[Resolved] Infected with Vundo.H and Hiloti

Tried McAfee rootkit cleaner, Symantec Vundo removal tool, and a few online scans. They all failed to even detect the problem. I would greatly appreciate your help. Thanks

Logs

Malwarebytes' Anti-Malware 1.44
Database version: 3556
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/13/2010 5:01:13 PM
mbam-log-2010-01-13 (17-01-09).txt

Scan type: Quick Scan
Objects scanned: 108954
Time elapsed: 8 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\nespnte.dll (Trojan.Hiloti) -> No action taken.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: nespnte.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\nespnte.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\laci8266.exe (Trojan.Hiloti) -> No action taken.




GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-14 10:25:28
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pwtoruog.sys


—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF74D787E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF74D7BFE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xAE60978A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xAE609738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xAE60974C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xAE609837]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xAE609863]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xAE6098D1]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xAE6098BB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xAE6097CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xAE6098FD]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xAE60980D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xAE609710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xAE609724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xAE60979E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xAE609939]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xAE6098A5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xAE60988F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xAE60984D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xAE609925]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xAE609911]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xAE609776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xAE609762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xAE6097F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xAE6098E7]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xAE6097E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xAE6097B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device -> \Driver\IdeChnDr \Device\Harddisk0\DR0 86974856

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\Log Analyzer buffer creator@optCounters ? ?H?H???H?H?H??? ???????A???????????H?????????????????????l?????????H????0???????G???F??????????H????1??????????????????H?Has??? ???????A???????????H?????????????????????l?????????H????0???????G???F??????????H????1??????????????????H?Her??? ???????A???????????H?????????????? ????????????????H????0???????G???F??????????H????1??????????????????????H?????????s?????????)?T?T?U?U?U?U?V?V?V?V??? ???????A???????????H?????????????? ????????????????H????1?????????????????? ???????A???????????H?????????????? ???????????Log Analyzer stat checker???????????????????TE???????H????0??????????????????H????1??????????????????H?H?????? ??H????1?????????????????????????? ???????H???????????H?H????????N????????????H???H?H?H??? ???????A???????????H?????????????????????m?????????H????0??????????????????????H????1??????????????????H?Hs ??? ???????A???????????H?????????? ????????????????????H????0??????????????? ??H????1??????????????????????????H?Htg??? ???????A???????????H?????????????????????m?????????H?????????????????????????
Reg HKLM\SYSTEM\ControlSet003\Services\Log Analyzer buffer creator@optCounters ? ?$???????????????????s?????????????*?3? ??? ??????????????????????hsd1.ca.comcast.net.????? ??????? ?????????????H????????????????????????????? ??????? ?????????????H?????????????????f???????????????????????????o??tl????????????????????8??#????????h?????Network Connections???????4??1???n?????e?i??????????????p???????????????????????? ????X??J???A???E??????????????????????System32\DRIVERS\rasacd.sys?nt???s????????????? ????SysSetup.Dll,StorageCoInstaller?SysSetup.Dll,CriticalDeviceCoInstaller??0,??SysSetup.Dll,CriticalDeviceCoInstaller??,0??? ?????????????????????H?????????????????f??? ??????? ?????????????H????????????(???????????????????????? ?3??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??????????37-0000F8753ED1}??SysSetup.Dll,StorageCoInstaller??0???&???????0???????????????????,??SysSetup.Dll,StorageCoInstaller?WmiProp.dll,WmiPropCoInstaller???????&??? ???7???????????????????,???&D;?? ??????????????????????????????????????????????? ??????????????\??\PCI#VEN_8086&DEV;_24C7&SUBSYS;_57701462&REV;_02#3&13c0b0c5&0&E;

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\IdeChnDr.sys suspicious modification

—- EOF - GMER 1.0.15 —-




DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 14:54:48.56 on Thu 01/14/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.555 [GMT -8:00]

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\SWSoft NSU lab\LogAnalyzer\StatisticsGatherer.exe
C:\Program Files\SWSoft NSU lab\LogAnalyzer\StatisticsAnalyzer.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
svchost.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dogpile.com/
uSearch Page = hxxp://srch-qus7.hpwis.com/
uSearch Bar = hxxp://srch-qus7.hpwis.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
uRun: [Multi Reminders] "c:\program files\multi reminders\reminder.exe" -c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [nwiz] nwiz.exe /installquiet /keeploaded
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Byahucow] rundll32.exe "c:\windows\adedahem.dll",Startup
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131_02-win.cab
DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-1_4_0_01-win.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5859/mcfscan.cab
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-9-22 64160]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-11-4 214664]
R2 Log Analyzer buffer creator;Log Analyzer buffer creator;c:\program files\swsoft nsu lab\loganalyzer\statisticsgatherer.exe -service –> c:\program files\swsoft nsu lab\loganalyzer\StatisticsGatherer.exe -service [?]
R2 Log Analyzer stat checker;Log Analyzer stat checker;c:\program files\swsoft nsu lab\loganalyzer\statisticsanalyzer.exe -service –> c:\program files\swsoft nsu lab\loganalyzer\StatisticsAnalyzer.exe -service [?]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2010-1-13 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2010-1-13 144704]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-1-13 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-1-13 35272]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-1-13 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-1-13 40552]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\pc-doc~1\diagno~1\pcdrdrv.sys –> c:\progra~1\pc-doc~1\diagno~1\PCDRDRV.sys [?]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2010-1-13 606736]

