What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] https tidserv request 2

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, I have been getting errors from norton security suite, involving an attack from an outside computer that has been detected and blocked. The name it shows is https tidserv request 2. I ran some scans and it seems that my atapi.sys driver is infected. I tried to clean it using the tdsskiller program and the norton tdss program also. So far I haven't been able to clean it. I can't save the GMER log currently, the initial scan shows atapi.sys has been suspicously modified or something like that. I tried to run the DDS.SCR program but Vista thinks its a screensaver and locks up when I click on it. I do have the logs from tdsskiller and norman tdss cleaner though. I will work on getting the GMER and DDS logs in the meantime. Thanks for your help Mike.

Attachments:

Post #2
Hello Michael and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back as soon as possible with instructions.
Post #3 last edited
Michael,

Make sure you are opening DDS and GMER by right clicking on them and selecting "Run as administrator"

Also, run GMER following these instructions carefully:

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please include the following in your next post:
  • DDS and Attach.txt log
  • GMER log
Post #4
Thanks RP, I got the DDS logs… Note: I had to change the extension from .SCR to .PIF to get it to work. Vista thinks the .SCR extension is for screensavers… I guess I could fix that somewhere. I am still having trouble with GMER… it locks up windows completely during the scan. I will keep trying tho. Thanks again. Michael.

Attachments:

Post #6
Michael,

🖼Click to load external image (Posted Image) Try running GMER again for me
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the safe mode (instructions below)
Follow these steps to reboot your computer into the Safe Mode:
  • Restart the computer.
  • As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode menu item
  • Press Enter.
🖼Click to load external image (Posted Image) Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • GMER log
  • ComboFix log
Post #7
Ok, I ran Combofix ok and got a report. I tried GMER again but it always locks up before finishing. the last few times it hangs on \device\harddiskvolumeshadowcopy4.

I tried GMER also in Safemode, it finished once without detecting anything, and also hung at the above file, shadowcopy4.

Here is the log from combofix:

ComboFix 10-04-13.02 - micheal 04/13/2010 13:19:15.2.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2047.1196 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton Security Suite *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Security Suite *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-03-13 to 2010-04-13 )))))))))))))))))))))))))))))))
.

