[Resolved] Slow computer

These are the 3 items you requested I believe. I was not sure how to turn off scripts so I disabled some anti virus stuff. Also, after I downloaded the gmer I didn't see any message about running a scan for rootkits. Let me know if this is ok or whether I need to do anything else. Thanks so much for your help. For what it's worth I coundn't log back into the site from my laptop (the problem computer) so I e-mailed the files to my desktop and posted them here from my desktop.


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 4/7/2008 11:59:01 PM
System Uptime: 3/3/2010 11:31:48 AM (46 hours ago)

Motherboard: Intel Corporation | | MPAD-MSAE Customer Reference Boards
Processor: Genuine Intel® CPU T2050 @ 1.60GHz | U1 | 1595/mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 112 GiB total, 71.627 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP624: 12/5/2009 6:58:22 PM - System Checkpoint
RP625: 12/6/2009 7:53:28 PM - System Checkpoint
RP626: 12/7/2009 11:31:54 PM - System Checkpoint
RP627: 12/8/2009 11:49:39 PM - System Checkpoint
RP628: 12/10/2009 12:03:48 AM - System Checkpoint
RP629: 12/11/2009 12:42:33 AM - System Checkpoint
RP630: 12/12/2009 12:43:21 AM - System Checkpoint
RP631: 12/13/2009 12:44:00 AM - System Checkpoint
RP632: 12/14/2009 12:44:35 AM - System Checkpoint
RP633: 12/15/2009 6:22:21 AM - System Checkpoint
RP634: 12/16/2009 6:24:06 AM - System Checkpoint
RP635: 12/17/2009 6:25:04 AM - System Checkpoint
RP636: 12/18/2009 6:25:50 AM - System Checkpoint
RP637: 12/19/2009 6:26:26 AM - System Checkpoint
RP638: 12/20/2009 6:39:28 AM - System Checkpoint
RP639: 12/20/2009 10:54:55 AM - Made by Registry Mechanic O
RP640: 12/21/2009 11:04:37 AM - System Checkpoint
RP641: 12/22/2009 11:08:10 AM - System Checkpoint
RP642: 12/23/2009 11:31:04 AM - System Checkpoint
RP643: 12/24/2009 11:51:53 AM - System Checkpoint
RP644: 12/25/2009 11:59:59 AM - System Checkpoint
RP645: 12/26/2009 12:23:29 PM - System Checkpoint
RP646: 12/27/2009 12:24:16 PM - System Checkpoint
RP647: 12/28/2009 1:25:45 PM - System Checkpoint
RP648: 12/29/2009 5:24:49 PM - System Checkpoint
RP649: 12/30/2009 6:45:46 PM - System Checkpoint
RP650: 12/31/2009 7:01:59 PM - System Checkpoint
RP651: 1/1/2010 8:13:02 PM - System Checkpoint
RP652: 1/2/2010 9:33:41 PM - System Checkpoint
RP653: 1/3/2010 10:30:53 PM - System Checkpoint
RP654: 1/4/2010 10:39:25 PM - System Checkpoint
RP655: 1/5/2010 11:31:28 PM - System Checkpoint
RP656: 1/7/2010 12:56:10 AM - System Checkpoint
RP657: 1/8/2010 1:31:22 AM - System Checkpoint
RP658: 1/9/2010 10:55:27 AM - System Checkpoint
RP659: 1/10/2010 11:41:50 AM - System Checkpoint
RP660: 1/11/2010 1:30:36 PM - System Checkpoint
RP661: 1/12/2010 2:02:27 PM - System Checkpoint
RP662: 1/13/2010 7:30:08 PM - System Checkpoint
RP663: 1/14/2010 4:52:04 PM - Removed SystemSuite 9 Professional
RP664: 1/14/2010 6:29:33 PM - Installed Avanquest MergeModules
RP665: 1/14/2010 6:29:54 PM - Installed SystemSuite 10 Professional
RP666: 1/15/2010 7:07:02 PM - System Checkpoint
RP667: 1/16/2010 7:11:07 PM - System Checkpoint
RP668: 1/17/2010 7:28:40 PM - System Checkpoint
