Spyware / Malware / Virus Removal

[Resolved] Rootkit.Win32.TDSS.u!A2

5 min read

Looking for the outcome? Ask AI

Ally Topic Starter

Post #1December 23, 2009, 4:04 PM UTC

I did a scan of my system today with A2Free and it discovered a rootkit,I let A2 quarantine these files and done another scan with A2,it showed up another rootkit file.I then done a malwarebyte scan and it found something called rogue installer.I hope someone can help me because I have only done a clean install a few weeks back and it has taken forever to get my PC set-up.

I have some logfiles that I hope are helpful …my first A2 scan>a-squared Free - Version 4.5
Last update: 23/12/2009 13:05:36

Scan settings:

Scan type: Deep Scan
Objects: Memory, Traces, Cookies, C:\
Scan archives: On
Heuristics: Off
ADS Scan: On

Scan start: 23/12/2009 13:07:16

C:\WINDOWS\ServicePackFiles\i386\atapi.sys detected: Rootkit.Win32.TDSS.u!A2
C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys detected: Rootkit.Win32.TDSS.u!A2
C:\WINDOWS\system32\drivers\atapi.sys detected: Rootkit.Win32.TDSS.u!A2

Scanned

Files: 82645
Traces: 677818
Cookies: 31
Processes: 28

Found

Files: 3
Traces: 0
Cookies: 0
Processes: 0
Registry keys: 0

Scan end: 23/12/2009 13:44:55
Scan time: 0:37:39

C:\WINDOWS\ServicePackFiles\i386\atapi.sys Quarantined Rootkit.Win32.TDSS.u!A2
C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys Quarantined Rootkit.Win32.TDSS.u!A2
C:\WINDOWS\system32\drivers\atapi.sys Quarantined Rootkit.Win32.TDSS.u!A2

Quarantined

Files: 3
Traces: 0
Cookies: 0
my 2nd A2 scan>a-squared Free - Version 4.5
Last update: 23/12/2009 13:05:36

Scan settings:

Scan type: Deep Scan
Objects: Memory, Traces, Cookies, C:\
Scan archives: On
Heuristics: Off
ADS Scan: On

Scan start: 23/12/2009 13:49:02

C:\Documents and Settings\Alistair\Application Data\Mozilla\Firefox\Profiles\pbbl1whh.default\cookies.sqlite:1261574072734000 detected: Trace.TrackingCookie.statse.webtrendslive!A2
C:\WINDOWS\system32\dllcache\atapi.sys detected: Rootkit.Win32.TDSS.u!A2
C:\WINDOWS\system32\drivers\atapi.sys detected: Rootkit.Win32.TDSS.u!A2

Scanned

Files: 82911
Traces: 677818
Cookies: 24
Processes: 28

Found

Files: 2
Traces: 0
Cookies: 2
Processes: 0
Registry keys: 0

Scan end: 23/12/2009 14:27:06
Scan time: 0:38:04

C:\WINDOWS\system32\dllcache\atapi.sys Quarantined Rootkit.Win32.TDSS.u!A2
C:\WINDOWS\system32\drivers\atapi.sys Quarantined Rootkit.Win32.TDSS.u!A2
C:\Documents and Settings\Alistair\Application Data\Mozilla\Firefox\Profiles\pbbl1whh.default\cookies.sqlite:1261574072734000 Quarantined Trace.TrackingCookie.statse.webtrendslive!A2

Quarantined

Files: 2
Traces: 0
Cookies: 1
my mbytes scan>Malwarebytes' Anti-Malware 1.42
Database version: 3415
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

23/12/2009 14:52:04
mbam-log-2009-12-23 (14-52-04).txt

Scan type: Full Scan (C:\|)
Objects scanned: 149022
Time elapsed: 16 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Alistair\My Documents\Readon Player\SopFilter\Setup-P2PFilter-3.0.5-2009-1-23.exe (Rogue.Installer) -> Quarantined and deleted successfully.
my hjthis log>Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:56:15, on 23/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AntiLogger\AntiLogger.exe
C:\Program Files\IObit\IObit Security 360\IS360tray.exe
C:\Program Files\Styler\Styler.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AntiLogger] "C:\Program Files\AntiLogger\AntiLogger.exe" /minimized
O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [EPSON SX410 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE /FU "C:\WINDOWS\TEMP\E_S85.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Styler.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: &Virtual; keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: URLs c&heck; - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 7009 bytes
my gmer scan>GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-23 15:44:18
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Alistair\LOCALS~1\Temp\kfqiqaog.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xB410B58C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xB410BE0C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xB410C922]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xB410CE94]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwCreateFile [0xB387D788]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateKey [0xB410A436]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xB410CD6C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xB410B192]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xB410CC28]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xB410B34E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xB410CFC6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xB410EC08]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwCreateThread [0xB387CFC2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xB410CCCA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xB410E5FA]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwDeleteKey [0xB387D5AA]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwDeleteValueKey [0xB387D47C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xB410C576]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xB410F5CA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB410AECA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB410AF74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwFsControlFile [0xB410C382]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwLoadDriver [0xB387CDF8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xB410A412]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xB410A424]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwMapViewOfSection [0xB387CB9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xB410B0C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xB410CF36]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwOpenFile [0xB387D9D8]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwOpenKey [0xB387D776]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xB410CE04]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwOpenProcess [0xB387D0E4]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwOpenSection [0xB387D24A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xB410D068]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwOpenThread [0xB387D194]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xB410B01E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xB410AC46]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xB410EFD4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryValueKey [0xB410A896]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwQueueApcThread [0xB387D072]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xB410AB0E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xB410A2B0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xB410D3F2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xB410D2B8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xB410E39A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xB4111E2C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xB410F4AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xB410A248]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwSecureConnectPort [0xB387DB06]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwSetContextThread [0xB387CB2C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xB410DC4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSecurityObject [0xB410E786]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwSetSystemInformation [0xB387CF54]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwSetValueKey [0xB387D676]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xB410F1F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xB410F320]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xB410E526]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwTerminateProcess [0xB387D362]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xB410B860]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xB410EE8A]
SSDT \??\C:\Program Files\AntiLogger\AntiLog32.sys (Zemana AntiLogger Driver (stand-alone)/Zemana Ltd.) ZwWriteVirtualMemory [0xB387CA34]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
my DDStxt scan>
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 15:44:48.15 on 23/12/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3197.2777 [GMT 0:00]

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Styler\Styler.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Alistair\Desktop\Downloads\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
BHO: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: StylerToolBar: {d2f8f919-690b-4ea2-9fa7-a203d1e04f75} - c:\program files\styler\tb\StylerTB.dll
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
uRun: [EPSON SX410 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatifce.exe /fu "c:\windows\temp\E_S85.tmp" /EF "HKCU"
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AntiLogger] "c:\program files\antilogger\AntiLogger.exe" /minimized
mRun: [IObit Security 360] "c:\program files\iobit\iobit security 360\IS360tray.exe" /autostart
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\docume~1\alistair\startm~1\programs\startup\styler.lnk - c:\docume~1\alistair\applic~1\microsoft\installer\{e9ecf354-2422-4fdb-9abf-d8adac0ef941}\_585b207a.exe
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {4248FE82-7FCB-46AC-B270-339F08212110}
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: line6.net
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\alistair\applic~1\mozilla\firefox\profiles\pbbl1whh.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://m.uk.yahoo.com/
FF - plugin: c:\windows\system32\c2mp\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
R1 AntiLog32;AntiLog32;c:\program files\antilogger\AntiLog32.sys [2009-10-23 116080]
R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-12-15 315408]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-23 74480]
R2 a2free;a-squared Free Service;c:\program files\a-squared free\a2service.exe [2009-12-15 1858144]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]
R3 L6TPortGX;Service - Line 6 TonePort GX;c:\windows\system32\drivers\L6TPortGX.sys [2009-12-16 532992]
S2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe [2009-10-20 340456]
S2 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2009-12-15 312592]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3c.tmp –> c:\windows\system32\3C.tmp [?]
S3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2009-12-17 14424]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-23 7408]