2010-04-13 20:31 . 2010-04-13 20:31 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-04-13 20:31 . 2010-04-13 20:31 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-04-13 20:14 . 2010-04-13 20:15 ——– d—–w- C:\32788R22FWJFW
2010-04-13 20:11 . 2010-02-13 01:41 558448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-04-13 16:14 . 2010-03-11 10:39 84912 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\NAVENG.SYS
2010-04-13 16:14 . 2010-03-11 10:39 177520 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\NAVENG32.DLL
2010-04-13 16:14 . 2010-03-11 10:39 1647984 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\NAVEX32A.DLL
2010-04-13 16:14 . 2010-03-11 10:39 1324720 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\NAVEX15.SYS
2010-04-13 16:14 . 2010-03-11 10:39 371248 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\EECTRL.SYS
2010-04-13 16:14 . 2010-03-11 10:39 2747440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\CCERASER.DLL
2010-04-13 16:14 . 2010-03-11 10:39 259440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\ECMSVR32.DLL
2010-04-13 16:14 . 2010-03-11 10:39 102448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100412.056\ERASER.SYS
2010-04-12 23:09 . 2010-04-12 23:09 ——– d—–w- c:\program files\ERUNT
2010-04-12 19:22 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSvix86.sys
2010-04-12 19:22 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\Scxpx86.dll
2010-04-12 19:22 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSxpx86.dll
2010-04-12 19:22 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSXpx86.sys
2010-04-12 19:22 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSviA64.sys
2010-04-12 17:41 . 2010-04-12 17:41 388096 —-a-r- c:\users\micheal\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-12 17:41 . 2010-04-12 17:41 ——– d—–w- c:\program files\TrendMicro
2010-04-11 07:14 . 2010-04-11 07:14 ——– d—–w- C:\MGlogs
2010-04-11 05:22 . 2010-04-11 05:22 ——– d—–w- c:\users\micheal\AppData\Roaming\Malwarebytes
2010-04-11 05:21 . 2010-03-29 22:24 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-11 05:21 . 2010-04-11 05:21 ——– d—–w- c:\programdata\Malwarebytes
2010-04-11 05:21 . 2010-03-29 22:24 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-11 05:21 . 2010-04-11 05:22 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-11 03:12 . 2010-04-11 03:12 52224 —-a-w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-11 03:12 . 2010-04-11 03:12 117760 —-a-w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-11 03:11 . 2010-04-11 03:11 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2010-04-11 03:11 . 2010-04-12 22:41 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-11 03:11 . 2010-04-11 03:11 ——– d—–w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com
2010-04-11 01:44 . 2010-04-11 01:44 ——– d—–w- c:\program files\CCleaner
2010-04-11 01:41 . 2010-04-11 01:41 ——– d—–w- c:\program files\Common Files\Java
2010-04-11 01:39 . 2010-04-11 01:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-04-08 01:03 . 2010-04-08 01:03 ——– d—–w- c:\users\micheal\AppData\Local\ApplicationHistory
2010-04-08 00:10 . 2010-04-11 07:13 214821 —-a-w- C:\MGlogs.zip
2010-04-08 00:09 . 2010-04-11 07:13 ——– d—–w- C:\MGtools
2010-04-08 00:07 . 2010-04-08 00:06 2388895 —-a-w- C:\MGtools.exe
2010-04-06 01:55 . 2010-04-06 01:55 ——– d—–w- c:\windows\Sun
2010-04-06 01:53 . 2010-04-06 01:53 ——– d—–w- c:\program files\Free Offers from Freeze.com
2010-04-06 01:01 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\Scxpx86.dll
2010-04-06 01:01 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSvix86.sys
2010-04-06 01:01 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSxpx86.dll
2010-04-06 01:01 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSviA64.sys
2010-04-06 01:01 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSXpx86.sys
2010-03-27 03:12 . 2010-03-27 03:12 ——– d—–w- c:\programdata\WindowsSearch
2010-03-14 22:23 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\Scxpx86.dll
2010-03-14 22:23 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSvix86.sys
2010-03-14 22:23 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSXpx86.sys
2010-03-14 22:23 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSxpx86.dll
2010-03-14 22:23 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100312.001\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-13 20:11 . 2010-02-22 00:50 33069 —-a-w- c:\programdata\nvModes.dat
2010-04-13 20:10 . 2010-02-22 00:45 ——– d—–w- c:\programdata\NVIDIA
2010-04-12 22:41 . 2010-02-22 00:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-04-12 20:09 . 2008-02-14 19:24 21560 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-04-11 01:39 . 2007-06-11 22:30 ——– d—–w- c:\program files\Java
2010-04-06 22:38 . 2010-02-06 21:39 ——– d—–w- c:\program files\Trade Guider RT V4
2010-04-04 03:55 . 2007-06-18 21:04 ——– d—–w- c:\users\micheal\AppData\Roaming\OpenOffice.org2
2010-03-12 03:39 . 2007-03-27 19:50 ——– d—–w- c:\programdata\Symantec
2010-03-11 21:54 . 2007-03-27 19:50 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-03-11 21:39 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-03-11 21:34 . 2010-03-11 21:31 ——– d—–w- c:\programdata\Norton
2010-03-11 21:34 . 2007-09-14 19:08 ——– d—–w- c:\program files\Movie Maker 2.6
2010-03-11 21:32 . 2010-03-11 21:32 ——– d—–w- c:\program files\Symantec
2010-03-11 21:32 . 2010-03-11 21:32 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-03-11 21:32 . 2010-03-11 21:32 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-11 21:32 . 2010-03-11 21:32 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-03-11 21:31 . 2010-03-11 21:33 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-11 21:31 . 2010-03-11 21:33 25648 —-a-r- c:\windows\system32\drivers\SymIMV.sys
2010-03-11 21:31 . 2010-03-11 21:31 1291104 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2010-03-11 21:31 . 2010-03-11 21:31 136840 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2010-03-11 21:31 . 2010-03-11 21:33 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2010-03-11 21:31 . 2010-03-11 21:31 776952 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2010-03-11 21:31 . 2010-03-11 21:31 ——– d—–w- c:\program files\Norton Security Suite
2010-03-11 21:30 . 2010-03-11 21:30 ——– d—–w- c:\programdata\NortonInstaller
2010-03-11 21:30 . 2010-03-11 21:30 ——– d—–w- c:\program files\NortonInstaller
2010-03-11 20:59 . 2007-06-10 02:55 ——– d—–w- c:\programdata\McAfee
2010-03-09 16:54 . 2010-03-31 04:23 832512 —-a-w- c:\windows\system32\wininet.dll
2010-03-09 16:50 . 2010-03-31 04:23 56320 —-a-w- c:\windows\system32\iesetup.dll
2010-03-09 16:50 . 2010-03-31 04:23 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-09 16:50 . 2010-03-31 04:23 52736 —-a-w- c:\windows\AppPatch\iebrshim.dll
2010-03-09 16:48 . 2010-03-31 04:23 72704 —-a-w- c:\windows\system32\admparse.dll
2010-03-09 14:17 . 2010-03-31 04:23 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2010-03-09 12:43 . 2010-03-31 04:23 48128 —-a-w- c:\windows\system32\mshtmler.dll
2010-03-07 00:07 . 2009-02-07 09:29 ——– d—–w- c:\users\micheal\AppData\Roaming\Skype
2010-03-07 00:06 . 2007-06-10 02:29 89032 —-a-w- c:\users\micheal\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-05 22:07 . 2009-06-26 17:43 ——– d—–w- c:\programdata\performance
2010-03-05 20:58 . 2009-12-20 01:41 ——– d—–w- c:\users\micheal\AppData\Roaming\GrabIt
2010-02-26 20:52 . 2010-02-26 20:51 ——– d—–w- c:\program files\iTunes
2010-02-26 20:51 . 2010-02-26 20:51 ——– d—–w- c:\program files\iPod
2010-02-26 20:51 . 2007-07-20 02:59 ——– d—–w- c:\program files\Common Files\Apple
2010-02-26 20:43 . 2010-02-26 20:43 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-26 20:35 . 2009-08-22 19:46 ——– d—–w- c:\users\micheal\AppData\Roaming\NewzToolz-EZ
2010-02-24 17:16 . 2010-02-22 10:10 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-22 17:21 . 2007-09-01 07:19 ——– d—–w- c:\program files\Google
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\users\micheal\AppData\Roaming\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\users\micheal\AppData\Roaming\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 111928 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-02-22 06:50 . 2010-02-22 06:50 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2010-02-22 06:50 . 2010-02-22 06:50 794408 —-a-w- c:\windows\system32\pbsvc.exe
2010-02-22 06:50 . 2007-03-27 19:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-22 06:11 . 2010-01-23 02:40 ——– d—–w- c:\program files\Activision
2010-02-22 00:47 . 2010-02-22 00:34 1356 —-a-w- c:\users\micheal\AppData\Local\d3d9caps.dat
2010-02-22 00:44 . 2010-02-22 00:44 ——– d—–w- c:\program files\NVIDIA Corporation
2010-02-22 00:44 . 2010-02-22 00:44 ——– d—–w- c:\program files\AGEIA Technologies
2010-02-19 23:47 . 2010-02-19 23:47 3604480 —-a-w- c:\windows\system32\GPhotos.scr
2010-02-16 08:38 . 2010-02-09 18:38 ——– d—–w- c:\program files\EOD Downloader
2010-01-25 12:58 . 2010-02-24 11:45 473088 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:58 . 2010-02-24 11:45 154624 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:58 . 2010-02-24 11:45 154112 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:58 . 2010-02-24 11:45 472576 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 12:56 . 2010-02-24 11:45 312320 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:36 . 2010-02-24 11:45 435712 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:36 . 2010-02-24 11:45 515584 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:36 . 2010-02-24 11:45 431104 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:35 . 2010-02-24 11:45 523776 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-23 08:05 . 2010-02-24 11:47 2048 —-a-w- c:\windows\system32\tzres.dll
2001-07-24 00:09 . 2007-09-14 20:42 696320 —-a-w- c:\program files\Common Files\sapi.dll
2007-06-28 21:01 . 2007-06-28 21:01 22 –sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-05-16 95536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-06-10 1006264]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-01 133656]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2008-05-16 54576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2006-11-20 155648]
"MaxtorOneTouch"="c:\program files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-24 44136]

c:\users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-3 111376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-22 135664]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2010-03-11 259632]
S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2010-03-11 482432]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100409.001\IDSvix86.sys [2009-10-28 343088]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-03-11 102448]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-22 17:21]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-22 17:21]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000Core.job
- c:\users\micheal\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 21:07]