RP669: 1/18/2010 9:43:24 PM - System Checkpoint
RP670: 1/19/2010 10:38:55 PM - System Checkpoint
RP671: 1/21/2010 11:59:38 PM - System Checkpoint
RP673: 1/22/2010 12:19:19 AM - Made by Registry Mechanic O
RP674: 1/23/2010 1:03:07 AM - System Checkpoint
RP675: 1/24/2010 1:43:26 AM - System Checkpoint
RP676: 1/25/2010 1:48:30 AM - System Checkpoint
RP677: 1/26/2010 2:17:30 AM - System Checkpoint
RP678: 1/27/2010 2:54:19 AM - System Checkpoint
RP679: 1/28/2010 3:14:01 AM - System Checkpoint
RP680: 1/29/2010 6:29:08 AM - System Checkpoint
RP681: 1/29/2010 11:05:11 AM - Made by Registry Mechanic O
RP682: 1/29/2010 11:06:32 AM - Made by Registry Mechanic O
RP683: 1/30/2010 5:21:17 PM - System Checkpoint
RP684: 1/31/2010 9:35:54 PM - System Checkpoint
RP685: 2/1/2010 10:42:59 PM - System Checkpoint
RP686: 2/3/2010 12:32:37 AM - System Checkpoint
RP687: 2/4/2010 12:43:28 AM - System Checkpoint
RP688: 2/5/2010 1:31:59 AM - System Checkpoint
RP689: 2/6/2010 2:19:04 AM - System Checkpoint
RP690: 2/7/2010 3:16:32 AM - System Checkpoint
RP691: 2/8/2010 3:29:09 AM - System Checkpoint
RP692: 2/8/2010 11:34:03 PM - Made by Registry Mechanic O
RP693: 2/10/2010 12:08:23 AM - System Checkpoint
RP694: 2/11/2010 12:09:25 AM - System Checkpoint
RP695: 2/11/2010 11:15:31 PM - Installed Java™ 6 Update 18
RP696: 2/12/2010 12:00:44 AM - Removed mIWA
RP697: 2/12/2010 12:00:58 AM - Removed mPfWiz
RP698: 2/12/2010 12:01:08 AM - Removed mXML
RP699: 2/12/2010 12:01:17 AM - Removed mHelp
RP700: 2/12/2010 12:01:44 AM - Removed mMHouse
RP701: 2/12/2010 12:02:08 AM - Removed mLogView
RP702: 2/12/2010 12:02:27 AM - Removed mZConfig
RP703: 2/12/2010 12:02:36 AM - Removed mDrWiFi
RP704: 2/12/2010 12:03:12 AM - Removed mCore
RP705: 2/12/2010 12:03:30 AM - Removed mPfMgr
RP706: 2/12/2010 12:03:38 AM - Installed Intel® PROSet/Wireless WiFi Software.
RP707: 2/13/2010 12:22:27 AM - System Checkpoint
RP708: 2/13/2010 7:22:41 PM - Made by Registry Mechanic O
RP709: 2/13/2010 7:23:47 PM - Made by Registry Mechanic O
RP710: 2/13/2010 8:02:53 PM - Made by Registry Mechanic O
RP711: 2/13/2010 8:03:59 PM - Made by Registry Mechanic O
RP712: 2/14/2010 8:15:28 AM - Made by Registry Mechanic O
RP713: 2/15/2010 8:32:15 AM - System Checkpoint
RP714: 2/16/2010 11:00:38 AM - System Checkpoint
RP715: 2/17/2010 4:05:26 PM - System Checkpoint
RP716: 2/18/2010 4:47:37 PM - System Checkpoint
RP717: 2/19/2010 5:33:39 PM - System Checkpoint
RP718: 2/20/2010 7:50:53 PM - System Checkpoint
RP719: 2/21/2010 5:55:29 PM - PC Decrapifier Restore Point
RP720: 2/22/2010 7:04:59 PM - System Checkpoint
RP721: 2/23/2010 8:06:22 PM - System Checkpoint
RP722: 2/24/2010 8:37:46 PM - System Checkpoint
RP723: 2/24/2010 11:10:09 PM - Made by Registry Mechanic O
RP724: 2/25/2010 11:27:30 PM - System Checkpoint
RP725: 2/27/2010 12:14:44 AM - System Checkpoint
RP726: 2/27/2010 9:14:29 AM - Made by Registry Mechanic O
RP727: 2/28/2010 9:56:12 AM - System Checkpoint
RP728: 3/1/2010 12:25:37 PM - System Checkpoint
RP729: 3/2/2010 12:27:19 PM - System Checkpoint
RP730: 3/3/2010 1:47:09 AM - Made by Registry Mechanic O
RP731: 3/4/2010 2:36:04 AM - System Checkpoint
RP732: 3/5/2010 2:50:00 AM - System Checkpoint

