Function Name: NtSecureConnectPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8057ea7a
#: 211 Function Name: NtSetBootEntryOrder
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472bf
#: 212 Function Name: NtSetBootOptions
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806472bf
#: 213 Function Name: NtSetContextThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062c4b3
#: 214 Function Name: NtSetDebugFilterState
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8065b01c
#: 215 Function Name: NtSetDefaultHardErrorPort
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805d4dbf
#: 216 Function Name: NtSetDefaultLocale
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805ae01d
#: 217 Function Name: NtSetDefaultUILanguage
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805adfc4
#: 218 Function Name: NtSetEaFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80615b2f
#: 219 Function Name: NtSetEvent
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80568718
#: 220 Function Name: NtSetEventBoostPriority
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80574c3e
#: 221 Function Name: NtSetHighEventPair
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647d03
#: 222 Function Name: NtSetHighWaitLowEventPair
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647c23
#: 223 Function Name: NtSetInformationDebugObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80658e71
#: 224 Function Name: NtSetInformationFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80576f1c
#: 225 Function Name: NtSetInformationJobObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805aaada
#: 226 Function Name: NtSetInformationKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064c853
#: 227 Function Name: NtSetInformationObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80580653
#: 228 Function Name: NtSetInformationProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8056bdcd
#: 229 Function Name: NtSetInformationThread
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80574826
#: 230 Function Name: NtSetInformationToken
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a7e85
#: 231 Function Name: NtSetIntervalProfile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647f23
#: 232 Function Name: NtSetIoCompletion
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80576dd1
#: 233 Function Name: NtSetLdtEntries
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062d1d7
#: 234 Function Name: NtSetLowEventPair
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647c97
#: 235 Function Name: NtSetLowWaitHighEventPair
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647baf
#: 236 Function Name: NtSetQuotaInformationFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80615e83
#: 237 Function Name: NtSetSecurityObject
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8059b8c1
#: 238 Function Name: NtSetSystemEnvironmentValue
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647584
#: 239 Function Name: NtSetSystemEnvironmentValueEx
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80647284
#: 240 Function Name: NtSetSystemInformation
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805a26f4
#: 241 Function Name: NtSetSystemPowerState
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80665927
#: 242 Function Name: NtSetSystemTime
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806461e5
#: 243 Function Name: NtSetThreadExecutionState
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805df7ac
#: 245 Function Name: NtSetTimerResolution
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805dfe32
#: 246 Function Name: NtSetUuidSeed
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x805aa8d6
#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80573d0d
#: 248 Function Name: NtSetVolumeInformationFile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x806163c5
#: 249 Function Name: NtShutdownSystem
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064592f
#: 251 Function Name: NtStartProfile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8064818e
#: 252 Function Name: NtStopProfile
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x80648347
#: 253 Function Name: NtSuspendProcess
Status: Hooked by "C:\WINDOWS\system32\ntoskrnl.exe" at address 0x8062e099
#: 254 Function Na==EOF==
=========================================================================
DDS log :
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 16:56:50.17 on Tue 12/01/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.545 [GMT -5:00]
FW: McAfee Personal Firewall Plus *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
SVCHOST.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Joe\My Documents\virus-DJS\dds.scr
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.dell4me.com/myway
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.dell4me.com/myway
mSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: N/A: {4d25f926-b9fe-4682-bf72-8ab8210d6d75} - c:\program files\mywaysa\srchasde\1.bin\deSrcAs.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: BHO: {22e1eff7-d8dd-4bbc-9ce8-87edbe8c1a40} - c:\windows\system32\iehelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [system tool] c:\program files\txtehn\xcrxsysguard.exe