=============== Created Last 30 ================

2010-01-14 12:01 –d—– c:\windows\system32\wbem\Repository
2010-01-14 12:00 –d—– c:\docume~1\alluse~1\applic~1\RegCure
2010-01-13 15:38 –d—– c:\docume~1\owner\applic~1\Malwarebytes
2010-01-13 15:38 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-13 15:38 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-13 15:38 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-13 15:38 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-13 08:29 –d—– c:\program files\Trend Micro
2010-01-13 08:18 -cd—– c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-13 06:47 7,993 a——- c:\windows\system32\Config.MPF
2010-01-13 06:44 79,816 a——- c:\windows\system32\drivers\mfeavfk.sys
2010-01-13 06:44 40,552 a——- c:\windows\system32\drivers\mfesmfk.sys
2010-01-13 06:44 35,272 a——- c:\windows\system32\drivers\mfebopk.sys
2010-01-13 06:44 120,136 a——- c:\windows\system32\drivers\Mpfp.sys
2010-01-13 06:44 –d—– c:\program files\McAfee.com
2010-01-13 06:44 –d—– c:\program files\common files\McAfee
2010-01-13 06:43 –d—– c:\program files\McAfee
2010-01-13 06:41 34,248 a——- c:\windows\system32\drivers\mferkdk.sys
2010-01-13 06:22 –d—– c:\program files\Eusing Free Registry Cleaner
2010-01-12 23:05 –d—– c:\windows\McAfee.com
2010-01-12 11:10 120 a——- c:\windows\Bqaqaruyuqidefay.dat
2010-01-12 11:10 0 a——- c:\windows\Dbucakob.bin
2010-01-06 22:21 87,552 a——- c:\windows\system32\cpwmon2k.dll
2010-01-06 22:21 –d—– c:\program files\Acro Software
2010-01-06 22:20 –d—– c:\program files\GPLGS

==================== Find3M ====================

2010-01-13 18:30 101,431 a——- c:\windows\system32\drivers\IdeChnDr.sys
2009-12-04 21:20 249,856 ——– c:\windows\Setup1.exe
2009-12-04 21:19 73,216 a——- c:\windows\ST6UNST.EXE
2009-11-21 07:51 471,552 a——- c:\windows\apppatch\aclayers.dll
2009-11-04 22:51 24,192 a——- c:\documents and settings\owner\usbsermptxp.sys
2009-11-04 22:51 22,768 a——- c:\documents and settings\owner\usbsermpt.sys
2009-10-28 23:46 832,512 a——- c:\windows\system32\wininet.dll
2009-10-28 23:46 78,336 a——- c:\windows\system32\ieencode.dll
2009-10-28 23:46 17,408 a——- c:\windows\system32\corpol.dll
2009-10-24 22:02 153,768 a——- c:\windows\hphins26.dat
2009-10-20 21:38 75,776 a——- c:\windows\system32\strmfilt.dll
2009-10-20 21:38 25,088 a——- c:\windows\system32\httpapi.dll

============= FINISH: 14:56:02.75 ===============





UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 8/23/2009 11:14:27 PM
System Uptime: 1/14/2010 2:38:32 PM (0 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6577
Processor: Intel® Pentium® 4 CPU 2.53GHz | Socket 478 | 2532/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 111 GiB total, 92.488 GiB free.
D: is FIXED (NTFS) - 32 GiB total, 11.585 GiB free.
E: is FIXED (FAT32) - 4 GiB total, 0.737 GiB free.
F: is CDROM ()
G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 1/14/2010 6:40:20 AM - System Checkpoint
RP2: 1/14/2010 6:40:29 AM - RegCure Backup
RP3: 1/14/2010 9:53:55 AM - Automatic Restore Point
RP4: 1/14/2010 12:00:48 PM - Restore Operation

==== Installed Programs ======================


Acrobat.com
Ad-Aware
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9.2
Avanquest update
Coloreal
Corel Uninstaller
CrystalDiskMark 2.2.0n
CutePDF Writer 2.8
Date Cracker 2000
DJ_SF_03_D1500_Software_Min
ERUNT 1.1j
Eusing Free Registry Cleaner
HD Tune 2.55
HDD Health v3.3 Beta
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
HP Deskjet D1500 Printer Driver 10.0 Rel .3
IE Privacy Keeper
Intel Application Accelerator
Intel® Extreme Graphics Driver
InterVideo WinDVD Player
IZArc 4.0 beta 1
Java 2 Runtime Environment Standard Edition v1.3.1_02
Java 2 Runtime Environment, SE v1.4.0_01
Java Web Start
Java™ 6 Update 17
KBD
LimeWire 5.2.13
LogAnalyzer
Malwarebytes' Anti-Malware
McAfee SecurityCenter
McAfee Virtual Technician
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft IntelliPoint 7.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Works 7.0
Motorola Phone Tools
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Multi Reminders 2.74
Nero 8
neroxml
NirSoft VideoCacheView
NVIDIA Windows 2000/XP Display Drivers
PC-Doctor for Windows
pdf-to-image1
PlayFLV
PS2
RealOne Player
REALTEK GbE & FE Ethernet PCI NIC Driver
RecordNow
RecordNow Update Manager
RegCure
S3Display
S3Gamma2
S3Info2
S3Overlay
SeaTools for Windows
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
ShowBiz
Simple Installer - Multilanguage Version
System Requirements Lab
Toolbox
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VCRedistSetup
Viewpoint Media Player (Remove Only)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
WildTangent Channel Manager
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