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.1.0
AOL Coach Version 2.0(Build:20041026.5 en)
AOL You've Got Pictures Screensaver
Apple Software Update
Avanquest update
Bejeweled 2 Deluxe
Blasterball 2 Revolution
Bluetooth Stack for Windows by Toshiba
Browser Defender 2.0.6.15
CD/DVD Drive Acoustic Silencer
Critical Update for Windows Media Player 11 (KB959772)
DVD-RAM Driver
ESPNMotion
FATE
FLV Player 2.0 (build 25)
GemMaster Mystic
GoToMeeting 4.5.0.452
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Connections Drivers
Intel® PROSet/Wireless Software
InterVideo WinDVD Creator 2
InterVideo WinDVD for TOSHIBA
J2SE Runtime Environment 5.0 Update 4
Java Auto Updater
Java DB 10.4.1.3
Java™ 6 Update 18
Java™ 6 Update 7
Java™ SE Development Kit 6 Update 13
JavaFX™ 1.1 SDK
Kaspersky Internet Security 2009
Macromedia Flash Player 8
mCore
mDrWiFi
Metamail (Toshiba Registration Utility)
mHelp
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office OneNote 2003
Microsoft Office Standard Edition 2003
Microsoft Office XP Small Business
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
mIWA
mLogView
mMHouse
Move Media Player
Mozilla Firefox (3.6)
mPfMgr
mPfWiz
mProSafe
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
mWlsSafe
mXML
MyConnect Special Offer
mZConfig
Office 2003 Trial Assistant
Otto
Polar Golfer
Primo
QuickTime
RealPlayer Basic
Realtek High Definition Audio Driver
RegCure 1.6.0.0
Registry Mechanic 9.0
SCRABBLE
SD Secure Module
Secure Viewer 2.6.0.0
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Sonic DLA
Sonic Encoders
Sonic RecordNow!
Sony Picture Utility
Spybot - Search & Destroy
Spyware Doctor 7.0
Synaptics Pointing Device Driver
SystemSuite 10 Professional
Texas Instruments PCIxx21/x515/xx12 drivers.
thinkorswim
TIPCI
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Controls
TOSHIBA Game Console
TOSHIBA Hotkey Utility
TOSHIBA PC Diagnostic Tool
TOSHIBA Power Saver
TOSHIBA SD Memory Card Format
TOSHIBA Software Modem
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA TouchPad ON/Off Utility
TOSHIBA TV Tuner 4.0.12.73
TOSHIBA Utilities
TOSHIBA Virtual Sound
TOSHIBA Zooming Utility
TrojanHunter 5.2
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
VLC media player 1.0.1
Volcone Analyzer Pro 2.0
WebEx
WebFldrs XP
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Media Center Edition 2005 KB888316
Windows XP Media Center Edition 2005 KB894553
Windows XP Media Center Edition 2005 KB895678
Windows XP Media Center Edition 2005 KB925766
Windows XP Media Center Edition 2005 KB973768
Windows XP Service Pack 3
Yahoo! Music Engine