=============== Created Last 30 ================

2009-12-23 14:56 –d—– c:\program files\Trend Micro
2009-12-23 05:14 –d—– c:\program files\TagScanner
2009-12-22 19:59 –d—– c:\program files\P2PFilter
2009-12-22 19:56 –d—– c:\docume~1\alluse~1\applic~1\Readon
2009-12-22 19:53 –d—– c:\program files\Readon Technology
2009-12-22 18:00 21,504 ac—— c:\windows\system32\dllcache\hidserv.dll
2009-12-22 18:00 21,504 a——- c:\windows\system32\hidserv.dll
2009-12-22 18:00 12,160 ac—— c:\windows\system32\dllcache\mouhid.sys
2009-12-22 18:00 12,160 a——- c:\windows\system32\drivers\mouhid.sys
2009-12-22 18:00 14,592 ac—— c:\windows\system32\dllcache\kbdhid.sys
2009-12-22 18:00 14,592 a——- c:\windows\system32\drivers\kbdhid.sys
2009-12-22 17:59 10,368 ac—— c:\windows\system32\dllcache\hidusb.sys
2009-12-22 17:59 10,368 a——- c:\windows\system32\drivers\hidusb.sys
2009-12-22 09:16 174 a——- c:\windows\DemaDivxFix.ini
2009-12-20 10:33 129,024 a——- c:\windows\system32\AVERM.dll
2009-12-20 10:33 28,672 a——- c:\windows\system32\AVEQT.dll
2009-12-20 10:33 –d—– c:\program files\Allok Video Joiner
2009-12-20 10:00 –d—– c:\docume~1\alistair\applic~1\Xilisoft Corporation
2009-12-20 08:34 57,398 ac—— c:\windows\system32\dllcache\imjpdadm.exe
2009-12-20 08:33 8,704 ac—— c:\windows\system32\dllcache\kbdjpn.dll
2009-12-20 08:33 8,192 ac—— c:\windows\system32\dllcache\kbdkor.dll
2009-12-20 08:33 6,144 ac—— c:\windows\system32\dllcache\kbd101c.dll
2009-12-20 08:33 5,632 ac—— c:\windows\system32\dllcache\kbd103.dll
2009-12-20 08:33 8,704 a——- c:\windows\system32\kbdjpn.dll
2009-12-20 08:33 8,192 a——- c:\windows\system32\kbdkor.dll
2009-12-20 08:33 6,144 a——- c:\windows\system32\kbd101c.dll
2009-12-20 08:33 5,632 a——- c:\windows\system32\kbd103.dll
2009-12-20 08:33 6,144 ac—— c:\windows\system32\dllcache\kbd101b.dll
2009-12-20 08:33 6,144 a——- c:\windows\system32\kbd101b.dll
2009-12-20 08:33 6,144 ac—— c:\windows\system32\dllcache\kbd106.dll
2009-12-20 08:33 6,144 a——- c:\windows\system32\kbd106.dll
2009-12-20 08:33 –d—– c:\program files\All Media Fixer
2009-12-20 05:56 361,600 a——- c:\windows\system32\drivers\tcpip.sys.backup
2009-12-20 05:50 –d–r– c:\program files\UniversalTcpipPatch
2009-12-19 23:34 –d—– c:\documents and settings\alistair\dwhelper
2009-12-19 23:32 –d—– c:\program files\ConvertHelper
2009-12-19 03:04 –d—– c:\program files\common files\Motorola Shared
2009-12-18 06:50 –d—– c:\program files\Fast AVI MPEG Joiner
2009-12-18 01:37 –d—– c:\program files\NCH Software
2009-12-18 01:34 –d—– c:\program files\NCH Swift Sound
2009-12-17 03:27 –d—– c:\program files\PeerBlock
2009-12-16 23:40 327,168 a——- c:\windows\system32\cutil32.dll
2009-12-16 23:40 285,696 a——- c:\windows\system32\cudart.dll
2009-12-16 20:39 274,288 a——- c:\windows\system32\mucltui.dll
2009-12-16 20:39 215,920 a——- c:\windows\system32\muweb.dll
2009-12-16 20:39 16,736 a——- c:\windows\system32\mucltui.dll.mui
2009-12-16 10:29 –d—– C:\DriverBackup
2009-12-16 05:41 –d—– c:\program files\Instant Photo Effects 2
2009-12-16 05:39 –d—– c:\program files\PhotoFiltre
2009-12-16 04:56 –d—– c:\program files\Photoshopportable
2009-12-16 02:54 32 a——- c:\windows\system32\w3data.vss
2009-12-16 02:54 32 a——- c:\windows\system32\msvcsv60.dll
2009-12-16 02:54 32 a——- c:\windows\msocreg32.dat
2009-12-16 02:53 –d—– c:\program files\Steinberg
2009-12-16 02:53 –d—– c:\program files\IK Multimedia
2009-12-16 02:52 –d—– c:\program files\ASIO4ALL v2
2009-12-16 02:42 532,992 a——- c:\windows\system32\drivers\L6TPortGX.sys
2009-12-16 02:42 167,936 a——- c:\windows\system32\L6tpgx.dll
2009-12-16 02:41 32 a——- c:\windows\GearBox.ini
2009-12-16 02:41 –d—– c:\program files\common files\Digidesign
2009-12-16 02:41 –d—– c:\docume~1\alluse~1\applic~1\Line 6
2009-12-16 02:41 –d—– c:\docume~1\alistair\applic~1\Line 6
2009-12-16 02:41 –d—– c:\program files\Line6
2009-12-16 00:19 –d—– c:\docume~1\alluse~1\applic~1\vsosdk
2009-12-15 14:32 –d—– c:\program files\Full Tilt Poker
2009-12-15 14:31 –d—– c:\program files\PokerStars
2009-12-15 13:39 –d—– c:\program files\a-squared Free
2009-12-15 13:31 –d—– c:\windows\system32\custom matrices
2009-12-15 13:31 –d—– c:\windows\system32\C2MP
2009-12-15 11:40 –d—– c:\windows\pss
2009-12-15 11:22 266,360 a——- c:\windows\system32\TweakUI.exe
2009-12-15 11:22 160,217 a——- c:\windows\system32\PowerToysLicense.rtf
2009-12-15 10:35 87,608 a——- c:\docume~1\alistair\applic~1\inst.exe
2009-12-15 10:35 47,360 a——- c:\windows\system32\drivers\pcouffin.sys
2009-12-15 10:35 47,360 a——- c:\docume~1\alistair\applic~1\pcouffin.sys
2009-12-15 10:35 626,688 a——- c:\windows\system32\vp7vfw.dll
2009-12-15 10:35 217,127 a——- c:\windows\system32\drv43260.dll
2009-12-15 10:35 208,935 a——- c:\windows\system32\drv33260.dll
2009-12-15 10:35 176,165 a——- c:\windows\system32\drv23260.dll
2009-12-15 10:35 102,439 a——- c:\windows\system32\sipr3260.dll
2009-12-15 10:35 65,602 a——- c:\windows\system32\cook3260.dll
2009-12-15 10:35 1,184,984 a——- c:\windows\system32\wvc1dmod.dll
2009-12-15 10:35 –d—– c:\program files\VSO
2009-12-15 10:13 –d—– c:\program files\uTorrent
2009-12-15 10:12 –d—– c:\docume~1\alistair\applic~1\uTorrent
2009-12-15 10:07 8,192 a——- c:\windows\system32\E_DCINST.DLL
2009-12-15 10:06 86,528 a——- c:\windows\system32\E_FLBFCE.DLL
2009-12-15 10:06 78,848 a——- c:\windows\system32\E_FD4BFCE.DLL
2009-12-15 10:06 26,368 ac—— c:\windows\system32\dllcache\usbstor.sys
2009-12-15 10:06 25,856 ac—— c:\windows\system32\dllcache\usbprint.sys
2009-12-15 10:06 25,856 a——- c:\windows\system32\drivers\usbprint.sys
2009-12-15 10:06 15,104 ac—— c:\windows\system32\dllcache\usbscan.sys
2009-12-15 10:06 15,104 a——- c:\windows\system32\drivers\usbscan.sys
2009-12-15 10:06 32,128 ac—— c:\windows\system32\dllcache\usbccgp.sys
2009-12-15 10:06 32,128 a——- c:\windows\system32\drivers\usbccgp.sys
2009-12-15 10:05 –d—– c:\docume~1\alluse~1\applic~1\UDL
2009-12-15 10:04 –d—– c:\program files\Epson Software
2009-12-15 10:04 –d—– c:\program files\ABBYY FineReader 6.0 Sprint
2009-12-15 10:02 –d—– c:\docume~1\alluse~1\applic~1\EPSON
2009-12-15 10:02 –d—– c:\program files\epson
2009-12-15 09:56 –d—– c:\docume~1\alluse~1\applic~1\PCPitstop
2009-12-15 09:56 –d—– c:\program files\PCPitstop
2009-12-15 09:49 –d—– c:\program files\common files\Little Registry Cleaner
2009-12-15 09:48 –d—– c:\program files\Little Registry Cleaner
2009-12-15 09:47 –d—– c:\docume~1\alistair\applic~1\Auslogics
2009-12-15 09:47 –d—– c:\program files\Auslogics
2009-12-15 09:31 –d—– c:\docume~1\alluse~1\applic~1\IObit
2009-12-15 09:23 –d—– c:\docume~1\alistair\applic~1\Free Download Manager
2009-12-15 09:23 –d—– c:\docume~1\alluse~1\applic~1\FreeDownloadManager.ORG
2009-12-15 09:23 –d—– c:\program files\Free Download Manager
2009-12-15 09:14 27,612 a——- c:\windows\syscall.dat
2009-12-15 09:14 -cd-h— c:\docume~1\alluse~1\applic~1\{E8DD7A4A-3EE8-4019-898E-952A32C3B613}
2009-12-15 09:14 –d—– c:\program files\AntiLogger
2009-12-15 08:43 –d—– c:\docume~1\alistair\applic~1\Styler
2009-12-15 08:41 –d—– c:\program files\Styler
2009-12-15 08:38 –d—– c:\program files\VideoLAN
2009-12-15 08:36 –d—– c:\program files\common files\xing shared
2009-12-15 08:36 499,712 a——- c:\windows\system32\msvcp71.dll
2009-12-15 08:36 348,160 a——- c:\windows\system32\msvcr71.dll
2009-12-15 08:36 –d—– c:\program files\common files\Real
2009-12-15 08:33 –d—– c:\program files\IconTweaker
2009-12-15 08:33 –d—– c:\docume~1\alluse~1\applic~1\IconTweaker
2009-12-15 08:28 218,624 ac—— c:\windows\system32\dllcache\uxtheme.dll
2009-12-15 08:21 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-12-15 08:21 –d—– c:\program files\SUPERAntiSpyware
2009-12-15 08:21 –d—– c:\docume~1\alistair\applic~1\SUPERAntiSpyware.com
2009-12-15 08:21 –d—– c:\program files\common files\Wise Installation Wizard
2009-12-15 08:16 –d—– c:\docume~1\alistair\applic~1\Malwarebytes
