lourdes15301
Topic Starter
When using any search engine (Yahoo, Google ect) all links get redirected to various sites. Even when checking Yahoo Mail, clicking sign in pops another window in a new tab. Some exe programs will not work, they start and CPU usage goes to 100% and then the program stops responding. Using your "Are you infected" thread, this is what I have done.
1. Downloaded and ran ATF Cleaner.
2. Downloaded and tried to run System Restore. (A box never appeared and CPU went to 100%. Everything locked and hitting the reset was the only was to get going again. Tried this twice.
3. Downloaded and ran ERUNT with no problem.
4. Downloaded, updated and ran MBAM. Here is the log.
6. Downloaded and ran DDS. The logs are below.
1. Downloaded and ran ATF Cleaner.
2. Downloaded and tried to run System Restore. (A box never appeared and CPU went to 100%. Everything locked and hitting the reset was the only was to get going again. Tried this twice.
3. Downloaded and ran ERUNT with no problem.
4. Downloaded, updated and ran MBAM. Here is the log.
Malwarebytes' Anti-Malware 1.43 Database version: 3509 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1/7/2010 3:29:49 PM mbam-log-2010-01-07 (15-29-49).txt Scan type: Quick Scan Objects scanned: 112660 Time elapsed: 6 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)5. Downloaded and tried to run GMER. CPU went to 100% and after 1 hour stopped responding and would not let you shut it down thus no LOG as I had to hit reset.
6. Downloaded and ran DDS. The logs are below.
Attach text UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume3 Install Date: 4/5/2007 6:33:13 PM System Uptime: 1/7/2010 4:19:56 PM (0 hours ago) Motherboard: ASUSTeK Computer Inc. | | A8V Deluxe Processor: AMD Athlon™ 64 X2 Dual Core Processor 4400+ | Socket 939 | 2202/200mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 112 GiB total, 52.487 GiB free. D: is CDROM () E: is FIXED (NTFS) - 149 GiB total, 44.199 GiB free. F: is FIXED (NTFS) - 298 GiB total, 76.504 GiB free. G: is CDROM () H: is Removable I: is Removable J: is Removable K: is Removable L: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP122: 10/9/2009 10:46:27 AM - System Checkpoint RP123: 10/10/2009 10:51:57 AM - System Checkpoint RP124: 10/11/2009 10:53:15 AM - System Checkpoint RP125: 10/11/2009 10:52:15 AM - System Checkpoint RP126: 10/12/2009 1:31:33 PM - System Checkpoint RP127: 10/13/2009 1:43:52 PM - System Checkpoint RP128: 10/14/2009 3:24:04 PM - System Checkpoint RP129: 10/15/2009 3:41:40 PM - System Checkpoint RP130: 10/16/2009 1:14:19 PM - Software Distribution Service 3.0 RP131: 10/18/2009 6:53:49 AM - System Checkpoint RP132: 10/19/2009 1:05:47 PM - System Checkpoint RP133: 10/19/2009 6:11:14 PM - Installed Masque IGT Slots Texas Tea RP134: 10/21/2009 1:30:20 PM - System Checkpoint RP135: 10/22/2009 9:31:23 AM - Software Distribution Service 3.0 RP136: 10/23/2009 11:32:26 AM - System Checkpoint RP137: 10/24/2009 12:48:17 PM - System Checkpoint RP138: 10/26/2009 1:27:46 PM - System Checkpoint RP139: 10/27/2009 1:32:06 PM - System Checkpoint RP140: 10/28/2009 3:34:28 PM - System Checkpoint RP141: 10/30/2009 5:42:59 PM - System Checkpoint RP142: 10/31/2009 2:14:53 PM - Installed Treasures of the Far East RP143: 10/31/2009 2:33:38 PM - Installed DirectX RP144: 10/31/2009 2:52:23 PM - Installed Treasures of the Far East RP145: 10/31/2009 3:03:10 PM - Before uninstall Treasures of the Far East RP146: 10/31/2009 3:03:33 PM - Removed Treasures of the Far East RP147: 11/1/2009 3:57:27 PM - Installed Treasures of the Far East RP148: 11/1/2009 5:34:52 PM - Installed DirectX RP149: 11/2/2009 6:19:46 PM - System Checkpoint RP150: 11/3/2009 6:37:26 PM - System Checkpoint RP151: 11/4/2009 3:22:05 PM - Software Distribution Service 3.0 RP152: 11/5/2009 8:35:22 PM - System Checkpoint RP153: 11/6/2009 9:26:37 PM - System Checkpoint RP154: 11/7/2009 9:44:11 PM - System