==== Event Viewer Messages From Past Week ========

3/5/2010 9:01:09 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
3/3/2010 2:58:50 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the sdCoreService service.
3/3/2010 10:09:18 PM, error: Service Control Manager [7034] - The SystemSuite Task Manager service terminated unexpectedly. It has done this 1 time(s).
3/2/2010 9:45:00 PM, error: Service Control Manager [7034] - The SystemSuite service terminated unexpectedly. It has done this 1 time(s).
3/2/2010 9:44:12 PM, error: SideBySide [59] - Generate Activation Context failed for C:\PROGRA~1\KASPER~1\KASPER~1\oeas.dll. Reference error message: Error Message is unavailable .
3/2/2010 10:12:46 PM, error: Service Control Manager [7022] - The Telephony service hung on starting.
3/2/2010 10:12:46 PM, error: Service Control Manager [7022] - The Network Location Awareness (NLA) service hung on starting.
3/2/2010 10:12:46 PM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: After starting, the service hung in a start-pending state.
3/2/2010 10:10:21 PM, error: Service Control Manager [7022] - The COM+ System Application service hung on starting.
3/2/2010 10:04:06 PM, error: Service Control Manager [7001] - The Intel® PROSet/Wireless Service service depends on the Intel® PROSet/Wireless Event Log service which failed to start because of the following error: The system cannot find the file specified.
3/2/2010 10:04:06 PM, error: Service Control Manager [7000] - The Intel® PROSet/Wireless Registry Service service failed to start due to the following error: The system cannot find the file specified.
3/2/2010 10:04:06 PM, error: Service Control Manager [7000] - The Intel® PROSet/Wireless Event Log service failed to start due to the following error: The system cannot find the file specified.
3/2/2010 10:04:06 PM, error: Service Control Manager [7000] - The Ast Service service failed to start due to the following error: The system cannot find the file specified.
3/2/2010 10:04:06 PM, error: Service Control Manager [7000] - The AEGIS Protocol (IEEE 802.1x) v3.4.9.0 service failed to start due to the following error: The system cannot find the file specified.

==== End Of File ===========================


DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 9:05:13.28 on Fri 03/05/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.479 [GMT -5:00]

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AV: Avanquest SystemSuite *On-access scanning enabled* (Updated) {964FCE60-0B18-4D30-ADD6-EB178909041C}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TDispVol.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\dla\DLACTRLW.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\TrojanHunter 5.2\THGuard.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Common Files\AntiVirus\SBAMSvc.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask2.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\dllhost.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Desktop\dds.com
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avanquest\systemsuite\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: DataVault Object: {8373adc0-6330-11dd-9d77-22c856d89593} - c:\program files\avanquest\systemsuite\IE_ContextMenu_Vault.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe
uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p
mRun: [TDispVol] TDispVol.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [THotkey] c:\program files\toshiba\toshiba applet\thotkey.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [Tvs] c:\program files\toshiba\tvs\TvsTray.exe
mRun: [TPSMain] TPSMain.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [dla] c:\windows\system32\dla\DLACTRLW.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [CFSServ.exe] CFSServ.exe -NoClient
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [THGuard] "c:\program files\trojanhunter 5.2\THGuard.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxdev.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\adialhk.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\65u39nzw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\program files\avanquest\systemsuite\firefox3dv\components\VaultComponent.dll
FF - plugin: c:\documents and settings\owner\application data\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\program files\adobe\acrobat 7.0\reader\browser\npatgpc.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-3-21 207792]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2008-11-19 213520]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2010-1-14 13360]
R1 sbtis;sbtis;c:\windows\system32\drivers\sbtis.sys [2010-1-14 203056]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2009-12-30 112592]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2010-2-13 583640]
R2 SBAMSvc;SystemSuite;c:\program files\common files\antivirus\SBAMSvc.exe [2009-9-8 1012040]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2010-1-14 69936]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
S2 Ast Service;Ast Service;c:\windows\system32\\astsrv.exe –> c:\windows\system32\\AstSrv.exe [?]
S2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-7-29 208616]
S3 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-8-5 93872]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-3-21 359624]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-3-21 1141712]
S3 TFilter;TFilter;c:\progra~1\avanqu~1\system~1\TFilter.sys [2009-12-3 26952]

=============== Created Last 30 ================

2010-03-03 17:51:55 0 d—–w- c:\docume~1\owner\applic~1\TrojanHunter
2010-03-03 15:18:55 81920 —-a-w- c:\windows\system32\Startup.cpl
2010-02-25 06:01:00 0 d—–w- c:\program files\TrojanHunter 5.2
2010-02-14 01:06:32 0 d—–w- c:\docume~1\owner\applic~1\Registry Mechanic
2010-02-14 00:57:41 880640 —-a-w- c:\windows\system32\UniBox10.ocx
2010-02-14 00:57:41 212992 —-a-w- c:\windows\system32\UniBoxVB12.ocx
2010-02-14 00:57:41 1101824 —-a-w- c:\windows\system32\UniBox210.ocx
2010-02-12 17:22:46 2310 —-a-w- c:\windows\system32\%LocalXml%
2010-02-12 05:24:42 172032 —-a-w- c:\windows\system32\igfxres.dll
2010-02-12 05:04:35 663552 —-a-w- c:\windows\system32\NETw5c32.dll
2010-02-12 05:04:35 4221952 —-a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-02-12 05:04:35 2756608 —-a-w- c:\windows\system32\NETw5r32.dll
2010-02-12 05:03:47 0 d—–w- c:\program files\common files\Intel
2010-02-12 04:54:42 57344 —-a-w- c:\windows\system32\igxprd32.dll
2010-02-12 04:54:41 5854752 —-a-w- c:\windows\system32\drivers\igxpmp32.sys
2010-02-12 04:54:41 2643968 —-a-w- c:\windows\system32\igxpdx32.dll
2010-02-12 04:54:41 176128 —-a-w- c:\windows\system32\igfxrsky.lrc
2010-02-12 04:54:41 172032 —-a-w- c:\windows\system32\igfxrslv.lrc
2010-02-12 04:54:41 1670144 —-a-w- c:\windows\system32\igxpdv32.dll
2010-02-12 04:54:41 151040 —-a-w- c:\windows\system32\igxpgd32.dll
2010-02-12 04:54:41 147456 —-a-w- c:\windows\system32\igfxCoIn_v4926.dll
2010-02-12 04:54:34 920088 —-a-w- c:\windows\system32\igxpun.exe
2010-02-12 04:54:34 319456 —-a-w- c:\windows\system32\difxapi.dll
2010-02-12 04:51:29 0 d—–w- C:\Intel
2010-02-12 04:30:01 0 d—–w- c:\program files\SystemRequirementsLab

==================== Find3M ====================

2010-02-23 16:41:33 737312 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-23 16:41:33 4225568 –sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-23 16:41:33 3600 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-23 16:41:33 34092 –sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-19 00:59:09 72080 —-a-w- c:\documents and settings\owner\g2mdlhlpx.exe
2010-01-21 23:21:07 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-01-21 23:21:07 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-01-21 23:21:06 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-01-21 23:21:05 767952 —-a-w- c:\windows\BDTSupport.dll
2009-12-17 22:14:00 411368 —-a-w- c:\windows\system32\deploytk.dll
2008-08-13 19:25:19 2223653 —-a-w- c:\program files\mpc2kxp6490.zip
2006-03-20 19:37:00 5689344 —-a-w- c:\program files\mplayerc.exe
2008-08-12 22:43:58 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008081220080813\index.dat

============= FINISH: 9:06:33.45 ===============


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-05 11:51:10
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pwriyfob.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwAdjustPrivilegesToken [0xAA5E3A72]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwClose [0xAA5E401E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwConnectPort [0xAA5E5A82]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateFile [0xAA5E5438]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF7622E52]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF7603CDE]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF7603ED0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xAA5E73E4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateThread [0xAA5E3E1A]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF7623640]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF76238F4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeviceIoControlFile [0xAA5E5744]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDuplicateObject [0xAA5E78F0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateKey [0xAA5E3940]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateValueKey [0xAA5E39A8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwFsControlFile [0xAA5E55FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwLoadDriver [0xAA5E6EA8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenFile [0xAA5E5294]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF7621B44]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenProcess [0xAA5E3C40]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenSection [0xAA5E740E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenThread [0xAA5E3B96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryKey [0xAA5E3A10]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryMultipleValueKey [0xAA5E3714]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryValueKey [0xAA5E34F2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueueApcThread [0xAA5E7110]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF7623D60]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwReplaceKey [0xAA5E2E6A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwRequestWaitReplyPort [0xAA5E630C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwRestoreKey [0xAA5E2FCC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwResumeThread [0xAA5E77C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSaveKey [0xAA5E2C68]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSecureConnectPort [0xAA5E5924]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetContextThread [0xAA5E3F18]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetSecurityObject [0xAA5E6FA2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetSystemInformation [0xAA5E7438]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF7623112]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSuspendProcess [0xAA5E751C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSuspendThread [0xAA5E7648]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSystemDebugControl [0xAA5E6DD4]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF7603984]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwWriteVirtualMemory [0xAA5E3D5C]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) IoIsOperationSynchronous

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Udfs \UdfsCdRom DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\meiudf \MeiUDF_Disk DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\meiudf \MeiUDF_CdRom DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Udfs \UdfsDisk DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

AttachedDevice \Driver\Tcpip \Device\Ip sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software)

Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys

AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\RawIp sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

—- EOF - GMER 1.0.15 —-