2009-12-15 08:16 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-15 08:16 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-12-15 08:16 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-12-15 08:16 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-12-15 08:15 –d—– c:\program files\DivX
2009-12-15 08:15 –d—– c:\program files\common files\DivX Shared
2009-12-15 08:14 –d—– c:\program files\Sophos
2009-12-15 08:07 –d—– c:\program files\IObit
2009-12-15 08:07 –d—– c:\docume~1\alistair\applic~1\IObit
2009-12-15 08:06 90,112 a——- c:\windows\unvise32.exe
2009-12-15 08:06 –d—– c:\program files\AxiomX
2009-12-15 08:05 –d—– c:\program files\CCleaner
2009-12-15 08:03 –d—– c:\docume~1\alistair\applic~1\Foxit
2009-12-15 08:03 –d—– c:\program files\Foxit Software
2009-12-15 07:46 411,368 a——- c:\windows\system32\deploytk.dll
2009-12-15 07:46 73,728 a——- c:\windows\system32\javacpl.cpl
2009-12-15 06:46 1,089,593 -c—— c:\windows\system32\dllcache\ntprint.cat
2009-12-15 06:39 –d—– c:\windows\system32\XPSViewer
2009-12-15 06:39 1,676,288 -c—— c:\windows\system32\dllcache\xpssvcs.dll
2009-12-15 06:39 597,504 -c—— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-15 06:39 575,488 -c—— c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-15 06:39 89,088 -c—— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-15 06:39 –d-h— C:\242871db40d80cf8538035b348
2009-12-15 06:39 1,676,288 ——– c:\windows\system32\xpssvcs.dll
2009-12-15 06:39 575,488 ——– c:\windows\system32\xpsshhdr.dll
2009-12-15 06:39 117,760 ——– c:\windows\system32\prntvpt.dll
2009-12-15 06:36 –d—– c:\program files\Windows Media Connect 2
2009-12-15 06:34 –d—– c:\windows\system32\LogFiles
2009-12-15 06:33 –d—– c:\windows\system32\URTTemp
2009-12-15 06:24 –dsh— c:\documents and settings\alistair\IECompatCache
2009-12-15 06:24 –dsh— c:\documents and settings\alistair\PrivacIE
2009-12-15 06:23 –dsh— c:\documents and settings\alistair\IETldCache
2009-12-15 06:21 11,069,952 -c—— c:\windows\system32\dllcache\ieframe.dll
2009-12-15 06:21 1,985,536 -c—— c:\windows\system32\dllcache\iertutil.dll
2009-12-15 06:21 594,432 -c—— c:\windows\system32\dllcache\msfeeds.dll
2009-12-15 06:21 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll
2009-12-15 06:21 55,296 -c—— c:\windows\system32\dllcache\msfeedsbs.dll
2009-12-15 06:21 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll
2009-12-15 06:21 –d—– c:\windows\ie8updates
2009-12-15 06:20 92,160 -c—— c:\windows\system32\dllcache\iecompat.dll
2009-12-15 06:19 -cd-h— c:\windows\ie8
2009-12-15 06:16 471,552 -c—— c:\windows\system32\dllcache\aclayers.dll
2009-12-15 05:58 –d—– c:\windows\system32\scripting
2009-12-15 05:58 –d—– c:\windows\l2schemas
2009-12-15 05:58 –d—– c:\windows\system32\en
2009-12-15 05:58 –d—– c:\windows\system32\bits
2009-12-15 05:55 –d—– c:\windows\network diagnostic
2009-12-15 05:53 –d—– c:\windows\EHome
2009-12-15 05:28 –d—– c:\windows\ServicePackFiles
2009-12-15 05:15 138,496 -c—— c:\windows\system32\dllcache\afd.sys
2009-12-15 05:15 401,408 -c—— c:\windows\system32\dllcache\rpcss.dll
2009-12-15 05:15 284,160 -c—— c:\windows\system32\dllcache\pdh.dll
2009-12-15 05:15 110,592 -c—— c:\windows\system32\dllcache\services.exe
2009-12-15 05:15 730,112 -c—— c:\windows\system32\dllcache\lsasrv.dll
2009-12-15 05:15 714,752 -c—— c:\windows\system32\dllcache\ntdll.dll
2009-12-15 05:15 617,472 -c—— c:\windows\system32\dllcache\advapi32.dll
2009-12-15 05:15 473,600 -c—— c:\windows\system32\dllcache\fastprox.dll
2009-12-15 05:15 453,120 -c—— c:\windows\system32\dllcache\wmiprvsd.dll
2009-12-15 05:15 227,840 -c—— c:\windows\system32\dllcache\wmiprvse.exe
2009-12-15 05:15 2,189,184 -c—— c:\windows\system32\dllcache\ntoskrnl.exe
2009-12-15 05:15 2,145,280 -c—— c:\windows\system32\dllcache\ntkrnlmp.exe
2009-12-15 05:15 2,023,936 -c—— c:\windows\system32\dllcache\ntkrpamp.exe
2009-12-15 05:14 203,136 -c—— c:\windows\system32\dllcache\rmcast.sys
2009-12-15 05:14 455,296 -c—— c:\windows\system32\dllcache\mrxsmb.sys
2009-12-15 05:14 333,952 -c—— c:\windows\system32\dllcache\srv.sys
2009-12-15 05:14 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll
2009-12-15 05:14 691,712 -c—— c:\windows\system32\dllcache\inetcomm.dll
2009-12-15 05:14 13,646 a——- c:\windows\system32\wpa.bak
2009-12-15 05:14 337,408 -c—— c:\windows\system32\dllcache\netapi32.dll
2009-12-15 05:14 272,128 -c—— c:\windows\system32\dllcache\bthport.sys
2009-12-15 05:14 272,128 ——– c:\windows\system32\drivers\bthport.sys
2009-12-15 05:13 8,461,312 -c—— c:\windows\system32\dllcache\shell32.dll
2009-12-15 05:13 2,560 ——– c:\windows\system32\xpsp4res.dll
2009-12-15 05:13 215,552 -c—— c:\windows\system32\dllcache\wordpad.exe
2009-12-15 05:12 –d—– c:\windows\system32\PreInstall
2009-12-15 05:12 –d-h— c:\windows\$hf_mig$
2009-12-15 05:08 –d—– c:\docume~1\alluse~1\applic~1\NVIDIA Corporation
2009-12-15 05:08 69,632 a——- c:\windows\system32\OpenCL.dll
2009-12-15 05:08 8,743 a——- c:\windows\system32\nvinfo.pb
2009-12-15 05:08 11,374,592 a——- c:\windows\system32\nvcompiler.dll
2009-12-15 05:07 253,952 -c—— c:\windows\system32\dllcache\es.dll
2009-12-15 05:06 146,650 a——- c:\windows\system32\BuzzingBee.wav
2009-12-15 05:06 940,794 a——- c:\windows\system32\LoopyMusic.wav
2009-12-15 05:06 –d—– c:\windows\system32\Lang
2009-12-15 05:04 49,152 —–r– c:\windows\system32\ChCfg.exe
2009-12-15 05:02 26,144 a——- c:\windows\system32\spupdsvc.exe
2009-12-15 05:02 –d—– c:\program files\Realtek
2009-12-15 05:01 –d—– c:\windows\AS_SCRIPTS
2009-12-15 04:57 108,059 a——- c:\windows\system32\drivers\klin.dat
2009-12-15 04:57 95,259 a——- c:\windows\system32\drivers\klick.dat
2009-12-15 04:57 –d—– c:\program files\Kaspersky Lab
2009-12-15 04:57 –d—– c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2009-12-15 04:56 –d—– c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2009-12-15 04:51 –dsh— c:\documents and settings\alistair\UserData
2009-12-15 04:49 –d—– c:\program files\SystemRequirementsLab
2009-12-15 04:45 –d—– c:\program files\NVIDIA Corporation
2009-12-15 04:44 701,440 a——- c:\windows\system32\cohelper.dll
2009-12-15 04:44 485,920 a——- c:\windows\system32\nvunrm.exe
2009-12-15 04:44 7,090 a——- c:\windows\system32\nvnrm.nvu
2009-12-15 04:44 –d—– c:\windows\system32\ReinstallBackups
2009-12-15 04:41 –d—– C:\NVIDIA
2009-12-15 04:33 –d—– c:\windows\ASUSInstAll
2009-12-15 04:28 592,488 a——- c:\windows\system32\nvudisp.exe
2009-12-15 04:28 25,699 a——- c:\windows\system32\nvdisp.nvu
2009-12-15 04:28 –d—– c:\windows\nview
2009-12-15 04:28 –d—– c:\windows\system32\SoftwareDistribution
2009-12-15 04:27 888,320 a——- c:\windows\system32\fdco1ins.dll
2009-12-15 04:27 1,732 a—-r– c:\windows\system32\drivers\nvphy.bin
2009-12-15 04:27 11,264 a——- c:\windows\system32\bdco1ins.dll
2009-12-15 04:27 453,152 a——- c:\windows\system32\nvusmb.exe
2009-12-15 04:27 2,344 a——- c:\windows\system32\nvsmb.nvu
2009-12-15 04:27 592,488 a——- c:\windows\system32\NVUNINST.EXE
2009-12-15 04:26 11,028 a——- c:\windows\Ascd_log.ini
2009-12-15 04:26 5,810 a—-r– c:\windows\system32\drivers\ASACPI.sys
2009-12-15 04:26 10,855 a——- c:\windows\Ascd_tmp.ini
2009-12-15 04:26 12,536 a——- c:\windows\system32\drivers\ASUSHWIO.SYS
2009-12-15 04:25 –d—– c:\documents and settings\Alistair
2009-12-15 04:24 –ds—- c:\windows\system32\Microsoft
2009-12-15 04:24 8,192 a——- c:\windows\REGLOCS.OLD
2009-12-15 04:22 18,944 ac—— c:\windows\system32\dllcache\cprofile.exe
2009-12-15 04:21 –dsh— c:\documents and settings\all users\DRM
2009-12-15 04:21 488 a—hr– c:\windows\system32\WindowsLogon.manifest
2009-12-15 04:21 –d-h— c:\program files\WindowsUpdate
2009-12-15 04:20 –d—– c:\program files\common files\MSSoap
2009-12-15 04:19 –d—– c:\program files\Online Services
2009-12-15 04:19 –d—– c:\program files\Messenger
2009-12-15 04:19 –d—– c:\program files\MSN Gaming Zone
2009-12-15 04:19 –d—– c:\program files\Windows NT
2009-12-15 04:14 –d—– c:\program files\common files\ODBC
2009-12-15 04:14 –d—– c:\program files\common files\SpeechEngines
2009-12-15 04:14 –d–r– c:\documents and settings\all users\Documents