1/14/2010 11:23:36 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNASvc with arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}
1/14/2010 11:23:18 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk MPFP MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
1/14/2010 11:23:18 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/14/2010 11:23:18 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/14/2010 11:23:18 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
1/14/2010 10:40:35 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
1/14/2010 10:40:23 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
1/14/2010 10:33:51 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the McAfee Proxy Service service to connect.
1/14/2010 10:33:51 AM, error: Service Control Manager [7000] - The McAfee Proxy Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/14/2010 10:32:35 AM, error: Service Control Manager [7034] - The Log Analyzer buffer creator service terminated unexpectedly. It has done this 1 time(s).
1/14/2010 10:32:30 AM, error: Service Control Manager [7031] - The McAfee Proxy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/13/2010 9:02:42 AM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
1/13/2010 9:02:42 AM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
1/13/2010 6:36:59 AM, error: Service Control Manager [7000] - The McAfee SystemGuards service failed to start due to the following error: The system cannot find the path specified.
1/13/2010 5:37:39 AM, error: PSched [14103] - QoS [Adapter {D4B7092B-8AEB-4C15-A8B4-07E9B5441379}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
1/12/2010 8:44:10 AM, error: IdeChnDr [9] - The device, \Device\Ide\IdeDeviceP0T0L0, did not respond within the timeout period.
1/12/2010 8:43:46 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.
1/12/2010 11:01:15 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
1/12/2010 11:01:15 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/12/2010 11:00:42 PM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
1/12/2010 10:57:29 PM, error: Service Control Manager [7005] - The LoadUserProfile call failed with the following error: The process cannot access the file because it is being used by another process.
1/10/2010 12:49:25 AM, error: Service Control Manager [7031] - The McAfee Real-time Scanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

==== End Of File ===========================

Download TDSSKiller.zip from Kaspersky from here and save it to your Desktop - this is important.

• You will then need to extract the file(s) from the zipped folder.
  
  
• To do this: Right-click on the zipped folder and from the menu that appears, click on Extract All…
  In the Extraction Wizard window that opens, click on Next> and in the next window that appears, click on Next> again.
  In the final window, click on Finish
  
  
• Go to Start > Run, copy and paste the following into the text box and hit OK:
  
  "%userprofile%\desktop\tdsskiller\TDSSKiller.exe" -l report.txt
  
  
• A Command Window will open and the tool will scan and produce a log called report.txt that can be found in the TDSSKiller folder that you unzipped.

Please post the contents of this in your next reply.