2010-04-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000UA.job
- c:\users\micheal\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 21:07]
.
.
——- Supplementary Scan ——-
.
IE: Add to AMV Convert Tool… - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Media Manager… - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\
FF - prefs.js: browser.startup.homepage - hxxp://sfgate.com/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\users\micheal\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-13 13:31
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x85FE1AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x81e74d1f
\Driver\ACPI -> acpi.sys @ 0x804699d6
\Driver\atapi -> ataport.SYS @ 0x807949c6
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x82196243
SecurityProcedure -> ntkrnlpa.exe @ 0x82195467
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x82196243
SecurityProcedure -> ntkrnlpa.exe @ 0x82195467
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3655264125-3525235294-3771617924-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:de,b4,e8,31,28,58,bb,6d,d1,44,85,85,7f,72,60,d2,35,cc,59,5b,6a,ad,2e,
92,c0,32,2d,77,4f,41,73,83,b2,65,b5,dd,6f,8a,55,83,74,f5,35,29,e8,ae,be,1a,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-3655264125-3525235294-3771617924-1000\Software\SecuROM\License information*]
"datasecu"=hex:f0,08,b2,91,3a,69,1d,b9,8c,73,1e,bb,c9,08,ab,bf,8f,b4,84,5f,2c,
1a,43,a4,87,35,71,5c,3f,6b,d1,f1,1c,d6,99,75,3d,45,3d,04,bb,16,dd,07,64,eb,\
"rkeysecu"=hex:71,8d,fd,90,a1,c1,52,00,47,2a,4b,c0,49,a3,a2,b2

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(3832)
c:\windows\system32\timedate.cpl
c:\windows\System32\NaturalLanguage6.dll
c:\windows\system32\webcheck.dll
c:\windows\System32\ntlanman.dll
.
Completion time: 2010-04-13 13:38:58
ComboFix-quarantined-files.txt 2010-04-13 20:38
ComboFix2.txt 2010-04-11 06:30

Pre-Run: 19,670,925,312 bytes free
Post-Run: 19,837,329,408 bytes free

- - End Of File - - 0576DAA88CA68709236635EE15D2A2E5
Post #8
Michael,

🖼Click to load external image (Posted Image) Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Custom Scan box paste this in:
    netsvcs
    %systemroot%\system32\drivers\*.sys /90
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time.
Please include the following in your next post:
  • OTL log
Post #9
Thanks RP, here is the log file:


OTL logfile created on: 4/13/2010 6:52:32 PM - Run 2
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\micheal\Desktop
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 63.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.98 Gb Total Space | 18.48 Gb Free Space | 13.02% Space Free | Partition Type: NTFS
Drive D: | 7.07 Gb Total Space | 0.88 Gb Free Space | 12.48% Space Free | Partition Type: NTFS
Drive E: | 4.51 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TRADER
Current User Name: micheal
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\micheal\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe (Maxtor Corporation)
PRC - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()


========== Modules (SafeList) ==========

MOD - C:\Users\micheal\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MaxBackServiceInt) – File not found
SRV - (CLTNetCnService) – File not found
SRV - (N360) – C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
SRV - (Stereo Service) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://sfgate.com/"
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/04/13 18:47:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/10 13:45:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/10 18:39:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/12/19 18:33:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009/12/19 18:34:08 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Mozilla\Extensions
[2009/12/19 18:34:08 | 000,000,000 | —D | M] (No name found) – C:\Users\micheal\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/04/13 18:49:52 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions
[2009/07/20 17:59:06 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/22 16:46:47 | 000,000,000 | —D | M] (Free TV Bar Toolbar) – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions\{a0729639-d831-46c9-811b-9b0aa79fb45a}
[2009/08/25 16:01:36 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions\[removed]
[2010/04/13 18:47:07 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/09/03 14:17:10 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/10/01 14:46:11 | 000,221,184 | —- | M] (CNN) – C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2009/05/20 07:10:51 | 000,000,841 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 255.255.255.255 hcurltest5
O1 - Hosts: 74.208.77.54 hcurltest1
O1 - Hosts: 82.165.161.232 hcurltest2
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe (Maxtor Corporation)
O4 - HKLM..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe (OLYMPUS IMAGING CORP.)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKCU..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O4 - Startup: C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab (ijjiPlugin2 Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop BackupWallPaper: C:\Users\micheal\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/09/26 18:49:43 | 000,000,000 | —D | M] - E:\AutoRunData – [ CDFS ]
O32 - AutoRun File - [2006/09/01 10:27:06 | 000,090,112 | R— | M] () - E:\Autorun.exe – [ CDFS ]
O32 - AutoRun File - [2006/07/12 15:56:29 | 000,000,058 | R— | M] () - E:\Autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008/10/04 16:56:22 | 000,000,000 | —D | M]
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 14 Days ==========

[2010/04/13 13:37:32 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/04/13 13:14:27 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2010/04/13 13:01:28 | 000,000,000 | –SD | C] – C:\Users\micheal\Desktop\ComboFix
[2010/04/12 16:09:03 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/04/12 15:56:53 | 002,618,936 | —- | C] (Norman ASA) – C:\Users\micheal\Desktop\Norman_TDSS_Cleaner.exe
[2010/04/12 15:41:28 | 000,000,000 | —D | C] – C:\Config.Msi
[2010/04/12 11:43:18 | 000,561,664 | —- | C] (OldTimer Tools) – C:\Users\micheal\Desktop\OTL.exe
[2010/04/12 10:41:24 | 000,000,000 | —D | C] – C:\Program Files\TrendMicro
[2010/04/12 10:36:43 | 000,178,000 | —- | C] (Kaspersky Lab) – C:\Users\micheal\Desktop\TDSSKiller.exe
[2010/04/12 10:36:43 | 000,000,000 | —D | C] – C:\Users\micheal\Desktop\tdsskiller
[2010/04/11 00:14:26 | 000,000,000 | —D | C] – C:\MGlogs
[2010/04/10 23:08:05 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/04/10 23:08:05 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/04/10 23:08:05 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/04/10 23:08:05 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/04/10 23:07:54 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/04/10 23:04:54 | 000,000,000 | —D | C] – C:\Qoobox
[2010/04/10 22:22:24 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Roaming\Malwarebytes
[2010/04/10 22:21:51 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/10 22:21:46 | 000,020,824 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/04/10 22:21:46 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/04/10 22:21:45 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/10 20:11:54 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/04/10 20:11:39 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Roaming\SUPERAntiSpyware.com
[2010/04/10 20:11:39 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/04/10 20:03:53 | 000,000,000 | —D | C] – C:\Users\micheal\Desktop\malware scanners
[2010/04/10 18:44:36 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/04/10 18:41:45 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/04/10 18:41:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/04/07 18:03:59 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Local\ApplicationHistory
[2010/04/07 17:09:38 | 000,000,000 | —D | C] – C:\MGtools
[2010/04/05 18:55:44 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/04/05 18:53:25 | 000,000,000 | —D | C] – C:\Program Files\Free Offers from Freeze.com
[2010/04/05 16:27:42 | 000,000,000 | —D | C] – C:\Users\micheal\Desktop\oldpicscans
[2007/09/14 13:42:05 | 000,696,320 | —- | C] (Microsoft Corporation) – C:\Program Files\Common Files\sapi.dll