==================== Find3M ====================

2009-12-20 07:16 361,600 a——- c:\windows\system32\drivers\tcpip.sys
2009-12-15 06:00 76,487 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-12-15 05:02 315,392 a——- c:\windows\HideWin.exe
2009-12-15 04:20 21,640 a——- c:\windows\system32\emptyregdb.dat
2009-12-03 05:38 1,060,864 a——- c:\windows\system32\MFC71.dll
2009-11-21 15:51 471,552 a——- c:\windows\apppatch\aclayers.dll
2009-11-21 02:34 13,602,816 a——- c:\windows\system32\nvoglnt.dll
2009-11-21 02:34 10,235,968 a——- c:\windows\system32\drivers\nv4_mini.sys
2009-11-21 02:34 6,282,752 a——- c:\windows\system32\nv4_disp.dll
2009-11-21 02:34 4,038,656 a——- c:\windows\system32\nvcuda.dll
2009-11-21 02:34 2,293,286 a——- c:\windows\system32\nvdata.bin
2009-11-21 02:34 2,259,560 a——- c:\windows\system32\nvcuvid.dll
2009-11-21 02:34 1,989,224 a——- c:\windows\system32\nvcuvenc.dll
2009-11-21 02:34 1,056,768 a——- c:\windows\system32\nvapi.dll
2009-11-21 02:34 182,888 a——- c:\windows\system32\nvcodins.dll
2009-11-21 02:34 182,888 a——- c:\windows\system32\nvcod.dll
2009-11-20 20:32 12,669,544 a——- c:\windows\system32\nvcpl.dll
2009-11-20 20:32 278,120 a——- c:\windows\system32\nvmccs.dll
2009-11-20 20:32 154,216 a——- c:\windows\system32\nvsvc32.exe
2009-11-20 20:32 145,000 a——- c:\windows\system32\nvcolor.exe
2009-11-20 20:32 110,184 a——- c:\windows\system32\nvmctray.dll
2009-11-20 20:32 81,920 a——- c:\windows\system32\nvwddi.dll
2009-11-14 00:49 129,784 ——– c:\windows\system32\pxafs.dll
2009-11-14 00:49 120,056 ——– c:\windows\system32\pxcpyi64.exe
2009-11-14 00:49 118,520 ——– c:\windows\system32\pxinsi64.exe
2009-11-14 00:49 43,528 ——– c:\windows\system32\drivers\PxHelp20.sys
2009-11-14 00:49 9,464 ——– c:\windows\system32\drivers\cdralw2k.sys
2009-11-14 00:49 9,336 ——– c:\windows\system32\drivers\cdr4_xp.sys
2009-11-14 00:47 856,064 a——- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 856,064 a——- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 847,872 a——- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 843,776 a——- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 839,680 a——- c:\windows\system32\divx_xx11.dll
2009-10-29 07:45 916,480 a——- c:\windows\system32\wininet.dll
2009-10-27 23:22 4,835,652 a——- c:\windows\system32\libavcodec.dll
2009-10-27 23:16 1,632,375 a——- c:\windows\system32\ffmpegmt.dll
2009-10-27 23:16 611,638 a——- c:\windows\system32\libmplayer.dll
2009-10-27 23:10 143,872 a——- c:\windows\system32\libmpeg2_ff.dll
2009-10-27 22:46 248,320 a——- c:\windows\system32\ff_kernelDeint.dll
2009-10-27 22:28 324,096 a——- c:\windows\system32\TomsMoComp_ff.dll
2009-10-21 05:38 75,776 a——- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 25,088 a——- c:\windows\system32\httpapi.dll
2009-10-20 19:34 219,664 a——- c:\windows\system32\klogon.dll
2009-10-16 23:58 183,296 a——- c:\windows\system32\ff_samplerate.dll
2009-10-16 23:57 146,944 a——- c:\windows\system32\ff_tremor.dll
2009-10-16 23:04 178,688 a——- c:\windows\system32\ff_libmad.dll
2009-10-16 23:04 113,152 a——- c:\windows\system32\ff_unrar.dll
2009-10-16 23:03 257,024 a——- c:\windows\system32\ff_libdts.dll
2009-10-16 23:03 142,848 a——- c:\windows\system32\ff_liba52.dll
2009-10-16 23:03 484,864 a——- c:\windows\system32\ff_libfaad2.dll
2009-10-16 20:53 100,864 a——- c:\windows\system32\ff_wmv9.dll
2009-10-16 20:53 85,504 a——- c:\windows\system32\ff_vfw.dll
2009-10-16 19:40 957,047 a——- c:\windows\system32\ff_x264.dll
2009-10-16 19:38 914,464 a——- c:\windows\system32\xvidcore.dll
2009-10-13 10:30 270,336 a——- c:\windows\system32\oakley.dll
2009-10-12 13:38 149,504 a——- c:\windows\system32\rastls.dll
2009-10-12 13:38 79,872 a——- c:\windows\system32\raschap.dll

============= FINISH: 15:46:02.51 ===============
I also have a txt file from my DDS scan called attach.txt if it is needed.If anyone can help that would be greatly appreciated,thanks.

LDTate

Post #2December 27, 2009, 1:30 PM UTC

[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
IObit Security 360

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

Ally

Post #3December 28, 2009, 7:39 AM UTC

Hi LDTate,Merry Christmas! I scanned my PC again with A2free a couple of days ago and got a message saying the files that were quarantined were false positives and re-enabled them.However,I have followed your instructions though incase you would like to take a further look,just to be on the safe side!Again thanks for all your help! here is my combofix log >ComboFix 09-12-27.02 - Alistair 28/12/2009 7:17.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3197.2720 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Alistair\Application Data\inst.exe
c:\windows\system32\msvcsv60.dll

.
((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-28 )))))))))))))))))))))))))))))))
.