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [CTSysVol] c:\program files\creative\sound blaster live! 24-bit\surround mixer\CTSysVol.exe /r
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\McUpdate.exe
mRun: [VirusScan Online] c:\progra~1\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [system tool] c:\program files\txtehn\xcrxsysguard.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\lsp.dll
Trusted Zone: turbotax.com
DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} - hxxp://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} - hxxp://hgtv2.view22.com/view22/app/view22rte.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
R2 MCVSRte;McAfee.com VirusScan Online Realtime Engine;c:\progra~1\mcafee.com\vso\mcvsrte.exe [2005-6-17 122880]
R3 McShield;McAfee.com McShield;c:\progra~1\mcafee.com\vso\mcshield.exe [2005-6-17 225375]
R3 NaiFiltr;NaiFiltr;c:\windows\system32\drivers\NaiFiltr.sys [2005-6-17 23296]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2005-6-17 249856]
=============== Created Last 30 ================
2009-11-01 19:35 –d—– c:\program files\Trend Micro
2009-11-01 19:35 –d—– C:\HJT-save
==================== Find3M ====================
2009-10-03 13:33 222,208 a——- c:\windows\syssvc.exe
2009-10-03 13:33 12,032 a——- c:\windows\system32\iehelper.dll
2009-10-01 20:08 180,224 a——- c:\windows\system32\lsp.dll
2009-09-11 09:33 133,632 a——- c:\windows\system32\SET1B.tmp
2009-09-11 09:33 133,632 ——– c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 15:45 58,880 a——- c:\windows\system32\SETB6.tmp
2009-09-04 15:45 58,880 ——– c:\windows\system32\dllcache\msasn1.dll
2009-05-25 12:23 34 a——- c:\documents and settings\joe\jagex_runescape_preferences.dat
============= FINISH: 16:57:27.06 ===============
here is the exehelper.exe log:
exeHelper by Raktor
Build 20091204
Run at 13:55:23 on 12/05/09
Now searching…
Checking for numerical processes…
Checking for sysguard processes…
Removing HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system tool
Deleting file C:\Program Files\txtehn\xcrxsysguard.exe
Removing HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system tool
Checking for bad processes…
Checking for bad files…
Deleting file C:\WINDOWS\system32\~.exe
Checking for bad registry entries…
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values…
Resetting policies…
–Finished–
And here is a new DDS log:
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 13:56:54.89 on Sat 12/05/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.562 [GMT -5:00]
FW: McAfee Personal Firewall Plus *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
SVCHOST.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Joe\My Documents\virus-DJS\exeHelper.com
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Joe\My Documents\virus-DJS\dds.scr
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.dell4me.com/myway
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.dell4me.com/myway
mSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: N/A: {4d25f926-b9fe-4682-bf72-8ab8210d6d75} - c:\program files\mywaysa\srchasde\1.bin\deSrcAs.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: BHO: {22e1eff7-d8dd-4bbc-9ce8-87edbe8c1a40} - c:\windows\system32\iehelper.dll
BHO: : {4d25f921-b9fe-4682-bf72-8ab8210d6d75} - c:\program files\mywaysa\srchasde\1.bin\deSrcAs.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [CTSysVol] c:\program files\creative\sound blaster live! 24-bit\surround mixer\CTSysVol.exe /r
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\McUpdate.exe
mRun: [VirusScan Online] c:\progra~1\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\lsp.dll
Trusted Zone: turbotax.com
DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} - hxxp://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} - hxxp://hgtv2.view22.com/view22/app/view22rte.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
R2 MCVSRte;McAfee.com VirusScan Online Realtime Engine;c:\progra~1\mcafee.com\vso\mcvsrte.exe [2005-6-17 122880]
R3 McShield;McAfee.com McShield;c:\progra~1\mcafee.com\vso\mcshield.exe [2005-6-17 225375]
R3 NaiFiltr;NaiFiltr;c:\windows\system32\drivers\NaiFiltr.sys [2005-6-17 23296]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2005-6-17 249856]
=============== Created Last 30 ================
==================== Find3M ====================
2009-10-03 13:33 222,208 a——- c:\windows\syssvc.exe
2009-10-03 13:33 12,032 a——- c:\windows\system32\iehelper.dll
2009-10-01 20:08 180,224 a——- c:\windows\system32\lsp.dll
2009-09-18 04:56 18,432 ——– c:\windows\system32\dllcache\iedw.exe
2009-09-11 09:33 133,632 a——- c:\windows\system32\msv1_0.dll
2009-09-11 09:33 133,632 ——– c:\windows\system32\dllcache\msv1_0.dll
2009-05-25 12:23 34 a——- c:\documents and settings\joe\jagex_runescape_preferences.dat
============= FINISH: 13:57:38.37 ===============
I attached another Attach zip file even though you didn't mention it directly, since it was created by the DDS process.
Thanks again!