System froze up on reboot twice, then booted and ran for a couple of minutes before a blue screen error: MFEHIDK.SYS DRIVER_IRQL_NOT_LESS_OR_EQUAL It did reboot ok and I was able to run the scans that you requested. The system is running slow and pauses frequently when trying to save to disk. Also pauses while typing causing missed letters in text. McAfee takes unusually long to load and the virus scan was dissabled at first. Thanks again for your help….here are the logs you requested Malwarebytes' Anti-Malware 1.44 Database version: 3585 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 1/17/2010 3:45:56 PM mbam-log-2010-01-17 (15-45-56).txt Scan type: Full Scan (C:\|E:\|) Objects scanned: 176663 Time elapsed: 56 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 8/23/2009 11:14:27 PM System Uptime: 1/17/2010 3:08:03 AM (0 hours ago) Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6577 Processor: Intel® Pentium® 4 CPU 2.53GHz | Socket 478 | 2532/133mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 111 GiB total, 91.502 GiB free. E: is FIXED (FAT32) - 4 GiB total, 0.736 GiB free. F: is CDROM () G: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 1/14/2010 6:40:20 AM - System Checkpoint RP2: 1/14/2010 6:40:29 AM - RegCure Backup RP3: 1/14/2010 9:53:55 AM - Automatic Restore Point RP4: 1/14/2010 12:00:48 PM - Restore Operation RP5: 1/15/2010 8:17:42 PM - System Checkpoint ==== Installed Programs ====================== Acrobat.com Ad-Aware Adobe Acrobat 5.0 Adobe AIR Adobe Flash Player 10 Plugin Adobe Reader 9.3 Avanquest update Coloreal Corel Uninstaller CrystalDiskMark 2.2.0n CutePDF Writer 2.8 Date Cracker 2000 DJ_SF_03_D1500_Software_Min ERUNT 1.1j Eusing Free Registry Cleaner HD Tune 2.55 HDD Health v3.3 Beta HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) HP Deskjet D1500 Printer Driver 10.0 Rel .3 IE Privacy Keeper ieSpell Intel Application Accelerator Intel® Extreme Graphics Driver InterVideo WinDVD Player IZArc 4.0 beta 1 Java 2 Runtime Environment Standard Edition v1.3.1_02 Java 2 Runtime Environment, SE v1.4.0_01 Java Web Start Java™ 6 Update 17 KBD LimeWire 5.2.13 LogAnalyzer Malwarebytes' Anti-Malware McAfee SecurityCenter McAfee Virtual Technician Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.0 Hotfix (KB928367) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft IntelliPoint 7.0 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office 2000 Premium Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Works 7.0 Motorola Phone Tools MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Multi Reminders 2.74 Nero 8 neroxml NirSoft VideoCacheView NVIDIA Windows 2000/XP Display Drivers PC-Doctor for Windows pdf-to-image1 PlayFLV PS2 RealOne Player REALTEK GbE & FE Ethernet PCI NIC Driver RecordNow RecordNow Update Manager RegCure S3Display S3Gamma2 S3Info2 S3Overlay SeaTools for Windows Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371-v2) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) ShowBiz Simple Installer - Multilanguage Version System Requirements Lab Toolbox Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Windows (KB971513) Update for Windows Internet Explorer 7 (KB976749) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VCRedistSetup Viewpoint Media Player (Remove Only) Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebFldrs XP WildTangent Channel Manager Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 3 ==== Event Viewer Messages From Past Week ======== 1/16/2010 4:18:30 AM, error: Service Control Manager [7023] - The Server service terminated with the following error: The specified driver is invalid. 1/16/2010 4:18:30 AM, error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The specified driver is invalid. 1/15/2010 10:14:54 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: agp440 atapi IntelIde nv_agp viaagp1 1/15/2010 10:14:29 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume. 1/15/2010 10:14:09 AM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{D4B7092B-8AEB-4C15-A8B4-07E9B5441379} because another computer on the network has the same name. The server could not start. 1/15/2010 10:00:01 PM, error: Service Control Manager [7034] - The Terminal Services service terminated unexpectedly. It has done this 1 time(s). 1/15/2010 10:00:01 PM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine. 1/15/2010 1:21:33 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ACER-399B23EC8F that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D4B7092B-8AE. The master browser is stopping or an election is being forced. 1/14/2010 9:58:59 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 1/14/2010 11:23:36 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNASvc with arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A} 1/14/2010 11:23:18 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk MPFP MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip 1/14/2010 11:23:18 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/14/2010 11:23:18 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/14/2010 11:23:18 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning. 1/14/2010 10:40:35 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 1/14/2010 10:40:23 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 1/14/2010 10:33:51 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the McAfee Proxy Service service to connect. 1/14/2010 10:33:51 AM, error: Service Control Manager [7000] - The McAfee Proxy Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/14/2010 10:32:35 AM, error: Service Control Manager [7034] - The Log Analyzer buffer creator service terminated unexpectedly. It has done this 1 time(s). 1/14/2010 10:32:30 AM, error: Service Control Manager [7031] - The McAfee Proxy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 1/13/2010 9:02:42 AM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory. 1/13/2010 9:02:42 AM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver. 1/13/2010 6:36:59 AM, error: Service Control Manager [7000] - The McAfee SystemGuards service failed to start due to the following error: The system cannot find the path specified. 1/13/2010 5:37:39 AM, error: PSched [14103] - QoS [Adapter {D4B7092B-8AEB-4C15-A8B4-07E9B5441379}]: The netcard driver failed the query for OID_GEN_LINK_SPEED. 1/12/2010 8:43:46 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service. 1/10/2010 12:49:25 AM, error: Service Control Manager [7031] - The McAfee Real-time Scanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 1/10/2010 1:25:54 PM, error: Service Control Manager [7005] - The LoadUserProfile call failed with the following error: The process cannot access the file because it is being used by another process. 