Checkpoint RP155: 11/9/2009 9:06:39 AM - System Checkpoint RP156: 11/10/2009 1:36:14 PM - System Checkpoint RP157: 11/11/2009 11:54:23 AM - Software Distribution Service 3.0 RP158: 11/12/2009 1:01:15 PM - System Checkpoint RP159: 11/13/2009 6:01:03 PM - System Checkpoint RP160: 11/15/2009 11:06:01 AM - System Checkpoint RP161: 11/16/2009 11:11:41 AM - System Checkpoint RP162: 11/17/2009 4:16:41 PM - System Checkpoint RP163: 11/17/2009 6:40:54 PM - Removed Nero 7 Ultra Edition RP164: 11/17/2009 6:48:21 PM - Installed Nero 7 Ultra Edition RP165: 11/18/2009 6:21:33 PM - Installed Java(TM) 6 Update 17 RP166: 11/20/2009 5:45:37 PM - Before uninstall CyberDefender Registry Cleaner RP167: 11/21/2009 7:12:40 PM - System Checkpoint RP168: 11/22/2009 8:17:39 PM - System Checkpoint RP169: 11/25/2009 12:27:24 PM - Software Distribution Service 3.0 RP170: 11/25/2009 7:42:37 PM - Before uninstall Ad-Aware RP171: 11/27/2009 11:58:14 AM - System Checkpoint RP172: 11/28/2009 5:19:00 PM - System Checkpoint RP173: 11/30/2009 7:42:30 AM - System Checkpoint RP174: 12/1/2009 2:10:53 PM - System Checkpoint RP175: 12/1/2009 4:58:14 PM - Installed QuickTime RP176: 12/1/2009 7:57:57 PM - Installed TurboTax 2009 wrapper RP177: 12/1/2009 7:58:15 PM - Installed TurboTax 2009 WinPerReleaseEngine RP178: 12/1/2009 7:59:41 PM - Installed TurboTax 2009 WinPerFedFormset RP179: 12/1/2009 8:00:51 PM - Installed TurboTax 2009 WinPerTaxSupport RP180: 12/3/2009 12:42:29 PM - System Checkpoint RP181: 12/5/2009 11:04:33 AM - System Checkpoint RP182: 12/6/2009 11:31:06 AM - System Checkpoint RP183: 12/6/2009 6:10:14 PM - Before uninstall Malwarebytes' Anti-Malware RP184: 12/7/2009 6:33:17 PM - last good RP185: 12/9/2009 4:46:14 PM - System Checkpoint RP186: 12/10/2009 7:34:20 AM - Software Distribution Service 3.0 RP187: 12/11/2009 5:51:00 PM - System Checkpoint RP188: 12/13/2009 11:09:24 AM - System Checkpoint RP189: 12/20/2009 12:41:39 PM - System Checkpoint RP190: 12/23/2009 9:47:03 AM - System Checkpoint RP191: 12/24/2009 10:57:52 AM - System Checkpoint RP192: 12/25/2009 2:08:43 PM - System Checkpoint RP193: 12/27/2009 3:54:05 PM - System Checkpoint RP194: 12/29/2009 3:41:47 PM - System Checkpoint RP195: 12/30/2009 3:56:23 PM - System Checkpoint RP196: 12/31/2009 5:12:38 PM - System Checkpoint RP197: 1/1/2010 5:20:43 PM - Before uninstall Nero 7 Ultra Edition RP198: 1/1/2010 5:31:48 PM - Removed Nero 7 Ultra Edition RP199: 1/1/2010 5:49:43 PM - Installed Nero 9 Trial 2.0.0.1 RP200: 1/1/2010 8:13:04 PM - Installed Nero 9 Trial 2.0.0.1 RP201: 1/2/2010 6:44:56 AM - Before uninstall Nero 9 Trial RP202: 1/2/2010 6:46:59 AM - Removed Nero 9 Trial 2.0.0.1 RP203: 1/2/2010 11:42:27 AM - Installed Nero 8 RP204: 1/2/2010 12:58:02 PM - Before uninstall Nero 8 RP205: 1/2/2010 1:17:47 PM - Installed Nero 7 Ultra Edition RP206: 1/2/2010 2:05:58 PM - Before uninstall Nero 7 Ultra Edition RP207: 1/2/2010 2:16:55 PM - Removed Nero 7 Ultra Edition RP208: 1/2/2010 4:23:16 PM - Installed Nero 8 RP209: 1/2/2010 5:23:38 PM - Removed Nero 8 RP210: 1/2/2010 6:24:46 PM - Installed Nero 8. Available with Windows Installer version 1.2 and later. RP211: 1/2/2010 9:08:03 PM - Before uninstall Nero 8 RP212: 1/2/2010 9:19:21 PM - Removed Nero 8. Available with Windows Installer version 1.2 and later. RP213: 1/5/2010 3:04:11 PM - System Checkpoint RP214: 1/6/2010 5:05:04 PM - System Checkpoint ==== Installed Programs ====================== Ad-Aware Adobe Acrobat 7.0 Professional Adobe Acrobat 7.1.0 Professional Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX AnswerWorks 4.0 Runtime - English AnswerWorks 5.0 English Runtime Apple Application Support Apple Software Update ASUS Probe V2.23.03 Aussie Slots 4.05 Best of Slots II Blackbeard's Revenge BlindWrite 6.0.0.18 BonusManiaInstaller Canon CanoScan Toolbox 4.1 Canon Easy-WebPrint EX Canon Inkjet Printer/Scanner/Fax Extended Survey Program Canon iP4700 series Printer Driver Canon