2009-12-27 07:28 . 2009-12-27 07:28 ——– d—–w- c:\program files\CCleaner
2009-12-25 07:03 . 2009-12-25 07:03 15086 —-a-r- c:\documents and settings\Alistair\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_7b12541d.exe
2009-12-25 07:03 . 2009-12-25 07:03 15086 —-a-r- c:\documents and settings\Alistair\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe
2009-12-24 14:51 . 2008-04-14 00:12 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2009-12-24 14:51 . 2001-08-17 22:36 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2009-12-24 14:51 . 2008-04-14 00:12 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll
2009-12-24 14:51 . 2001-08-17 22:37 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe
2009-12-24 14:51 . 2001-08-17 22:37 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe
2009-12-24 14:51 . 2001-08-17 22:37 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe
2009-12-24 14:51 . 2001-08-17 12:11 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys
2009-12-24 14:51 . 2004-08-03 22:29 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys
2009-12-24 14:49 . 2001-08-17 13:28 397502 -c–a-w- c:\windows\system32\dllcache\vpctcom.sys
2009-12-24 14:48 . 2001-08-17 22:36 69632 -c–a-w- c:\windows\system32\dllcache\umaxu12.dll
2009-12-24 14:47 . 2001-08-17 13:51 4992 -c–a-w- c:\windows\system32\dllcache\toside.sys
2009-12-24 14:46 . 2001-08-17 22:36 94293 -c–a-w- c:\windows\system32\dllcache\sxports.dll
2009-12-24 14:45 . 2001-08-17 22:36 114688 -c–a-w- c:\windows\system32\dllcache\sonypi.dll
2009-12-24 14:44 . 2001-08-17 14:56 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll
2009-12-24 14:43 . 2001-08-17 13:51 16640 -c–a-w- c:\windows\system32\dllcache\scmstcs.sys
2009-12-24 14:42 . 2001-08-17 22:36 9216 -c–a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2009-12-24 14:41 . 2001-08-17 22:36 35328 -c–a-w- c:\windows\system32\dllcache\psisload.dll
2009-12-24 14:40 . 2001-08-17 12:12 26153 -c–a-w- c:\windows\system32\dllcache\pcmlm56.sys
2009-12-24 14:39 . 2001-08-17 13:47 9344 -c–a-w- c:\windows\system32\dllcache\ntapm.sys
2009-12-24 14:38 . 2001-08-17 13:50 21888 -c–a-w- c:\windows\system32\dllcache\mxcard.sys
2009-12-24 14:37 . 2001-08-17 12:19 48768 -c–a-w- c:\windows\system32\dllcache\maestro.sys
2009-12-24 14:36 . 2001-08-17 13:51 18688 -c–a-w- c:\windows\system32\dllcache\irsir.sys
2009-12-24 14:35 . 2008-04-13 18:41 18560 -c–a-w- c:\windows\system32\dllcache\i2omp.sys
2009-12-24 14:34 . 2001-08-17 22:36 48128 -c–a-w- c:\windows\system32\dllcache\hpgt33tk.dll
2009-12-24 14:33 . 2001-08-17 12:12 24618 -c–a-w- c:\windows\system32\dllcache\fa410nd5.sys
2009-12-24 14:32 . 2001-08-17 13:28 634134 -c–a-w- c:\windows\system32\dllcache\el656ct5.sys
2009-12-24 14:31 . 2001-08-17 13:52 7424 -c–a-w- c:\windows\system32\dllcache\ddsmc.sys
2009-12-24 14:30 . 2001-08-17 22:36 74240 -c–a-w- c:\windows\system32\dllcache\camexo20.dll
2009-12-24 14:29 . 2001-08-17 14:07 56960 -c–a-w- c:\windows\system32\dllcache\aic78xx.sys
2009-12-24 12:06 . 2009-12-24 12:12 ——– d—–w- c:\program files\Winamp Desk Band
2009-12-24 09:30 . 2009-12-24 09:30 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\DFX
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\documents and settings\SUPPORT_388945a0
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\documents and settings\HelpAssistant
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\documents and settings\Guest
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\documents and settings\ASPNET
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\documents and settings\Administrator
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\documents and settings\All Users\Application Data\DFX
2009-12-24 09:29 . 2009-12-24 09:29 ——– d—–w- c:\program files\Common Files\DFX
2009-12-24 08:15 . 2009-12-24 11:53 ——– d—–w- c:\program files\Winamp
2009-12-24 08:15 . 2009-12-24 11:52 ——– d—–w- c:\documents and settings\Alistair\Application Data\Winamp
2009-12-24 05:28 . 2009-12-24 05:31 ——– d—–w- c:\program files\Windows Live Safety Center
2009-12-24 05:27 . 2008-12-04 01:25 120832 -c–a-w- c:\documents and settings\Alistair\Application Data\Mozilla\Firefox\Profiles\pbbl1whh.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-12-23 14:56 . 2009-12-23 14:56 ——– d—–w- c:\program files\Trend Micro
2009-12-23 05:14 . 2009-12-23 12:46 ——– d—–w- c:\program files\TagScanner
2009-12-22 19:59 . 2009-12-22 19:59 ——– d—–w- c:\program files\P2PFilter
2009-12-22 19:54 . 2009-12-22 19:54 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\Readon_Technology
2009-12-22 19:53 . 2009-12-22 19:53 ——– d—–w- c:\program files\Readon Technology
2009-12-22 18:00 . 2008-04-14 00:11 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2009-12-22 18:00 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2009-12-22 18:00 . 2001-08-17 13:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2009-12-22 18:00 . 2001-08-17 13:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2009-12-22 18:00 . 2008-04-13 18:39 14592 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys
2009-12-22 18:00 . 2008-04-13 18:39 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2009-12-22 17:59 . 2008-04-13 18:45 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2009-12-22 17:59 . 2008-04-13 18:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2009-12-20 12:37 . 2009-12-24 21:44 52224 —-a-w- c:\documents and settings\Alistair\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-20 10:33 . 2007-04-12 14:19 129024 —-a-w- c:\windows\system32\AVERM.dll
2009-12-20 10:33 . 2006-09-26 13:57 28672 —-a-w- c:\windows\system32\AVEQT.dll
2009-12-20 10:33 . 2009-12-20 10:34 ——– d—–w- c:\program files\Allok Video Joiner
2009-12-20 10:00 . 2009-12-20 10:00 ——– d—–w- c:\documents and settings\Alistair\Application Data\Xilisoft Corporation
2009-12-20 08:34 . 2004-08-04 12:00 57398 -c–a-w- c:\windows\system32\dllcache\imjpdadm.exe
2009-12-20 08:34 . 2004-08-04 12:00 45109 -c–a-w- c:\windows\system32\dllcache\imjpuex.exe