1/10/2010 1:25:52 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect. 1/10/2010 1:25:52 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/10/2010 1:25:12 PM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 1/10/2010 1:24:35 PM, error: IdeChnDr [9] - The device, \Device\Ide\IdeDeviceP0T0L0, did not respond within the timeout period. ==== End Of File =========================== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 3:37:04.93 on Sun 01/17/2010 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.521 [GMT -8:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\WINDOWS\system32\igfxtray.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\SWSoft NSU lab\LogAnalyzer\StatisticsGatherer.exe C:\Program Files\SWSoft NSU lab\LogAnalyzer\StatisticsAnalyzer.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\System32\svchost.exe -k imgsvc svchost.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.dogpile.com/ uSearch Page = hxxp://srch-qus7.hpwis.com/ uSearch Bar = hxxp://srch-qus7.hpwis.com/ mSearch Bar = hxxp://srch-qus7.hpwis.com/ BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook uRun: [Multi Reminders] "c:\program files\multi reminders\reminder.exe" -c uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [nwiz] nwiz.exe /installquiet /keeploaded mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [PS2] c:\windows\system32\ps2.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Byahucow] rundll32.exe "c:\windows\adedahem.dll",Startup mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM IE: Lookup on Merriam Webster - file://c:\program files\iespell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://c:\program files\iespell\wikipedia.HTM IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: internet Trusted Zone: mcafee.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131_02-win.cab DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-1_4_0_01-win.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5859/mcfscan.cab Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-9-22 64160] R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-11-4 214664] R2 Log Analyzer buffer creator;Log Analyzer buffer creator;c:\program files\swsoft nsu lab\loganalyzer\statisticsgatherer.exe -service –> c:\program files\swsoft nsu lab\loganalyzer\StatisticsGatherer.exe -service [?] R2 Log Analyzer stat checker;Log Analyzer stat checker;c:\program files\swsoft nsu lab\loganalyzer\statisticsanalyzer.exe -service –> c:\program files\swsoft nsu lab\loganalyzer\StatisticsAnalyzer.exe -service [?] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2010-1-13 359952] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2010-1-13 144704] R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2010-1-13 606736] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-1-13 79816] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-1-13 35272] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-1-13 40552] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-1-13 34248] S3 msCMTSrvc;Content Monitoring Tool; [x] S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\pc-doc~1\diagno~1\pcdrdrv.sys –> c:\progra~1\pc-doc~1\diagno~1\PCDRDRV.sys [?] =============== Created Last 30 ================ 2010-01-15 22:25 –d—– c:\docume~1\owner\applic~1\ieSpell 2010-01-15 22:25 –d—– c:\program files\ieSpell 2010-01-15 17:09 1,693,696 a——- c:\windows\system32\ltclr13n.dll 2010-01-15 17:09 453,120 a——- c:\windows\system32\ltkrn13n.dll 2010-01-15 17:09 445,440 a——- c:\windows\system32\ltimg13n.dll 2010-01-15 17:09 388,608 a——- c:\windows\system32\lfcmp13n.dll 2010-01-15 17:09 265,216 a——- c:\windows\system32\ltdis13n.dll 2010-01-15 17:09 246,272 a——- c:\windows\system32\lfj2k13n.dll 2010-01-15 17:09 206,848 a——- c:\windows\system32\ltefx13n.dll 2010-01-15 17:09 189,976 a——- c:\windows\system32\mfimgvwr.ocx 2010-01-15 17:09 154,112 a——- c:\windows\system32\ltfil13n.dll 2010-01-15 17:09 142,848 a——- c:\windows\system32\lftif13n.dll 2010-01-15 17:09 90,112 a——- c:\windows\system32\lfjbg13n.dll 2010-01-15 17:09 73,728 a——- c:\windows\system32\lffax13n.dll 2010-01-15 17:09 –d—– c:\program files\MFInstall 2010-01-14 12:01 –d—– c:\windows\system32\wbem\Repository 2010-01-14 12:00 –d—– c:\docume~1\alluse~1\applic~1\RegCure 2010-01-13 15:38 –d—– c:\docume~1\owner\applic~1\Malwarebytes 2010-01-13 15:38 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-13 15:38 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-13 15:38 19,160 a——- c:\windows\system32\drivers\mbam.sys 2010-01-13 15:38 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-01-13 08:29 –d—– c:\program files\Trend Micro 2010-01-13 08:18 -cd—– c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9} 2010-01-13 06:47 8,885 a——- c:\windows\system32\Config.MPF 2010-01-13 06:44 79,816 a——- c:\windows\system32\drivers\mfeavfk.sys 2010-01-13 06:44 40,552 a——- c:\windows\system32\drivers\mfesmfk.sys 2010-01-13 06:44 35,272 a——- c:\windows\system32\drivers\mfebopk.sys 2010-01-13 06:44 120,136 a——- c:\windows\system32\drivers\Mpfp.sys 2010-01-13 06:44 –d—– c:\program files\McAfee.com 2010-01-13 06:44 –d—– c:\program files\common files\McAfee 2010-01-13 06:43 –d—– c:\program files\McAfee 2010-01-13 06:41 34,248 a——- c:\windows\system32\drivers\mferkdk.sys 2010-01-13 06:22 –d—– c:\program files\Eusing Free Registry Cleaner 2010-01-12 23:05 –d—– c:\windows\McAfee.com 2010-01-12 11:10 120 a——- c:\windows\Bqaqaruyuqidefay.dat 2010-01-12 11:10 0 a——- c:\windows\Dbucakob.bin 2010-01-06 22:21 87,552 a——- c:\windows\system32\cpwmon2k.dll 2010-01-06 22:21 –d—– c:\program files\Acro Software 2010-01-06 22:20 –d—– c:\program files\GPLGS ==================== Find3M ==================== 2010-01-15 22:13 101,431 a——- c:\windows\system32\drivers\IdeChnDr.sys 2009-12-04 21:20 249,856 ——– c:\windows\Setup1.exe 2009-12-04 21:19 73,216 a——- c:\windows\ST6UNST.EXE 2009-11-21 07:51 471,552 a——- c:\windows\apppatch\aclayers.dll 2009-11-04 22:51 24,192 a——- c:\documents and settings\owner\usbsermptxp.sys 2009-11-04 22:51 22,768 a——- c:\documents and settings\owner\usbsermpt.sys 2009-10-28 23:46 832,512 a——- c:\windows\system32\wininet.dll 2009-10-28 23:46 78,336 a——- c:\windows\system32\ieencode.dll 2009-10-28 23:46 17,408 a——- c:\windows\system32\corpol.dll 2009-10-24 22:02 153,768 a——- c:\windows\hphins26.dat 2009-10-20 21:38 75,776 a——- c:\windows\system32\strmfilt.dll 2009-10-20 21:38 25,088 a——- c:\windows\system32\httpapi.dll 2009-10-17 00:39 0 a–sh— c:\windows\sminst\HPCD.sys ============= FINISH: 3:37:49.00 ===============