========== Files - Modified Within 14 Days ==========

[2010/04/13 18:53:19 | 003,670,016 | -HS- | M] () – C:\Users\micheal\NTUSER.DAT
[2010/04/13 18:53:19 | 000,626,738 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/04/13 18:53:19 | 000,107,508 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/04/13 18:53:18 | 000,729,436 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/04/13 18:47:45 | 000,033,069 | —- | M] () – C:\ProgramData\nvModes.dat
[2010/04/13 18:47:45 | 000,033,069 | —- | M] () – C:\ProgramData\nvModes.001
[2010/04/13 18:47:16 | 000,003,680 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/13 18:47:16 | 000,003,680 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/13 18:47:02 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/13 18:46:55 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/13 18:46:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/13 18:45:46 | 2146,820,096 | -HS- | M] () – C:\hiberfil.sys
[2010/04/13 16:38:03 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/13 13:31:35 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/04/13 13:27:17 | 000,000,916 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000UA.job
[2010/04/13 13:08:48 | 315,629,674 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/04/13 12:51:35 | 003,914,375 | R— | M] () – C:\Users\micheal\Desktop\ComboFix.exe
[2010/04/12 21:39:56 | 000,000,864 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000Core.job
[2010/04/12 21:27:55 | 000,071,680 | —- | M] () – C:\Users\micheal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/12 19:37:32 | 000,293,376 | —- | M] () – C:\Users\micheal\Desktop\t4684t12.exe
[2010/04/12 16:10:34 | 000,359,929 | —- | M] () – C:\Users\micheal\Desktop\dds.pif
[2010/04/12 16:09:10 | 000,000,919 | —- | M] () – C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/04/12 16:09:04 | 000,000,739 | —- | M] () – C:\Users\micheal\Desktop\NTREGOPT.lnk
[2010/04/12 16:09:04 | 000,000,720 | —- | M] () – C:\Users\micheal\Desktop\ERUNT.lnk
[2010/04/12 15:56:12 | 002,618,936 | —- | M] (Norman ASA) – C:\Users\micheal\Desktop\Norman_TDSS_Cleaner.exe
[2010/04/12 11:42:55 | 000,561,664 | —- | M] (OldTimer Tools) – C:\Users\micheal\Desktop\OTL.exe
[2010/04/12 10:41:24 | 000,001,950 | —- | M] () – C:\Users\micheal\Desktop\HiJackThis.lnk
[2010/04/11 00:35:23 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/04/11 00:13:53 | 000,214,821 | —- | M] () – C:\MGlogs.zip
[2010/04/10 22:21:57 | 000,000,824 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/10 22:10:21 | 000,016,384 | -H– | M] () – C:\ffastun.ffo
[2010/04/10 22:10:21 | 000,004,379 | -H– | M] () – C:\ffastun.ffa
[2010/04/10 22:10:20 | 000,540,672 | -H– | M] () – C:\ffastun0.ffx
[2010/04/10 22:10:20 | 000,081,920 | -H– | M] () – C:\ffastun.ffl
[2010/04/10 18:44:45 | 000,001,676 | —- | M] () – C:\Users\micheal\Desktop\CCleaner.lnk
[2010/04/07 17:06:34 | 002,388,895 | —- | M] () – C:\MGtools.exe
[2010/04/06 15:38:16 | 000,000,863 | —- | M] () – C:\Users\Public\Desktop\Trade Guider RT V4.lnk
[2010/04/06 12:43:52 | 000,307,200 | —- | M] () – C:\Users\micheal\Desktop\forex log.xls
[2010/04/05 19:15:26 | 000,000,000 | —- | M] () – C:\Users\micheal\.gtk-bookmarks
[2010/04/01 13:32:39 | 000,026,117 | —- | M] () – C:\Users\micheal\Desktop\eu4hr.gif
[2010/03/31 12:28:18 | 000,067,072 | —- | M] () – C:\Users\micheal\Desktop\Trade check list log.xls