2009-12-20 08:34 . 2004-08-04 12:00 6656 -c–a-w- c:\windows\system32\dllcache\c_is2022.dll
2009-12-20 08:34 . 2004-08-04 12:00 6656 —-a-w- c:\windows\system32\c_is2022.dll
2009-12-20 05:50 . 2009-12-20 06:04 ——– d—–r- c:\program files\UniversalTcpipPatch
2009-12-19 23:34 . 2009-12-19 23:36 ——– d—–w- c:\documents and settings\Alistair\dwhelper
2009-12-19 23:32 . 2009-12-19 23:32 ——– d—–w- c:\program files\ConvertHelper
2009-12-19 03:04 . 2009-12-19 03:04 ——– d—–w- c:\program files\Common Files\Motorola Shared
2009-12-18 06:50 . 2009-12-18 06:50 ——– d—–w- c:\program files\Fast AVI MPEG Joiner
2009-12-18 01:37 . 2009-12-18 01:37 ——– d—–w- c:\program files\NCH Software
2009-12-18 01:34 . 2009-12-18 01:34 ——– d—–w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-12-18 01:34 . 2009-12-18 01:34 ——– d—–w- c:\program files\NCH Swift Sound
2009-12-18 01:34 . 2009-12-18 01:34 ——– d—–w- c:\documents and settings\Alistair\Application Data\NCH Swift Sound
2009-12-17 03:27 . 2009-12-25 08:30 ——– d—–w- c:\program files\PeerBlock
2009-12-16 23:40 . 2009-10-06 18:32 327168 —-a-w- c:\windows\system32\cutil32.dll
2009-12-16 23:40 . 2009-08-03 20:25 285696 —-a-w- c:\windows\system32\cudart.dll
2009-12-16 20:39 . 2009-08-06 19:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2009-12-16 20:39 . 2009-08-06 19:23 215920 —-a-w- c:\windows\system32\muweb.dll
2009-12-16 10:29 . 2009-12-16 10:29 ——– d—–w- C:\DriverBackup
2009-12-16 07:07 . 2009-12-16 07:07 ——– d—–w- c:\documents and settings\Alistair\Application Data\Apple Computer
2009-12-16 07:05 . 2009-12-19 04:20 ——– d—–w- c:\program files\QuickTime
2009-12-16 07:05 . 2009-12-16 07:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-16 07:04 . 2009-12-16 07:04 ——– d—–w- c:\program files\Common Files\Apple
2009-12-16 07:04 . 2009-12-16 07:04 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\Apple
2009-12-16 07:04 . 2009-12-16 07:04 ——– d—–w- c:\program files\Apple Software Update
2009-12-16 07:04 . 2009-12-16 07:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-12-16 07:04 . 2009-12-16 07:04 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\Apple Computer
2009-12-16 06:28 . 2009-12-16 06:28 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\Identities
2009-12-16 05:39 . 2009-12-16 05:39 ——– d—–w- c:\program files\PhotoFiltre
2009-12-16 04:56 . 2009-12-16 04:58 ——– d—–w- c:\program files\Photoshopportable
2009-12-16 04:38 . 2009-12-16 04:38 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-16 02:54 . 2009-12-27 11:44 32 —-a-w- c:\windows\msocreg32.dat
2009-12-16 02:53 . 2009-12-16 02:53 ——– d—–w- c:\program files\Steinberg
2009-12-16 02:53 . 2009-12-16 02:57 ——– d—–w- c:\program files\IK Multimedia
2009-12-16 02:52 . 2009-12-16 02:52 ——– d—–w- c:\program files\ASIO4ALL v2
2009-12-16 02:42 . 2009-07-07 22:00 167936 —-a-w- c:\windows\system32\L6tpgx.dll
2009-12-16 02:42 . 2009-07-07 22:00 532992 —-a-w- c:\windows\system32\drivers\L6TPortGX.sys
2009-12-16 02:41 . 2009-12-16 02:45 ——– d—–w- c:\documents and settings\Alistair\Application Data\Line 6
2009-12-16 02:41 . 2009-12-16 02:41 ——– d—–w- c:\program files\Common Files\Digidesign
2009-12-16 02:41 . 2009-12-16 02:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Line 6
2009-12-16 02:41 . 2009-12-16 02:41 ——– d—–w- c:\program files\Line6
2009-12-16 01:56 . 2009-12-16 01:56 ——– d—–w- c:\documents and settings\Alistair\Application Data\DivX
2009-12-16 00:19 . 2009-12-16 00:19 ——– d—–w- c:\documents and settings\All Users\Application Data\vsosdk
2009-12-15 14:33 . 2009-12-26 03:19 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\FullTiltPoker
2009-12-15 14:32 . 2009-12-26 03:19 ——– d—–w- c:\program files\Full Tilt Poker
2009-12-15 14:31 . 2009-12-19 05:14 ——– d—–w- c:\program files\PokerStars
2009-12-15 13:39 . 2009-12-24 06:53 ——– d—–w- c:\program files\a-squared Free
2009-12-15 13:31 . 2009-12-15 13:31 ——– d—–w- c:\windows\system32\custom matrices
2009-12-15 13:31 . 2009-12-15 13:31 ——– d—–w- c:\windows\system32\C2MP
2009-12-15 13:27 . 2009-12-15 13:27 177024 —-a-w- c:\documents and settings\Alistair\Application Data\Mozilla\Firefox\Profiles\pbbl1whh.default\FlashGot.exe
2009-12-15 11:22 . 2003-06-25 16:05 266360 —-a-w- c:\windows\system32\TweakUI.exe
2009-12-15 11:10 . 2009-12-15 11:10 ——– d—–w- c:\documents and settings\Alistair\Local Settings\Application Data\Stardock
2009-12-15 10:58 . 2008-04-14 00:12 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-12-15 10:53 . 2009-12-15 10:53 ——– d—–w- c:\documents and settings\Alistair\Application Data\EPSON
2009-12-15 10:35 . 2009-12-17 11:33 ——– d—–w- c:\documents and settings\Alistair\Application Data\Vso
2009-12-15 10:35 . 2009-12-15 10:35 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-15 10:35 . 2009-12-15 10:35 47360 —-a-w- c:\documents and settings\Alistair\Application Data\pcouffin.sys
2009-12-15 10:35 . 2009-09-02 16:41 65602 —-a-w- c:\windows\system32\cook3260.dll
2009-12-15 10:35 . 2009-09-02 16:41 626688 —-a-w- c:\windows\system32\vp7vfw.dll
2009-12-15 10:35 . 2009-09-02 16:41 217127 —-a-w- c:\windows\system32\drv43260.dll
2009-12-15 10:35 . 2009-09-02 16:41 208935 —-a-w- c:\windows\system32\drv33260.dll
2009-12-15 10:35 . 2009-09-02 16:41 176165 —-a-w- c:\windows\system32\drv23260.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-28 07:22 . 2009-12-15 04:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-12-25 06:57 . 2004-08-04 12:00 218624 —-a-w- c:\windows\system32\uxtheme.dll
2009-12-24 06:13 . 2004-08-04 12:00 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2009-12-22 07:29 . 2009-12-15 04:36 20848 —-a-w- c:\documents and settings\Alistair\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-20 08:44 . 2009-12-20 08:33 ——– d—–w- c:\program files\All Media Fixer
2009-12-16 05:41 . 2009-12-16 05:41 ——– d—–w- c:\program files\Instant Photo Effects 2
2009-12-16 02:57 . 2009-12-15 04:46 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-15 10:07 . 2009-12-15 10:02 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2009-12-15 10:04 . 2009-12-15 10:02 ——– d—–w- c:\program files\epson