I had some trouble with Combofix….I downloaded it to my desktop, followed all instructions, but when I ran the program it would say that some installation files were currupted….try downloading again. After the fourth time downloading it ran fine. System seems better now. Hard drive access is back to normal instead of short bursts with pauses in between. McAfee loads without problems. No popups. Here are the logs that you requested… thanks again….


ComboFix 10-01-18.02 - Owner 01/18/2010 19:11:13.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.694 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Local Settings\Application Data\{A5F508B9-6691-4D5E-A1A1-9A3FE39D52C1}
c:\documents and settings\Owner\Local Settings\Application Data\{A5F508B9-6691-4D5E-A1A1-9A3FE39D52C1}\chrome.manifest
c:\documents and settings\Owner\Local Settings\Application Data\{A5F508B9-6691-4D5E-A1A1-9A3FE39D52C1}\chrome\content\_cfg.js
c:\documents and settings\Owner\Local Settings\Application Data\{A5F508B9-6691-4D5E-A1A1-9A3FE39D52C1}\chrome\content\overlay.xul
c:\documents and settings\Owner\Local Settings\Application Data\{A5F508B9-6691-4D5E-A1A1-9A3FE39D52C1}\install.rdf
c:\documents and settings\Owner\My Documents\bak2.reg
c:\windows\adedahem.dll
c:\windows\system32\ps2.bat
E:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-18 06:37 . 2010-01-18 08:37 ——– d—–w- c:\program files\Panda Security
2010-01-16 06:25 . 2010-01-16 06:25 ——– d—–w- c:\documents and settings\Owner\Application Data\ieSpell
2010-01-16 06:25 . 2010-01-16 06:25 ——– d—–w- c:\program files\ieSpell
2010-01-16 05:59 . 2010-01-16 05:59 ——– d—–w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe
2010-01-16 01:09 . 2006-10-06 17:35 90112 —-a-w- c:\windows\system32\lfjbg13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 73728 —-a-w- c:\windows\system32\lffax13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 453120 —-a-w- c:\windows\system32\ltkrn13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 445440 —-a-w- c:\windows\system32\ltimg13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 388608 —-a-w- c:\windows\system32\lfcmp13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 265216 —-a-w- c:\windows\system32\ltdis13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 246272 —-a-w- c:\windows\system32\lfj2k13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 206848 —-a-w- c:\windows\system32\ltefx13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 1693696 —-a-w- c:\windows\system32\ltclr13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 154112 —-a-w- c:\windows\system32\ltfil13n.dll
2010-01-16 01:09 . 2006-10-06 17:35 142848 —-a-w- c:\windows\system32\lftif13n.dll
2010-01-16 01:09 . 2010-01-16 01:09 ——– d—–w- c:\program files\MFInstall
2010-01-14 20:01 . 2010-01-14 20:01 ——– d—–w- c:\windows\system32\wbem\Repository
2010-01-14 20:00 . 2010-01-14 20:00 ——– d—–w- c:\program files\RegCure
2010-01-14 20:00 . 2010-01-14 20:00 ——– d—–w- c:\documents and settings\All Users\Application Data\RegCure
2010-01-13 23:38 . 2010-01-13 23:38 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-13 23:38 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-13 23:38 . 2010-01-13 23:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-13 23:38 . 2010-01-18 23:26 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 23:38 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-13 23:35 . 2010-01-13 23:35 ——– d—–w- c:\program files\ERUNT
2010-01-13 16:29 . 2010-01-13 16:29 ——– d—–w- c:\program files\Trend Micro
2010-01-13 16:18 . 2010-01-13 16:18 ——– dc—-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-13 14:46 . 2010-01-13 14:46 128 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\fusioncache.dat
2010-01-13 14:44 . 2009-11-05 00:54 79816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-01-13 14:44 . 2009-11-05 00:54 40552 —-a-w- c:\windows\system32\drivers\mfesmfk.sys
2010-01-13 14:44 . 2009-11-05 00:54 35272 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-01-13 14:44 . 2009-07-16 20:32 120136 —-a-w- c:\windows\system32\drivers\Mpfp.sys
2010-01-13 14:44 . 2010-01-13 14:44 ——– d—–w- c:\program files\Common Files\McAfee
2010-01-13 14:44 . 2010-01-13 14:44 ——– d—–w- c:\program files\McAfee.com
2010-01-13 14:43 . 2010-01-15 08:05 ——– d—–w- c:\program files\McAfee
2010-01-13 14:41 . 2009-11-05 00:53 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys
2010-01-13 14:40 . 2010-01-13 17:45 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-01-13 14:22 . 2010-01-13 14:22 ——– d—–w- c:\program files\Eusing Free Registry Cleaner
2010-01-13 07:05 . 2010-01-13 07:05 ——– d—–w- c:\windows\McAfee.com
2010-01-12 19:10 . 2010-01-19 02:45 120 —-a-w- c:\windows\Bqaqaruyuqidefay.dat
2010-01-12 19:10 . 2010-01-18 08:32 0 —-a-w- c:\windows\Dbucakob.bin
2010-01-07 06:22 . 2010-01-15 16:50 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\CutePDF Writer
2010-01-07 06:21 . 2009-11-05 16:39 87552 —-a-w- c:\windows\system32\cpwmon2k.dll
2010-01-07 06:21 . 2010-01-07 06:21 ——– d—–w- c:\program files\Acro Software
2010-01-07 06:20 . 2010-01-07 06:20 ——– d—–w- c:\program files\GPLGS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 09:42 . 2009-10-04 05:01 ——– d—–w- c:\program files\IZArc
2010-01-18 08:38 . 2009-11-05 05:56 ——– d—–w- c:\documents and settings\All Users\Application Data\BVRP Software
2010-01-18 08:38 . 2003-01-24 14:51 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-18 08:37 . 2003-01-24 15:11 ——– d—–w- c:\program files\WildTangent
2010-01-18 05:42 . 2009-10-25 08:41 441744 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-16 10:32 . 2009-09-08 11:12 ——– d—–w- c:\program files\Multi Reminders
2010-01-16 09:12 . 2003-01-24 15:16 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-16 06:13 . 2009-09-10 21:08 101431 —-a-w- c:\windows\system32\drivers\IdeChnDr.sys
2010-01-12 18:56 . 2009-09-22 22:53 ——– d—–w- c:\documents and settings\Owner\Application Data\LimeWire
2010-01-09 07:19 . 2009-09-18 12:47 ——– d—–w- c:\program files\Music Oasis
2009-12-22 14:11 . 2009-09-22 14:13 3695616 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-12-22 14:11 . 2009-09-22 14:13 2353992 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-12-05 05:21 . 2009-12-05 05:21 ——– d—–w- c:\program files\Date Cracker 2000
2009-12-05 05:20 . 2009-12-05 05:20 249856 ——w- c:\windows\Setup1.exe
2009-12-05 05:19 . 2009-12-05 05:19 73216 —-a-w- c:\windows\ST6UNST.EXE
2009-12-01 01:52 . 2009-09-08 07:00 51472 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-01 01:52 . 2009-12-01 01:52 ——– d—–w- c:\program files\PDF3
2009-11-26 10:23 . 2009-11-26 10:23 ——– d—–w- c:\program files\HDD Health
2009-11-21 15:51 . 2009-03-22 17:11 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-05 06:51 . 2009-11-05 05:32 24192 —-a-w- c:\documents and settings\Owner\usbsermptxp.sys
2009-11-05 06:51 . 2009-11-05 05:32 22768 —-a-w- c:\windows\system32\drivers\usbsermpt.sys
2009-11-05 06:51 . 2009-11-05 05:32 22768 —-a-w- c:\documents and settings\Owner\usbsermpt.sys
2009-11-05 00:54 . 2009-11-05 00:54 214664 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2009-11-04 03:40 . 2009-11-04 03:40 152576 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-10-29 07:46 . 2009-03-22 17:11 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2009-09-08 08:15 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2009-03-22 17:11 17408 —-a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-17 08:39 . 2009-10-17 08:39 0 –sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2002-12-12 798789]
"Multi Reminders"="c:\program files\Multi Reminders\reminder.exe" [2009-07-20 228864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2001-07-07 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"nwiz"="nwiz.exe" [2002-12-12 319488]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-22 155648]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-06-01 1468296]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"PS2"="c:\windows\system32\ps2.exe" [2002-08-01 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2003-01-24 151597]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/22/2009 6:10 AM 64160]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 6:49 AM 1028432]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys –> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-01-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:13]