========== Files Created - No Company Name ==========

[2010/04/13 18:45:46 | 2146,820,096 | -HS- | C] () – C:\hiberfil.sys
[2010/04/13 13:07:55 | 315,629,674 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/04/13 12:55:11 | 003,914,375 | R— | C] () – C:\Users\micheal\Desktop\ComboFix.exe
[2010/04/12 19:40:35 | 000,293,376 | —- | C] () – C:\Users\micheal\Desktop\t4684t12.exe
[2010/04/12 16:11:52 | 000,359,929 | —- | C] () – C:\Users\micheal\Desktop\dds.pif
[2010/04/12 16:09:10 | 000,000,919 | —- | C] () – C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/04/12 16:09:04 | 000,000,739 | —- | C] () – C:\Users\micheal\Desktop\NTREGOPT.lnk
[2010/04/12 16:09:04 | 000,000,720 | —- | C] () – C:\Users\micheal\Desktop\ERUNT.lnk
[2010/04/12 10:41:24 | 000,001,950 | —- | C] () – C:\Users\micheal\Desktop\HiJackThis.lnk
[2010/04/11 00:35:23 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/04/10 23:08:05 | 000,261,632 | —- | C] () – C:\Windows\PEV.exe
[2010/04/10 23:08:05 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/04/10 23:08:05 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/04/10 23:08:05 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/04/10 23:08:05 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/04/10 22:21:57 | 000,000,824 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/10 18:47:02 | 000,001,098 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Compaq Connections.lnk
[2010/04/10 18:47:02 | 000,000,931 | —- | C] () – C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
[2010/04/10 18:44:45 | 000,001,676 | —- | C] () – C:\Users\micheal\Desktop\CCleaner.lnk
[2010/04/07 17:10:01 | 000,214,821 | —- | C] () – C:\MGlogs.zip
[2010/04/07 17:07:35 | 002,388,895 | —- | C] () – C:\MGtools.exe
[2010/04/01 13:32:37 | 000,026,117 | —- | C] () – C:\Users\micheal\Desktop\eu4hr.gif
[2010/03/31 11:55:04 | 000,067,072 | —- | C] () – C:\Users\micheal\Desktop\Trade check list log.xls
[2010/02/21 23:50:48 | 000,139,152 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2010/02/21 23:50:47 | 000,139,152 | —- | C] () – C:\Users\micheal\AppData\Roaming\PnkBstrK.sys
[2010/02/21 17:50:16 | 000,033,069 | —- | C] () – C:\ProgramData\nvModes.001
[2010/02/21 17:50:15 | 000,033,069 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/02/21 17:40:36 | 000,389,120 | —- | C] () – C:\Windows\System32\HookShield.dll
[2010/02/21 17:40:35 | 000,134,504 | —- | C] () – C:\Windows\System32\smdll.dll
[2010/02/21 17:40:35 | 000,036,200 | —- | C] () – C:\Windows\System32\Auxiliary.dll
[2010/02/21 17:40:31 | 000,225,280 | —- | C] () – C:\Windows\System32\HookMap.dll
[2010/02/21 17:34:11 | 000,001,356 | —- | C] () – C:\Users\micheal\AppData\Local\d3d9caps.dat
[2010/02/10 18:46:41 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2010/02/09 18:17:46 | 000,000,794 | —- | C] () – C:\Users\micheal\Desktopqmd.lnk
[2010/01/01 15:32:09 | 000,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2009/12/20 15:08:21 | 000,000,218 | —- | C] () – C:\Users\micheal\.recently-used.xbel
[2009/12/09 07:24:54 | 000,098,304 | —- | C] () – C:\Windows\System32\NtDirect.dll
[2009/10/19 18:19:03 | 000,000,121 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2009/10/16 16:39:25 | 000,000,040 | -HS- | C] () – C:\ProgramData\.zreglib
[2009/09/28 14:50:05 | 000,116,224 | —- | C] () – C:\Windows\System32\UnzDll.dll
[2009/09/28 14:50:04 | 000,017,920 | —- | C] () – C:\Windows\System32\IMPLODE.DLL
[2009/09/26 23:00:41 | 000,413,696 | —- | C] () – C:\Windows\System32\MetaLib.dll
[2009/08/03 01:21:54 | 000,197,912 | —- | C] () – C:\Windows\System32\physxcudart_20.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2009/08/03 01:21:52 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2009/08/03 01:21:52 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2009/02/26 12:03:30 | 000,060,744 | —- | C] () – C:\Users\micheal\g2mdlhlpx.exe
[2009/02/07 02:30:54 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/08/26 13:35:03 | 000,004,556 | —- | C] () – C:\Windows\WinSig.ini
[2008/08/26 13:35:03 | 000,000,253 | —- | C] () – C:\Windows\WINROS.INI
[2008/08/26 13:35:03 | 000,000,070 | —- | C] () – C:\Windows\reader.ini
[2008/07/23 14:14:34 | 000,605,763 | —- | C] () – C:\Users\micheal\.fonts.cache-1
[2008/03/25 09:56:08 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1461.dll
[2008/01/02 17:57:36 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2007/11/02 07:09:50 | 000,000,000 | —- | C] () – C:\Users\micheal\AppData\Roaming\wklnhst.dat
[2007/11/02 06:55:07 | 000,000,000 | —- | C] () – C:\Users\micheal\.gtk-bookmarks
[2007/09/14 13:42:05 | 000,282,687 | —- | C] () – C:\Windows\System32\CyberFax.dll
[2007/09/14 13:42:05 | 000,254,053 | —- | C] () – C:\Windows\System32\AtlTapiGetID.dll
[2007/09/14 12:11:46 | 000,071,680 | —- | C] () – C:\Users\micheal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/07 12:02:24 | 000,000,810 | —- | C] () – C:\Windows\Rtcw.INI
[2007/08/24 04:46:48 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2007/06/10 14:08:14 | 000,000,416 | —- | C] () – C:\Windows\MAXLINK.INI
[2007/06/09 19:20:58 | 000,000,020 | -HS- | C] () – C:\Users\micheal\ntuser.ini
[2007/06/09 19:20:57 | 003,670,016 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT
[2007/06/09 19:20:57 | 000,524,288 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms
[2007/06/09 19:20:57 | 000,524,288 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2007/06/09 19:20:57 | 000,262,144 | -H– | C] () – C:\Users\micheal\ntuser.dat.LOG1
[2007/06/09 19:20:57 | 000,065,536 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2007/06/09 19:20:57 | 000,000,000 | -H– | C] () – C:\Users\micheal\ntuser.dat.LOG2
[2007/03/27 11:58:19 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom24.dll
[2007/03/27 11:58:19 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes24.dll
[2007/03/27 11:49:46 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1132.dll
[2007/03/06 12:49:42 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1227.dll
[2007/01/10 04:56:34 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 00:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/08/10 23:00:40 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/08/10 23:00:40 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
[2004/09/16 13:26:40 | 000,012,634 | —- | C] () – C:\Windows\System32\drivers\ADFUUD.SYS
[2004/09/16 13:26:40 | 000,012,634 | —- | C] () – C:\Windows\ADFUUD.SYS
[2003/07/25 00:23:32 | 001,000,583 | —- | C] () – C:\Windows\System32\gnet-1.1.dll
[2002/12/12 22:24:04 | 000,653,824 | —- | C] () – C:\Windows\System32\libxml2.dll
[1996/12/03 16:00:00 | 000,022,016 | —- | C] () – C:\Windows\System32\DOCOBJ.DLL
[1996/12/03 16:00:00 | 000,012,288 | —- | C] () – C:\Windows\System32\HLINKPRX.DLL

========== LOP Check ==========

[2008/10/10 12:02:52 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Canon
[2008/04/25 13:20:45 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2009/06/26 10:43:54 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\counters
[2009/06/26 10:45:37 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\eSignal
[2009/11/26 12:40:09 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\FileZilla
[2010/03/05 13:58:16 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\GrabIt
[2009/12/20 14:31:03 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\gtk-2.0
[2007/08/12 17:43:08 | 000,000,000 | -H-D | M] – C:\Users\micheal\AppData\Roaming\ijjigame
[2009/11/05 18:26:38 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\KompoZer
[2010/02/26 13:35:41 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\NewzToolz-EZ
[2009/11/14 19:39:42 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Red Alert 3
[2007/06/10 14:07:59 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\ScanSoft
[2007/11/02 07:09:48 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Template
[2009/12/19 18:34:01 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Thunderbird
[2008/05/20 23:47:45 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Trading Rooms
[2007/09/14 14:45:34 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Video DVD Maker FREE
[2008/09/29 16:04:54 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\VirtuaWin
[2007/06/10 20:19:26 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\WinBatch
[2010/04/13 13:48:25 | 000,032,560 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %systemroot%\system32\drivers\*.sys /90 >
[2010/04/12 13:09:10 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\drivers\atapi.sys
[2010/03/11 14:31:48 | 000,026,600 | R— | M] (GEAR Software Inc.) – C:\Windows\System32\drivers\GEARAspiWDM.sys
[2010/03/29 15:24:46 | 000,020,824 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/03/29 15:24:58 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/02/21 23:50:47 | 000,139,152 | —- | M] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2010/03/11 14:32:20 | 000,124,976 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/03/11 14:31:48 | 000,025,648 | R— | M] (Symantec Corporation) – C:\Windows\System32\drivers\SymIMV.sys