2009-12-15 08:15 . 2009-12-15 08:15 ——– d—–w- c:\program files\DivX
2009-12-15 08:15 . 2009-12-15 08:15 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-12-15 06:39 . 2009-12-15 06:39 ——– d—–w- c:\program files\MSBuild
2009-12-15 06:39 . 2009-12-15 06:39 ——– d—–w- c:\program files\Reference Assemblies
2009-12-15 06:00 . 2009-12-15 04:22 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-15 05:09 . 2009-12-15 04:45 ——– d—–w- c:\program files\NVIDIA Corporation
2009-12-15 05:02 . 2009-12-15 05:02 ——– d—–w- c:\program files\Realtek
2009-12-15 05:02 . 2009-12-15 05:02 315392 —-a-w- c:\windows\HideWin.exe
2009-12-15 04:57 . 2009-12-15 04:57 95259 —-a-w- c:\windows\system32\drivers\klick.dat
2009-12-15 04:57 . 2009-12-15 04:57 108059 —-a-w- c:\windows\system32\drivers\klin.dat
2009-12-15 04:57 . 2009-12-15 04:57 ——– d—–w- c:\program files\Kaspersky Lab
2009-12-15 04:56 . 2009-12-15 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-12-15 04:49 . 2009-12-15 04:49 ——– d—–w- c:\program files\SystemRequirementsLab
2009-12-15 04:27 . 2009-12-15 04:27 ——– d—–w- c:\documents and settings\Alistair\Application Data\InstallShield
2009-12-15 04:22 . 2009-12-15 04:22 ——– d—–w- c:\program files\microsoft frontpage
2009-12-15 04:20 . 2009-12-15 04:20 21640 —-a-w- c:\windows\system32\emptyregdb.dat
2009-12-03 05:38 . 2009-12-03 05:38 1060864 —-a-w- c:\windows\system32\MFC71.dll
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-21 02:34 . 2009-12-15 04:28 592488 —-a-w- c:\windows\system32\nvudisp.exe
2009-11-21 02:34 . 2009-07-08 09:07 4038656 —-a-w- c:\windows\system32\nvcuda.dll
2009-11-21 02:34 . 2009-07-08 09:07 2293286 —-a-w- c:\windows\system32\nvdata.bin
2009-11-21 02:34 . 2009-07-08 09:07 2259560 —-a-w- c:\windows\system32\nvcuvid.dll
2009-11-21 02:34 . 2009-07-08 09:07 1989224 —-a-w- c:\windows\system32\nvcuvenc.dll
2009-11-21 02:34 . 2007-10-04 08:14 6282752 —-a-w- c:\windows\system32\nv4_disp.dll
2009-11-21 02:34 . 2007-10-04 08:14 182888 —-a-w- c:\windows\system32\nvcodins.dll
2009-11-21 02:34 . 2007-10-04 08:14 182888 —-a-w- c:\windows\system32\nvcod.dll
2009-11-21 02:34 . 2007-10-04 08:14 13602816 —-a-w- c:\windows\system32\nvoglnt.dll
2009-11-21 02:34 . 2007-10-04 08:14 1056768 —-a-w- c:\windows\system32\nvapi.dll
2009-11-21 02:34 . 2007-10-04 08:14 10235968 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-11-20 20:32 . 2009-11-20 20:32 278120 —-a-w- c:\windows\system32\nvmccs.dll
2009-11-20 20:32 . 2009-11-20 20:32 154216 —-a-w- c:\windows\system32\nvsvc32.exe
2009-11-20 20:32 . 2009-11-20 20:32 145000 —-a-w- c:\windows\system32\nvcolor.exe
2009-11-20 20:32 . 2009-11-20 20:32 12669544 —-a-w- c:\windows\system32\nvcpl.dll
2009-11-20 20:32 . 2009-11-20 20:32 110184 —-a-w- c:\windows\system32\nvmctray.dll
2009-11-20 20:32 . 2009-11-20 20:32 81920 —-a-w- c:\windows\system32\nvwddi.dll
2009-11-19 21:42 . 2009-12-15 04:27 592488 —-a-w- c:\windows\system32\NVUNINST.EXE
2009-11-14 13:06 . 2009-11-14 13:06 59992 —-a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.736\English\setup.exe
2009-11-14 00:49 . 2009-12-15 08:15 9464 ——w- c:\windows\system32\drivers\cdralw2k.sys
2009-11-14 00:49 . 2009-12-15 08:15 9336 ——w- c:\windows\system32\drivers\cdr4_xp.sys
2009-11-14 00:49 . 2009-12-15 08:15 120056 ——w- c:\windows\system32\pxcpyi64.exe
2009-11-14 00:49 . 2009-12-15 08:15 118520 ——w- c:\windows\system32\pxinsi64.exe
2009-11-14 00:47 . 2009-11-14 00:47 856064 —-a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 —-a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 —-a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 —-a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 —-a-w- c:\windows\system32\divx_xx11.dll
2009-10-29 07:45 . 2004-08-04 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-27 23:22 . 2009-10-27 23:22 4835652 —-a-w- c:\windows\system32\libavcodec.dll
2009-10-27 23:16 . 2009-10-27 23:16 1632375 —-a-w- c:\windows\system32\ffmpegmt.dll
2009-10-27 23:16 . 2009-10-27 23:16 611638 —-a-w- c:\windows\system32\libmplayer.dll
2009-10-27 23:10 . 2009-10-27 23:10 143872 —-a-w- c:\windows\system32\libmpeg2_ff.dll
2009-10-27 22:46 . 2009-10-27 22:46 248320 —-a-w- c:\windows\system32\ff_kernelDeint.dll
2009-10-27 22:28 . 2009-10-27 22:28 324096 —-a-w- c:\windows\system32\TomsMoComp_ff.dll
2009-10-21 05:38 . 2004-08-04 12:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 19:34 . 2009-10-20 19:34 219664 —-a-w- c:\windows\system32\klogon.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-16 23:58 . 2009-10-16 23:58 183296 —-a-w- c:\windows\system32\ff_samplerate.dll
2009-10-16 23:57 . 2009-10-16 23:57 146944 —-a-w- c:\windows\system32\ff_tremor.dll
2009-10-16 23:04 . 2009-10-16 23:04 178688 —-a-w- c:\windows\system32\ff_libmad.dll
2009-10-16 23:04 . 2009-10-16 23:04 113152 —-a-w- c:\windows\system32\ff_unrar.dll
2009-10-16 23:03 . 2009-10-16 23:03 257024 —-a-w- c:\windows\system32\ff_libdts.dll
2009-10-16 23:03 . 2009-10-16 23:03 142848 —-a-w- c:\windows\system32\ff_liba52.dll
2009-10-16 23:03 . 2009-10-16 23:03 484864 —-a-w- c:\windows\system32\ff_libfaad2.dll
2009-10-16 20:53 . 2009-10-16 20:53 100864 —-a-w- c:\windows\system32\ff_wmv9.dll
2009-10-16 20:53 . 2009-10-16 20:53 85504 —-a-w- c:\windows\system32\ff_vfw.dll
2009-10-16 19:40 . 2009-10-16 19:40 957047 —-a-w- c:\windows\system32\ff_x264.dll
2009-10-16 19:38 . 2009-10-16 19:38 914464 —-a-w- c:\windows\system32\xvidcore.dll
2009-10-14 20:18 . 2009-10-14 20:18 36880 —-a-w- c:\windows\system32\drivers\klbg.sys
2009-10-13 10:30 . 2004-08-04 12:00 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 12:00 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 12:00 79872 —-a-w- c:\windows\system32\raschap.dll
2009-10-02 18:39 . 2009-10-02 18:39 19472 —-a-w- c:\windows\system32\drivers\klmouflt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]
"SkyTel"="SkyTel.EXE" [2007-08-03 1826816]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-20 110184]
"AntiLogger"="c:\program files\AntiLogger\AntiLogger.exe" [2009-10-23 2478448]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]