iP4700 series User Registration Canon PhotoRecord Canon PIXMA iP3000 Canon Utilities Easy-PhotoPrint Canon Utilities Easy-PhotoPrint EX Canon Utilities My Printer Canon Utilities Solution Menu CloneCD CloneDVD [removed] ConvertXtoDVD 2.2.3.258 Coupon Printer for Windows Critical Update for Windows Media Player 11 (KB959772) Data Lifeguard Tools DVDFab Platinum 3.0.4.0 Ghosthunter release Easy-WebPrint ERUNT 1.1j FlashFXP v3 FlashGet 1.9.0.1012 FlashGet(JetCar) Futuremark SystemInfo Ghost Town GoldRush Google Earth Pro Hijackthis 1.99.1 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) ImagXpress InfraRecorder IrfanView (remove only) Java(TM) 6 Update 17 Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) 6 Update 5 Java(TM) 6 Update 7 Java(TM) SE Runtime Environment 6 Update 1 Malwarebytes' Anti-Malware Masque IGT Slots Little Green Men Masque IGT Slots Texas Tea McAfee SecurityCenter Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money Shared Libraries Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Premium Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.5.5) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MysticForest Nero Burning ROM Help Nero ControlCenter Nero Vision neroxml NVIDIA Drivers OGA Notifier 2.0.0048.0 Panda ActiveScan Philips SPC 900NC PC Camera Philips VLounge QuickTime RealPlayer Realtek AC'97 Audio Reel Deal Slots 2nd Volume Reel Deal Slots Adventure Rhapsody Player Engine Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB973704) Security Update for Microsoft Office Excel 2007 (KB973593) Security Update for Microsoft Office Outlook 2007 (KB972363) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office Publisher 2007 (KB969693) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Spybot - Search & Destroy Super Internet TV v7.11 SuperAVConverter V8.6 Build 5330 Treasures of the Far East TurboTax 2008 TurboTax 2008 WinPerFedFormset TurboTax 2008 WinPerProgramHelp TurboTax 2008 WinPerReleaseEngine TurboTax 2008 WinPerTaxSupport TurboTax 2008 WinPerUserEducation TurboTax 2008 wrapper TurboTax 2009 TurboTax 2009 WinPerFedFormset TurboTax 2009 WinPerReleaseEngine TurboTax 2009 WinPerTaxSupport TurboTax 2009 wrapper Ulead PhotoImpact 11 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Outlook 2007 Junk Email Filter (kb976884) Update for Windows Internet Explorer 8 (KB971930) Update for Windows Internet Explorer 8 (KB976749) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Vegas 7007 Slots 1.0 Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WAV MP3 Converter 3.8 build 968 WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Live OneCare safety scanner Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver Yahoo! Install Manager Yahoo! Internet Mail Yahoo! Messenger Your Uninstaller! 2008 Version 6.0 ==== Event Viewer Messages From Past Week ======== 1/7/2010 2:12:54 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the mcmscsvc service. 1/3/2010 4:02:53 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Intuit Update Service service to connect. 1/3/2010 4:02:53 PM, error: Service Control Manager [7000] - The Intuit Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/3/2010 4:02:08 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory. 1/3/2010 4:02:08 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver. 1/2/2010 6:53:19 PM, error: Print [6161] - The document Microsoft Word - LAURAand JoHN MED HIST.docx owned by MAC failed to print on printer Canon iP4700 series. Data type: NT EMF 1.008. Size of the spool file in bytes: 196608. Number of bytes printed: 129904. Total number of pages in the document: 2. Number of pages printed: 0. Client machine: \\MAC-3V9DSFI0IPN. Win32 error code returned by the print processor: 13 (0xd). 1/2/2010 6:28:23 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Nero\Nero 9\Nero StartSmart\AudioPluginMgr\APM_MSAxp.dll. Reference error message: The operation completed successfully. . 1/2/2010 6:28:23 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Nero\Nero 9\Nero StartSmart\AudioPluginMgr\APM_MSAxp.dll" on line 1. ==== End Of File ===========================