< %SYSTEMDRIVE%\*.exe >
[2010/04/07 17:06:34 | 002,388,895 | —- | M] () – C:\MGtools.exe


< MD5 for: AGP440.SYS >
[2008/01/19 00:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 02:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\ERDNT\cache\AGP440.sys
[2006/11/02 02:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 02:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 00:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\SoftwareDistribution\Download\848c23cf13d83b3e0a6f1da97f3af588\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 02:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/14 12:24:34 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\MGtools\temp\ERDNT\atapi.sys
[2010/04/12 13:09:10 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\ERDNT\cache\atapi.sys
[2010/04/12 13:09:10 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\drivers\atapi.sys
[2008/02/14 12:24:34 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/14 12:24:34 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/14 12:24:33 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 02:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 02:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 02:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/19 00:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 02:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 02:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 02:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\ERDNT\cache\netlogon.dll
[2006/11/02 02:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\System32\netlogon.dll
[2006/11/02 02:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 00:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 02:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 02:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 00:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\SoftwareDistribution\Download\848c23cf13d83b3e0a6f1da97f3af588\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 00:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 02:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\ERDNT\cache\scecli.dll
[2006/11/02 02:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\System32\scecli.dll
[2006/11/02 02:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 02:47:18 | 000,228,968 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\rsaenh.dll
[2007/07/13 13:39:10 | 000,223,232 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 03:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 03:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 03:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 03:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 03:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV
< End of report >
Post #10
Michael,

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above TDL::

TDL::
C:\Windows\System32\drivers\atapi.sys

Folder::
c:\program files\Free Offers from Freeze.com

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • ComboFix log
  • Kaspersky log
  • How is your computer running?
Post #11
Hi RP,

I ran the Combofix like you said, it rebooted and created a report. I am having trouble with the Kaspersky scanner… I ran firefox with Norton Security Suite Stopped and as Administrator. I have tried 3 times and it just stops at the Database Update section. "Size of update 92239 KB, Downloaded 83 KB " Thats as far as it gets….

As far as the computer, I believe it is still infected… When Norton is running it still detects the HTTPS Tidserv Request 2 and I get tabs that open automatically at times.

Here is the Combofix report:

ComboFix 10-04-13.02 - micheal 04/14/2010 13:16:03.3.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2047.1270 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\micheal\Desktop\CFScript.txt
AV: Norton Security Suite *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Security Suite *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Free Offers from Freeze.com
c:\program files\Free Offers from Freeze.com\5540.url
c:\program files\Free Offers from Freeze.com\5541.url
c:\program files\Free Offers from Freeze.com\5543.url
c:\program files\Free Offers from Freeze.com\control.txt
c:\program files\Free Offers from Freeze.com\games.ico
c:\program files\Free Offers from Freeze.com\marine2.ico
c:\program files\Free Offers from Freeze.com\mixxxdj.ico
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat

—– BITS: Possible infected sites —–

hxxp://au.download.windj+|Cv+@J:NGD_DQ{zZOmO$e
.
((((((((((((((((((((((((( Files Created from 2010-03-14 to 2010-04-14 )))))))))))))))))))))))))))))))
.

2010-04-14 20:32 . 2010-04-14 20:37 ——– d—–w- c:\users\micheal\AppData\Local\temp
2010-04-14 20:32 . 2010-04-14 20:32 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-04-14 20:32 . 2010-04-14 20:32 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-04-14 19:56 . 2010-04-14 20:00 ——– d—–w- C:\32788R22FWJFW
2010-04-12 23:09 . 2010-04-12 23:09 ——– d—–w- c:\program files\ERUNT
2010-04-12 17:41 . 2010-04-12 17:41 ——– d—–w- c:\program files\TrendMicro
2010-04-11 07:14 . 2010-04-11 07:14 ——– d—–w- C:\MGlogs
2010-04-11 05:22 . 2010-04-11 05:22 ——– d—–w- c:\users\micheal\AppData\Roaming\Malwarebytes
2010-04-11 05:21 . 2010-03-29 22:24 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-11 05:21 . 2010-04-11 05:21 ——– d—–w- c:\programdata\Malwarebytes
2010-04-11 05:21 . 2010-03-29 22:24 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-11 05:21 . 2010-04-11 05:22 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-11 03:11 . 2010-04-11 03:11 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2010-04-11 03:11 . 2010-04-12 22:41 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-11 03:11 . 2010-04-11 03:11 ——– d—–w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com
2010-04-11 01:44 . 2010-04-11 01:44 ——– d—–w- c:\program files\CCleaner
2010-04-11 01:41 . 2010-04-11 01:41 ——– d—–w- c:\program files\Common Files\Java
2010-04-11 01:39 . 2010-04-11 01:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-04-08 01:03 . 2010-04-08 01:03 ——– d—–w- c:\users\micheal\AppData\Local\ApplicationHistory
2010-04-08 00:10 . 2010-04-11 07:13 214821 —-a-w- C:\MGlogs.zip
2010-04-08 00:09 . 2010-04-11 07:13 ——– d—–w- C:\MGtools
2010-04-08 00:07 . 2010-04-08 00:06 2388895 —-a-w- C:\MGtools.exe
2010-04-06 01:55 . 2010-04-06 01:55 ——– d—–w- c:\windows\Sun
2010-03-27 03:12 . 2010-03-27 03:12 ——– d—–w- c:\programdata\WindowsSearch