c:\documents and settings\Alistair\Start Menu\Programs\Startup\
Styler.lnk - c:\documents and settings\Alistair\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2009-12-25 15086]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14/10/2009 20:18 36880]
R1 AntiLog32;AntiLog32;c:\program files\AntiLogger\AntiLog32.sys [23/10/2009 09:47 116080]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/11/2009 08:43 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/11/2009 08:43 74480]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [15/12/2009 13:39 1858144]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14/09/2009 13:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02/10/2009 18:39 19472]
R3 L6TPortGX;Service - Line 6 TonePort GX;c:\windows\system32\drivers\L6TPortGX.sys [16/12/2009 02:42 532992]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3C.tmp –> c:\windows\system32\3C.tmp [?]
S3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [17/12/2009 03:27 14424]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/11/2009 08:43 7408]
S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [15/12/2009 09:56 90352]
.
——- Supplementary Scan ——-
.
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
Trusted Zone: line6.net
FF - ProfilePath - c:\documents and settings\Alistair\Application Data\Mozilla\Firefox\Profiles\pbbl1whh.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://m.uk.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-28 07:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\3C.tmp"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1032)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3540)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvsvc32.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Styler\Styler.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-12-28 07:24:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-28 07:24

Pre-Run: 232,018,440,192 bytes free
Post-Run: 231,942,144,000 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 92E110BA92E68D26E5EDC5A4E37135D4
And my HJthis log>Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:30:16, on 28/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AntiLogger\AntiLogger.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Styler\Styler.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Alistair\Desktop\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AntiLogger] "C:\Program Files\AntiLogger\AntiLogger.exe" /minimized
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - Startup: Styler.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: &Virtual; keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: URLs c&heck; - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–cheers!

LDTate

Post #4December 28, 2009, 8:58 PM UTC

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

Click START then RUN
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

To be on the safe side, I would also change all my passwords.

Here's my usual all clean post

Log looks good
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  - From within Internet Explorer click on the Tools menu and then click on Options.
  - Click once on the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would suggest you read How to Prevent Malware:

Ally

Post #5December 28, 2009, 9:39 PM UTC

Once again thanks for taking the time too look over my logs.Merry Christmas to you and all at what the tech!Best wishes for the new year

LDTate

Post #6December 28, 2009, 9:41 PM UTC

Great job

You're more then welcome. Glad we were able to help Peace be with you

LDTate

Post #7December 28, 2009, 9:41 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Rootkit.Win32.TDSS.u!A2

✨ Ask AI

Ask AI