DSS TEXT
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 16:29:38.56 on Thu 01/07/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1360 [GMT -5:00]
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\System32\drivers\PhiBtn.exe
C:\WINDOWS\System32\drivers\Tray900.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\taskmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
c:\PROGRA~1\mcafee\msc\mcshell.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\MAC\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: {179aa8c2-6412-46ee-968c-f56d802ad3b6} - fabarupa.dll
BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
BHO: {530AC1D1-3286-48EE-A15A-7C86C3545E70} - No File
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: {63ba7168-40a5-4f89-b9c6-567c1457c45c} - c:\windows\system32\pmnMCRlm.dll
BHO: {65015BBC-EF2F-4EDE-B856-6121A537B888} - No File
BHO: {6fde790a-08e6-4994-bd3b-1683b5d69a3b} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {936DB4DA-A5DF-455D-BC8C-4D4945DB1E11} - No File
BHO: {AB4D44F8-C59C-46A7-9CBC-2DF1B1078F06} - No File
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - c:\progra~1\flashfxp\IEFlash.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
BHO: {F2986EF1-3A55-4D56-868B-09D2AD28AAB1} - No File
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: FlashGet Bar: {e0e899ab-f487-11d5-8d29-0050ba6940e3} - c:\progra~1\flashget\fgiebar.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [CyberDefender Registry Cleaner] c:\program files\cyberdefender\registry cleaner\CDregclean.exe
mRun: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
mRun: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [PhiBtn] %SystemRoot%\System32\drivers\PhiBtn.exe
mRun: [Traymin900] %SystemRoot%\System32\drivers\Tray900.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [CyberDefender Registry Cleaner]
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} - hxxp://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195341152156
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - hxxp://acs.pandasoftware.com/activescan/as5free/asinst.cab
DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} - hxxp://www.worldwinner.com/games/v57/wof/wof.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
AppInit_DLLs: c:\windows\system32\ c:\windows\system32\ kapigagi.dll c:\windows\system32\lanadata.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: vezekuher - {d0c5665f-fca5-478a-9274-2d824a77bea9} - c:\windows\system32\lanadata.dll
STS: mujuzedij: {d0c5665f-fca5-478a-9274-2d824a77bea9} - c:\windows\system32\lanadata.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Notification Packages = scecli c:\windows\system32\diyobela.dll c:\windows\system32\yujukumi.dll MSINUD.dll zijigegu.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\mac\applic~1\mozilla\firefox\profiles\bmupye1q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol308.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - HiddenExtension: XUL Cache: {22C2A2F0-4DD5-483D-B275-0E91FABD7869} - c:\documents and settings\mac\local settings\application data\{22C2A2F0-4DD5-483D-B275-0E91FABD7869}
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-11-28 64288]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-4-6 214664]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-7-30 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2007-4-6 144704]
R3 camvid40;Philips SPC 900NC PC Camera;c:\windows\system32\drivers\camdrv41.sys [2008-4-9 1240576]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-4-6 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-4-6 35272]
S0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys –> c:\windows\system32\drivers\viasraid.sys [?]
S2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2009-9-29 13088]
S3 cpuz130;cpuz130;\??\c:\docume~1\mac\locals~1\temp\cpuz130\cpuz_x32.sys –> c:\docume~1\mac\locals~1\temp\cpuz130\cpuz_x32.sys [?]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-4-6 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-4-6 40552]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2007-4-6 606736]
=============== Created Last 30 ================
2010-01-06 15:31 –d—– C:\VundoFix Backups
2010-01-03 14:23 15,880 a——- c:\windows\system32\lsdelete.exe
2010-01-02 17:27 1,414,440 a——- c:\windows\system32\ShellManager310E2D762.dll
2010-01-02 17:27 773,120 a——- c:\windows\system32\NEROINSTAEC43759.DB
2010-01-02 16:06 –d—– c:\docume~1\mac\applic~1\InfraRecorder
2010-01-02 16:05 –d—– c:\program files\InfraRecorder
2010-01-01 20:37 4,767 a——- c:\windows\Irremote.ini
2010-01-01 17:50 –d—– c:\docume~1\alluse~1\applic~1\Nero
2010-01-01 17:31 3,077,416 a——- c:\windows\system32\AdvrCntr2D6E0B790.dll
2009-12-25 16:23 27,672 a——- c:\windows\system32\drivers\Entech.sys
2009-12-25 16:23 –d—– c:\windows\system32\Futuremark
2009-12-25 16:23 –d—– c:\program files\common files\Futuremark Shared
2009-12-10 10:49 7,680 a–sh— c:\windows\Thumbs.db
2009-12-10 10:47 –d-h— c:\docume~1\alluse~1\applic~1\CanonIJEPPEX
2009-12-09 18:28 –d-h— c:\docume~1\alluse~1\applic~1\CanonIJSolutionMenu
2009-12-09 18:26 –d-h— c:\docume~1\alluse~1\applic~1\CanonIJEGV
2009-12-09 18:18 –d-h— c:\docume~1\alluse~1\applic~1\CanonIJMyPrinter
2009-12-09 18:18 –d—– c:\docume~1\alluse~1\applic~1\CanonIJPLM
2009-12-09 17:48 –d—– c:\docume~1\mac\applic~1\Canon Easy-WebPrint EX
2009-12-09 17:44 272,384 a——- c:\windows\system32\CNMLMA1.DLL
2009-12-09 17:44 178,176 a——- c:\windows\system32\CNMIUA1.DLL
==================== Find3M ====================
2010-01-06 16:47 96,512 a——- c:\windows\system32\drivers\atapi.sys
2009-12-30 14:55 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-30 14:54 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-11-25 19:21 93,360 a——- c:\windows\system32\drivers\SBREDrv.sys
2009-11-03 11:33 6 a——- c:\windows\fonts\wfonts.key
2009-10-29 02:45 916,480 a——- c:\windows\system32\wininet.dll
2009-10-21 00:38 75,776 a——- c:\windows\system32\strmfilt.dll
2009-10-21 00:38 25,088 a——- c:\windows\system32\httpapi.dll
2009-10-13 05:30 270,336 a——- c:\windows\system32\oakley.dll
2009-10-12 08:38 149,504 a——- c:\windows\system32\rastls.dll
2009-10-12 08:38 79,872 a——- c:\windows\system32\raschap.dll
2009-10-11 04:17 411,368 a——- c:\windows\system32\deploytk.dll
2008-07-18 21:48 11,114 a——- c:\docume~1\alluse~1\applic~1\MainApp.dll
2007-07-06 20:26 47,360 a——- c:\docume~1\mac\applic~1\pcouffin.sys
2007-04-10 10:40 94,080 a——- c:\docume~1\mac\applic~1\ezplay.sys
2007-04-10 10:40 81,920 a——- c:\docume~1\mac\applic~1\ezpinst.exe
============= FINISH: 16:31:45.57 ===============
That was all I was able to accomplish.
GMER 1.0.15.15281 - http://www.gmer.net Rootkit quick scan 2010-01-09 17:27:14 Windows 5.1.2600 Service Pack 3 Running: gmer.exe; Driver: C:\DOCUME~1\MAC\LOCALS~1\Temp\fflyypow.sys —- System - GMER 1.0.15 —- Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xB2CEF78A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xB2CEF738] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xB2CEF74C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xB2CEF837] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xB2CEF863] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xB2CEF8D1] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xB2CEF8BB] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xB2CEF7CA] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xB2CEF8FD] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xB2CEF80D] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xB2CEF710] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xB2CEF724] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xB2CEF79E] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xB2CEF939] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xB2CEF8A5] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xB2CEF88F] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xB2CEF84D] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xB2CEF925] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xB2CEF911] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xB2CEF776] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xB2CEF762] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xB2CEF7F9] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xB2CEF8E7] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xB2CEF7E0] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xB2CEF7B4] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess —- Devices - GMER 1.0.15 —- AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) Device -> \Driver\atapi \Device\Harddisk0\DR0 8A615841 —- Files - GMER 1.0.15 —- File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification —- EOF - GMER 1.0.15 —-
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}