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-14 20:36 . 2010-02-22 00:50 33069 —-a-w- c:\programdata\nvModes.dat
2010-04-14 20:34 . 2010-02-22 00:45 ——– d—–w- c:\programdata\NVIDIA
2010-04-12 22:41 . 2010-02-22 00:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-04-12 20:09 . 2008-02-14 19:24 21560 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-04-11 01:39 . 2007-06-11 22:30 ——– d—–w- c:\program files\Java
2010-04-06 22:38 . 2010-02-06 21:39 ——– d—–w- c:\program files\Trade Guider RT V4
2010-04-04 03:55 . 2007-06-18 21:04 ——– d—–w- c:\users\micheal\AppData\Roaming\OpenOffice.org2
2010-03-12 03:39 . 2007-03-27 19:50 ——– d—–w- c:\programdata\Symantec
2010-03-11 21:54 . 2007-03-27 19:50 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-03-11 21:39 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-03-11 21:34 . 2010-03-11 21:31 ——– d—–w- c:\programdata\Norton
2010-03-11 21:34 . 2007-09-14 19:08 ——– d—–w- c:\program files\Movie Maker 2.6
2010-03-11 21:32 . 2010-03-11 21:32 ——– d—–w- c:\program files\Symantec
2010-03-11 21:32 . 2010-03-11 21:32 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-03-11 21:32 . 2010-03-11 21:32 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-11 21:32 . 2010-03-11 21:32 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-03-11 21:31 . 2010-03-11 21:33 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-11 21:31 . 2010-03-11 21:33 25648 —-a-r- c:\windows\system32\drivers\SymIMV.sys
2010-03-11 21:31 . 2010-03-11 21:33 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2010-03-11 21:31 . 2010-03-11 21:31 ——– d—–w- c:\program files\Norton Security Suite
2010-03-11 21:30 . 2010-03-11 21:30 ——– d—–w- c:\programdata\NortonInstaller
2010-03-11 21:30 . 2010-03-11 21:30 ——– d—–w- c:\program files\NortonInstaller
2010-03-11 20:59 . 2007-06-10 02:55 ——– d—–w- c:\programdata\McAfee
2010-03-09 16:54 . 2010-03-31 04:23 832512 —-a-w- c:\windows\system32\wininet.dll
2010-03-09 16:50 . 2010-03-31 04:23 56320 —-a-w- c:\windows\system32\iesetup.dll
2010-03-09 16:50 . 2010-03-31 04:23 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-09 16:48 . 2010-03-31 04:23 72704 —-a-w- c:\windows\system32\admparse.dll
2010-03-09 14:17 . 2010-03-31 04:23 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2010-03-09 12:43 . 2010-03-31 04:23 48128 —-a-w- c:\windows\system32\mshtmler.dll
2010-03-07 00:07 . 2009-02-07 09:29 ——– d—–w- c:\users\micheal\AppData\Roaming\Skype
2010-03-07 00:06 . 2007-06-10 02:29 89032 —-a-w- c:\users\micheal\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-05 22:07 . 2009-06-26 17:43 ——– d—–w- c:\programdata\performance
2010-03-05 20:58 . 2009-12-20 01:41 ——– d—–w- c:\users\micheal\AppData\Roaming\GrabIt
2010-02-26 20:52 . 2010-02-26 20:51 ——– d—–w- c:\program files\iTunes
2010-02-26 20:51 . 2010-02-26 20:51 ——– d—–w- c:\program files\iPod
2010-02-26 20:51 . 2007-07-20 02:59 ——– d—–w- c:\program files\Common Files\Apple
2010-02-26 20:35 . 2009-08-22 19:46 ——– d—–w- c:\users\micheal\AppData\Roaming\NewzToolz-EZ
2010-02-24 17:16 . 2010-02-22 10:10 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-22 17:21 . 2007-09-01 07:19 ——– d—–w- c:\program files\Google
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\users\micheal\AppData\Roaming\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 111928 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-02-22 06:50 . 2010-02-22 06:50 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2010-02-22 06:50 . 2010-02-22 06:50 794408 —-a-w- c:\windows\system32\pbsvc.exe
2010-02-22 06:50 . 2007-03-27 19:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-22 06:11 . 2010-01-23 02:40 ——– d—–w- c:\program files\Activision
2010-02-22 00:47 . 2010-02-22 00:34 1356 —-a-w- c:\users\micheal\AppData\Local\d3d9caps.dat
2010-02-22 00:44 . 2010-02-22 00:44 ——– d—–w- c:\program files\NVIDIA Corporation
2010-02-22 00:44 . 2010-02-22 00:44 ——– d—–w- c:\program files\AGEIA Technologies
2010-02-19 23:47 . 2010-02-19 23:47 3604480 —-a-w- c:\windows\system32\GPhotos.scr
2010-02-16 08:38 . 2010-02-09 18:38 ——– d—–w- c:\program files\EOD Downloader
2010-01-25 12:58 . 2010-02-24 11:45 473088 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:58 . 2010-02-24 11:45 154624 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:58 . 2010-02-24 11:45 154112 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:58 . 2010-02-24 11:45 472576 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 12:56 . 2010-02-24 11:45 312320 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:36 . 2010-02-24 11:45 435712 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:36 . 2010-02-24 11:45 515584 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:36 . 2010-02-24 11:45 431104 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:35 . 2010-02-24 11:45 523776 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-23 08:05 . 2010-02-24 11:47 2048 —-a-w- c:\windows\system32\tzres.dll
2001-07-24 00:09 . 2007-09-14 20:42 696320 —-a-w- c:\program files\Common Files\sapi.dll
2007-06-28 21:01 . 2007-06-28 21:01 22 –sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-05-16 95536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-06-10 1006264]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-01 133656]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2008-05-16 54576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2006-11-20 155648]
"MaxtorOneTouch"="c:\program files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-24 44136]

c:\users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-3 111376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-22 135664]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2010-03-11 259632]
S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2010-03-11 482432]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100409.001\IDSvix86.sys [2009-10-28 343088]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-03-11 102448]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-22 17:21]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-22 17:21]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000Core.job
- c:\users\micheal\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 21:07]

2010-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000UA.job
- c:\users\micheal\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 21:07]
.
.
——- Supplementary Scan ——-
.
IE: Add to AMV Convert Tool… - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Media Manager… - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\
FF - prefs.js: browser.startup.homepage - hxxp://sfgate.com/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\users\micheal\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-14 13:36
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8609FAC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x81e74d1f
\Driver\ACPI -> acpi.sys @ 0x804699d6
\Driver\atapi -> ataport.SYS @ 0x807949c6
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x82196243
SecurityProcedure -> ntkrnlpa.exe @ 0x82195467
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x82196243
SecurityProcedure -> ntkrnlpa.exe @ 0x82195467
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3655264125-3525235294-3771617924-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:de,b4,e8,31,28,58,bb,6d,d1,44,85,85,7f,72,60,d2,35,cc,59,5b,6a,ad,2e,
92,c0,32,2d,77,4f,41,73,83,b2,65,b5,dd,6f,8a,55,83,74,f5,35,29,e8,ae,be,1a,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-3655264125-3525235294-3771617924-1000\Software\SecuROM\License information*]
"datasecu"=hex:f0,08,b2,91,3a,69,1d,b9,8c,73,1e,bb,c9,08,ab,bf,8f,b4,84,5f,2c,
1a,43,a4,87,35,71,5c,3f,6b,d1,f1,1c,d6,99,75,3d,45,3d,04,bb,16,dd,07,64,eb,\
"rkeysecu"=hex:71,8d,fd,90,a1,c1,52,00,47,2a,4b,c0,49,a3,a2,b2