2010-01-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-01-13 20:22]

2010-01-13 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-01-13 20:22]

2009-09-11 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2009-06-01 21:51]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.dogpile.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {94E5218F-9737-4FC2-8457-567B1FF23DC0} - hxxp://utilities.pcpitstop.com/DiskMD3/DiskMD3Ctrl.dll
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
HKLM-Run-Byahucow - c:\windows\adedahem.dll
HKLM-Run-PC Pitstop Diskmd3 Reminder - c:\program files\PCPitstop\DiskMD3\Reminder-Diskmd3.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 19:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-01-18 19:17:25
ComboFix-quarantined-files.txt 2010-01-19 03:17

Pre-Run: 105,371,377,664 bytes free
Post-Run: 105,335,619,584 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 02AF9C0D393D61BABB320AFAD8312994




DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 6:51:11.90 on Tue 01/19/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.577 [GMT -8:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
svchost.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Documents and Settings\Owner\Desktop\Forum Help\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dogpile.com/
mSearch Bar = hxxp://srch-qus7.hpwis.com/
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
uRun: [Multi Reminders] "c:\program files\multi reminders\reminder.exe" -c
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [nwiz] nwiz.exe /installquiet /keeploaded
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [McAfee Backup] "c:\program files\mcafee\mbk\McAfeeDataBackup.exe"
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {94E5218F-9737-4FC2-8457-567B1FF23DC0} - hxxp://utilities.pcpitstop.com/DiskMD3/DiskMD3Ctrl.dll
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131_02-win.cab
DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-1_4_0_01-win.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5859/mcfscan.cab
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-9-22 64160]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-11-4 214664]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2010-1-13 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2010-1-13 144704]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2010-1-13 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-1-13 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-1-13 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-1-13 40552]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-1-13 34248]
S3 msCMTSrvc;Content Monitoring Tool; [x]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\pc-doc~1\diagno~1\pcdrdrv.sys –> c:\progra~1\pc-doc~1\diagno~1\PCDRDRV.sys [?]

=============== Created Last 30 ================

2010-01-18 19:10 a-dshr– C:\cmdcons
2010-01-18 19:09 261,632 a——- c:\windows\PEV.exe
2010-01-18 19:09 161,792 a——- c:\windows\SWREG.exe
2010-01-18 19:09 98,816 a——- c:\windows\sed.exe
2010-01-18 19:09 77,312 a——- c:\windows\MBR.exe
2010-01-17 22:37 –d—– c:\program files\Panda Security
2010-01-15 22:25 –d—– c:\docume~1\owner\applic~1\ieSpell
2010-01-15 22:25 –d—– c:\program files\ieSpell
2010-01-15 17:09 1,693,696 a——- c:\windows\system32\ltclr13n.dll
2010-01-15 17:09 453,120 a——- c:\windows\system32\ltkrn13n.dll
2010-01-15 17:09 445,440 a——- c:\windows\system32\ltimg13n.dll
2010-01-15 17:09 388,608 a——- c:\windows\system32\lfcmp13n.dll
2010-01-15 17:09 265,216 a——- c:\windows\system32\ltdis13n.dll
2010-01-15 17:09 246,272 a——- c:\windows\system32\lfj2k13n.dll
2010-01-15 17:09 206,848 a——- c:\windows\system32\ltefx13n.dll
2010-01-15 17:09 189,976 a——- c:\windows\system32\mfimgvwr.ocx
2010-01-15 17:09 154,112 a——- c:\windows\system32\ltfil13n.dll
2010-01-15 17:09 142,848 a——- c:\windows\system32\lftif13n.dll
2010-01-15 17:09 90,112 a——- c:\windows\system32\lfjbg13n.dll
2010-01-15 17:09 73,728 a——- c:\windows\system32\lffax13n.dll
2010-01-15 17:09 –d—– c:\program files\MFInstall
2010-01-14 12:01 –d—– c:\windows\system32\wbem\Repository
2010-01-14 12:00 –d—– c:\docume~1\alluse~1\applic~1\RegCure
2010-01-13 15:38 –d—– c:\docume~1\owner\applic~1\Malwarebytes
2010-01-13 15:38 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-13 15:38 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-13 15:38 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-13 15:38 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-13 08:29 –d—– c:\program files\Trend Micro
2010-01-13 08:18 -cd—– c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-13 06:47 9,859 a——- c:\windows\system32\Config.MPF
2010-01-13 06:44 79,816 a——- c:\windows\system32\drivers\mfeavfk.sys
2010-01-13 06:44 40,552 a——- c:\windows\system32\drivers\mfesmfk.sys
2010-01-13 06:44 35,272 a——- c:\windows\system32\drivers\mfebopk.sys
2010-01-13 06:44 120,136 a——- c:\windows\system32\drivers\Mpfp.sys
2010-01-13 06:44 –d—– c:\program files\McAfee.com
2010-01-13 06:44 –d—– c:\program files\common files\McAfee
2010-01-13 06:43 –d—– c:\program files\McAfee
2010-01-13 06:41 34,248 a——- c:\windows\system32\drivers\mferkdk.sys
2010-01-13 06:22 –d—– c:\program files\Eusing Free Registry Cleaner
2010-01-12 23:05 –d—– c:\windows\McAfee.com
2010-01-12 11:10 120 a——- c:\windows\Bqaqaruyuqidefay.dat
2010-01-12 11:10 0 a——- c:\windows\Dbucakob.bin
2010-01-06 22:21 87,552 a——- c:\windows\system32\cpwmon2k.dll
2010-01-06 22:21 –d—– c:\program files\Acro Software
2010-01-06 22:20 –d—– c:\program files\GPLGS

==================== Find3M ====================

2010-01-15 22:13 101,431 a——- c:\windows\system32\drivers\IdeChnDr.sys
2009-12-04 21:20 249,856 ——– c:\windows\Setup1.exe
2009-12-04 21:19 73,216 a——- c:\windows\ST6UNST.EXE
2009-11-21 07:51 471,552 a——- c:\windows\apppatch\aclayers.dll
2009-11-04 22:51 24,192 a——- c:\documents and settings\owner\usbsermptxp.sys
2009-11-04 22:51 22,768 a——- c:\documents and settings\owner\usbsermpt.sys
2009-10-28 23:46 832,512 ——– c:\windows\system32\wininet.dll
2009-10-28 23:46 78,336 a——- c:\windows\system32\ieencode.dll
2009-10-28 23:46 17,408 a——- c:\windows\system32\corpol.dll
2009-10-17 00:39 0 a–sh— c:\windows\sminst\HPCD.sys

============= FINISH: 6:51:57.53 ===============

Here are the logs you requested…… thanks again for your help…

c:\windows\Bqaqaruyuqidefay.dat

Filename: Rnayesida.dat
Status: Scan finished. 0 out of 20 scanners reported malware.
Scan taken on: Sun 17 Jan 2010 07:30:03 (CET)
File size: 120 bytes
Filetype: ASCII text, with no line terminators
MD5: 8efeabdeec3de81c3dc42a2801ddf461
SHA1: 02f1032b36b1546af5815cd03befd0aa5a09b008


c:\windows\Dbucakob.bin

Status: File is empty (0 bytes)!



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:22:26 PM, on 1/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dogpile.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Multi Reminders] "C:\Program Files\Multi Reminders\reminder.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - http://intel-drv-cdn.systemrequirementslab…reqlab_srlx.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {94E5218F-9737-4FC2-8457-567B1FF23DC0} (diskhealth Class) - http://utilities.pcpitstop.com/DiskMD3/DiskMD3Ctrl.dll
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…859/mcfscan.cab
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

–
End of file - 7692 bytes