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(5556)
c:\windows\System32\NLSData0009.dll
c:\windows\system32\authui.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\DllHost.exe
c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
c:\windows\RtHDVCpl.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\sdclt.exe
c:\windows\system32\lpremove.exe
c:\windows\system32\lpksetup.exe
.
**************************************************************************
.
Completion time: 2010-04-14 13:50:32 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-14 20:50
ComboFix2.txt 2010-04-11 06:30

Pre-Run: 19,482,112,000 bytes free
Post-Run: 19,442,896,896 bytes free

- - End Of File - - D3C19FBFDE71647DE8598C87B6BA7E1C



I will keep trying the Kaspersky scan and post a report. when I can.

Thanks,

Michael.
Post #12
Michael, You can stop trying to run the Kaspersky scan. I can see by the ComboFix log that we have more to do first. I"ll post some more instructions later.
Post #13
First, you must verify that you can access the Vista Recovery Environment.
To do so, restart your computer and begin tapping the F8 key to enable the Advanced Start menu.
If the option 'Repair your computer' is available, select it.

If not available, you will need to insert your Vista installation dvd and restart, then press any key when prompted to boot from the cd.
At the Install Windows screen, select Repair your computer. (image below)

🖼Click to load external image (Posted Image)

Next, please download maxlook, saving the file to your desktop.
Double click maxlook.exe to run it. Note - you must run it only once!
As instructed when the tool runs, restart the computer and logon to the Recovery Environment.
Once you get to the System Recovery Options screen, first take note of the drive letter assigned to the operating system, then select Command Prompt.

🖼Click to load external image (Posted Image)

Type the following bolded command at the x:\sources> prompt (or x:\windows\system32>) then hit Enter.

cd /d x:\windows <— the red x represents your operating system drive letter, as shown in the image below


🖼Click to load external image (Posted Image)

At the C:\Windows> prompt type the following command then hit Enter

look.bat

You will see many files copied then return to the x:\windows> prompt.
Type Exit then restart your computer and logon in normal mode.
Please run maxlook.exe again now. Note - you must run it only once!
It will produce looklog.txt on the desktop and open it.
Please post the results here.

NEXT:

Once back in Windows, go to Start > Run, and copy/paste the following then press Enter.

maxlook -sig

Post the log in your next reply
Post #14
Ok, done, here are the 2 logs: Run from C:\Users\micheal\Desktop\maxlook.exe on Wed 04/14/2010 at 17:57:04.49 No infected file found the 2nd: code]Run from C:\Users\micheal\Desktop\maxlook.exe on Wed 04/14/2010 at 17:58:47.43 ——— maxlook unsigned files ——— c:\windows\maxdriver\ADFUUD.SYS: Verified: Unsigned File date: 1:26 PM 9/16/2004 Publisher: Description: Product: Version: 1.00 File version: 1.00 c:\windows\maxdriver\asapiW2k.sys: Verified: Unsigned File date: 8:27 PM 4/17/2002 Publisher: VOB Computersysteme GmbH Description: ASAPI Product: asapi Version: 6, 0, 0, 1 File version: 6, 0, 0, 1 c:\windows\maxdriver\cdr4_xp.sys: Verified: Unsigned File date: 3:00 AM 7/24/2006 Publisher: Sonic Solutions Description: CDR4 CD and DVD Place Holder Driver (see PxHelp) Product: Drag-to-Disc Version: 8.0.0.212 File version: 8.0.0.212 c:\windows\maxdriver\cdralw2k.sys: Verified: Unsigned File date: 3:00 AM 7/24/2006 Publisher: Sonic Solutions Description: CDRAL Place Holder Driver (see PxHelp) Product: Drag-to-Disc Version: 8.0.0.212 File version: 8.0.0.212 c:\windows\maxdriver\Pcouffin.sys: Verified: Unsigned File date: 6:10 PM 1/10/2008 Publisher: VSO Software Description: Patin-Couffin low level access layer for CD devices Product: Patin couffin engine Version: 1.19 File version: 1.19 c:\windows\maxdriver\RDPCDD.sys: Verified: Unsigned File date: 2:02 AM 11/2/2006 Publisher: n/a Description: n/a Product: n/a Version: n/a File version: n/a ——— system32\drivers unsigned files ——— c:\windows\system32\drivers\ADFUUD.SYS: Verified: Unsigned File date: 1:26 PM 9/16/2004 Publisher: Description: Product: Version: 1.00 File version: 1.00 c:\windows\system32\drivers\asapiW2k.sys: Verified: Unsigned File date: 8:27 PM 4/17/2002 Publisher: VOB Computersysteme GmbH Description: ASAPI Product: asapi Version: 6, 0, 0, 1 File version: 6, 0, 0, 1 c:\windows\system32\drivers\cdr4_xp.sys: Verified: Unsigned File date: 3:00 AM 7/24/2006 Publisher: Sonic Solutions Description: CDR4 CD and DVD Place Holder Driver (see PxHelp) Product: Drag-to-Disc Version: 8.0.0.212 File version: 8.0.0.212 c:\windows\system32\drivers\cdralw2k.sys: Verified: Unsigned File date: 3:00 AM 7/24/2006 Publisher: Sonic Solutions Description: CDRAL Place Holder Driver (see PxHelp) Product: Drag-to-Disc Version: 8.0.0.212 File version: 8.0.0.212 c:\windows\system32\drivers\Pcouffin.sys: Verified: Unsigned File date: 6:10 PM 1/10/2008 Publisher: VSO Software Description: Patin-Couffin low level access layer for CD devices Product: Patin couffin engine Version: 1.19 File version: 1.19 I did get a message from Norton again while loading the logs… Michael.
Post #15
Michael,

🖼Click to load external image (Posted Image) Go to the Control Panel
  • In the search bar enter Show hidden
  • In the main window click on Folder Options > Show hidden files and folders
  • Change the setting under Hidden files and folders to Show hidden files, folders, or drives
  • Click OK. (Remember to Hide files and folders once done)
Please go to one of the below sites to scan the following files:
jotti.org
Virus Total

click on Browse, and upload the following file for analysis:
c:\windows\maxdriver\ADFUUD.SYS
c:\windows\maxdriver\RDPCDD.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI