What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] https tidserv request 2

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi RP, looks like RPCDD.sys is the one. both sites identified it as infected. The other one is ok. Each of the AV scanners gave it a different name tho, "rootkit.patched.tdss!IK" or win32:alureon-FZ" or backdoor.tdss.2459 and others. Thanks, Michael.
Post #17 last edited
Michael,

Great, now we need to find a suitable replacment:

🖼Click to load external image (Posted Image) Double click on OTL to open it
  • When the window appears, click the "None" button in the upper left corner.
  • Under the Custom Scan box paste this in:
    /md5start
    RDPCDD.sys
    /md5stop
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open a notepad window. OTL.Txt. This is saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of that file and post them for me.
Post #18
OK here is the report:

OTL logfile created on: 4/15/2010 2:00:47 PM - Run 4
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\micheal\Desktop
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 56.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141.98 Gb Total Space | 17.90 Gb Free Space | 12.61% Space Free | Partition Type: NTFS
Drive D: | 7.07 Gb Total Space | 0.88 Gb Free Space | 12.48% Space Free | Partition Type: NTFS
Drive E: | 4.51 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TRADER
Current User Name: micheal
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\micheal\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe (Maxtor Corporation)
PRC - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()


========== Modules (SafeList) ==========

MOD - C:\Users\micheal\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MaxBackServiceInt) – File not found
SRV - (CLTNetCnService) – File not found
SRV - (N360) – C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
SRV - (Stereo Service) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://sfgate.com/"
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/04/15 13:55:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/14 14:04:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/10 18:39:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/12/19 18:33:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009/12/19 18:34:08 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Mozilla\Extensions
[2009/12/19 18:34:08 | 000,000,000 | —D | M] (No name found) – C:\Users\micheal\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/04/15 13:58:34 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions
[2009/07/20 17:59:06 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/22 16:46:47 | 000,000,000 | —D | M] (Free TV Bar Toolbar) – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions\{a0729639-d831-46c9-811b-9b0aa79fb45a}
[2009/08/25 16:01:36 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\extensions\[removed]
[2010/04/15 13:54:24 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/09/03 14:17:10 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/10/01 14:46:11 | 000,221,184 | —- | M] (CNN) – C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2010/04/14 13:35:24 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe (Maxtor Corporation)
O4 - HKLM..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe (OLYMPUS IMAGING CORP.)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKCU..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O4 - Startup: C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab (ijjiPlugin2 Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop BackupWallPaper: C:\Users\micheal\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/09/26 18:49:43 | 000,000,000 | —D | M] - E:\AutoRunData – [ CDFS ]
O32 - AutoRun File - [2006/09/01 10:27:06 | 000,090,112 | R— | M] () - E:\Autorun.exe – [ CDFS ]
O32 - AutoRun File - [2006/07/12 15:56:29 | 000,000,058 | R— | M] () - E:\Autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/04/14 17:58:46 | 000,220,024 | —- | C] (Sysinternals - www.sysinternals.com) – C:\Windows\sigcheck.exe
[2010/04/14 17:48:55 | 000,000,000 | —D | C] – C:\Windows\maxdriver
[2010/04/14 13:48:53 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/04/14 13:32:04 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Local\temp
[2010/04/14 12:56:37 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2010/04/13 13:01:28 | 000,000,000 | –SD | C] – C:\Users\micheal\Desktop\ComboFix
[2010/04/12 16:09:03 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/04/12 15:56:53 | 002,618,936 | —- | C] (Norman ASA) – C:\Users\micheal\Desktop\Norman_TDSS_Cleaner.exe
[2010/04/12 15:41:28 | 000,000,000 | —D | C] – C:\Config.Msi
[2010/04/12 11:43:18 | 000,561,664 | —- | C] (OldTimer Tools) – C:\Users\micheal\Desktop\OTL.exe
[2010/04/12 10:41:24 | 000,000,000 | —D | C] – C:\Program Files\TrendMicro
[2010/04/12 10:36:43 | 000,178,000 | —- | C] (Kaspersky Lab) – C:\Users\micheal\Desktop\TDSSKiller.exe
[2010/04/12 10:36:43 | 000,000,000 | —D | C] – C:\Users\micheal\Desktop\tdsskiller
[2010/04/11 00:14:26 | 000,000,000 | —D | C] – C:\MGlogs
[2010/04/10 23:08:05 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/04/10 23:08:05 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/04/10 23:08:05 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/04/10 23:08:05 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/04/10 23:07:54 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/04/10 23:04:54 | 000,000,000 | —D | C] – C:\Qoobox
[2010/04/10 22:22:24 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Roaming\Malwarebytes
[2010/04/10 22:21:51 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/04/10 22:21:46 | 000,020,824 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/04/10 22:21:46 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/04/10 22:21:45 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/10 20:11:54 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/04/10 20:11:39 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Roaming\SUPERAntiSpyware.com
[2010/04/10 20:11:39 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/04/10 20:03:53 | 000,000,000 | —D | C] – C:\Users\micheal\Desktop\malware scanners
[2010/04/10 18:44:36 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/04/10 18:41:45 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/04/10 18:41:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/04/07 18:03:59 | 000,000,000 | —D | C] – C:\Users\micheal\AppData\Local\ApplicationHistory
[2010/04/07 17:09:38 | 000,000,000 | —D | C] – C:\MGtools
[2010/04/05 18:55:44 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/04/05 16:27:42 | 000,000,000 | —D | C] – C:\Users\micheal\Desktop\oldpicscans
[2007/09/14 13:42:05 | 000,696,320 | —- | C] (Microsoft Corporation) – C:\Program Files\Common Files\sapi.dll

========== Files - Modified Within 14 Days ==========

[2010/04/15 13:59:51 | 003,670,016 | -HS- | M] () – C:\Users\micheal\NTUSER.DAT
[2010/04/15 13:55:27 | 000,033,069 | —- | M] () – C:\ProgramData\nvModes.dat
[2010/04/15 13:55:26 | 000,033,069 | —- | M] () – C:\ProgramData\nvModes.001
[2010/04/15 13:54:39 | 000,003,680 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/15 13:54:39 | 000,003,680 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/15 13:54:17 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/04/15 13:54:08 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/15 13:53:43 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/15 13:53:12 | 2146,820,096 | -HS- | M] () – C:\hiberfil.sys
[2010/04/15 10:11:05 | 004,022,443 | -H– | M] () – C:\Users\micheal\AppData\Local\IconCache.db
[2010/04/15 09:38:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/04/15 09:27:04 | 000,000,916 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000UA.job
[2010/04/14 17:41:29 | 001,138,992 | —- | M] () – C:\Users\micheal\Desktop\maxlook.exe
[2010/04/14 13:41:00 | 000,626,738 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/04/14 13:41:00 | 000,107,508 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/04/14 13:40:59 | 000,729,436 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/04/14 13:37:17 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/04/14 13:35:24 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/04/13 22:41:07 | 000,000,864 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3655264125-3525235294-3771617924-1000Core.job
[2010/04/13 13:08:48 | 315,629,674 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/04/13 12:51:35 | 003,914,375 | R— | M] () – C:\Users\micheal\Desktop\ComboFix.exe
[2010/04/12 21:27:55 | 000,071,680 | —- | M] () – C:\Users\micheal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/12 19:37:32 | 000,293,376 | —- | M] () – C:\Users\micheal\Desktop\t4684t12.exe
[2010/04/12 16:10:34 | 000,359,929 | —- | M] () – C:\Users\micheal\Desktop\dds.pif
[2010/04/12 16:09:10 | 000,000,919 | —- | M] () – C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/04/12 16:09:04 | 000,000,739 | —- | M] () – C:\Users\micheal\Desktop\NTREGOPT.lnk
[2010/04/12 16:09:04 | 000,000,720 | —- | M] () – C:\Users\micheal\Desktop\ERUNT.lnk
[2010/04/12 15:56:12 | 002,618,936 | —- | M] (Norman ASA) – C:\Users\micheal\Desktop\Norman_TDSS_Cleaner.exe
[2010/04/12 11:42:55 | 000,561,664 | —- | M] (OldTimer Tools) – C:\Users\micheal\Desktop\OTL.exe
[2010/04/12 10:41:24 | 000,001,950 | —- | M] () – C:\Users\micheal\Desktop\HiJackThis.lnk
[2010/04/11 00:35:23 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/04/11 00:13:53 | 000,214,821 | —- | M] () – C:\MGlogs.zip
[2010/04/10 22:21:57 | 000,000,824 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/10 22:10:21 | 000,016,384 | -H– | M] () – C:\ffastun.ffo
[2010/04/10 22:10:21 | 000,004,379 | -H– | M] () – C:\ffastun.ffa
[2010/04/10 22:10:20 | 000,540,672 | -H– | M] () – C:\ffastun0.ffx
[2010/04/10 22:10:20 | 000,081,920 | -H– | M] () – C:\ffastun.ffl
[2010/04/10 18:44:45 | 000,001,676 | —- | M] () – C:\Users\micheal\Desktop\CCleaner.lnk
[2010/04/07 17:06:34 | 002,388,895 | —- | M] () – C:\MGtools.exe
[2010/04/06 15:38:16 | 000,000,863 | —- | M] () – C:\Users\Public\Desktop\Trade Guider RT V4.lnk
[2010/04/06 12:43:52 | 000,307,200 | —- | M] () – C:\Users\micheal\Desktop\forex log.xls
[2010/04/05 19:15:26 | 000,000,000 | —- | M] () – C:\Users\micheal\.gtk-bookmarks

========== Files Created - No Company Name ==========

[2010/04/14 17:46:50 | 001,138,992 | —- | C] () – C:\Users\micheal\Desktop\maxlook.exe
[2010/04/13 18:45:46 | 2146,820,096 | -HS- | C] () – C:\hiberfil.sys
[2010/04/13 13:07:55 | 315,629,674 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/04/13 12:55:11 | 003,914,375 | R— | C] () – C:\Users\micheal\Desktop\ComboFix.exe
[2010/04/12 19:40:35 | 000,293,376 | —- | C] () – C:\Users\micheal\Desktop\t4684t12.exe
[2010/04/12 16:11:52 | 000,359,929 | —- | C] () – C:\Users\micheal\Desktop\dds.pif
[2010/04/12 16:09:10 | 000,000,919 | —- | C] () – C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/04/12 16:09:04 | 000,000,739 | —- | C] () – C:\Users\micheal\Desktop\NTREGOPT.lnk
[2010/04/12 16:09:04 | 000,000,720 | —- | C] () – C:\Users\micheal\Desktop\ERUNT.lnk
[2010/04/12 10:41:24 | 000,001,950 | —- | C] () – C:\Users\micheal\Desktop\HiJackThis.lnk
[2010/04/11 00:35:23 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/04/10 23:08:05 | 000,261,632 | —- | C] () – C:\Windows\PEV.exe
[2010/04/10 23:08:05 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/04/10 23:08:05 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/04/10 23:08:05 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/04/10 23:08:05 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/04/10 22:21:57 | 000,000,824 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/10 18:47:02 | 000,001,098 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Compaq Connections.lnk
[2010/04/10 18:47:02 | 000,000,931 | —- | C] () – C:\Users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
[2010/04/10 18:44:45 | 000,001,676 | —- | C] () – C:\Users\micheal\Desktop\CCleaner.lnk
[2010/04/07 17:10:01 | 000,214,821 | —- | C] () – C:\MGlogs.zip
[2010/04/07 17:07:35 | 002,388,895 | —- | C] () – C:\MGtools.exe
[2010/02/21 23:50:48 | 000,139,152 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2010/02/21 23:50:47 | 000,139,152 | —- | C] () – C:\Users\micheal\AppData\Roaming\PnkBstrK.sys
[2010/02/21 17:50:16 | 000,033,069 | —- | C] () – C:\ProgramData\nvModes.001
[2010/02/21 17:50:15 | 000,033,069 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/02/21 17:40:36 | 000,389,120 | —- | C] () – C:\Windows\System32\HookShield.dll
[2010/02/21 17:40:35 | 000,134,504 | —- | C] () – C:\Windows\System32\smdll.dll
[2010/02/21 17:40:35 | 000,036,200 | —- | C] () – C:\Windows\System32\Auxiliary.dll
[2010/02/21 17:40:31 | 000,225,280 | —- | C] () – C:\Windows\System32\HookMap.dll
[2010/02/21 17:34:11 | 000,001,356 | —- | C] () – C:\Users\micheal\AppData\Local\d3d9caps.dat
[2010/02/10 18:46:41 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2010/02/09 18:17:46 | 000,000,794 | —- | C] () – C:\Users\micheal\Desktopqmd.lnk
[2010/01/01 15:32:09 | 000,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2009/12/20 15:08:21 | 000,000,218 | —- | C] () – C:\Users\micheal\.recently-used.xbel
[2009/12/09 07:24:54 | 000,098,304 | —- | C] () – C:\Windows\System32\NtDirect.dll
[2009/10/19 18:19:03 | 000,000,121 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2009/10/16 16:39:25 | 000,000,040 | -HS- | C] () – C:\ProgramData\.zreglib
[2009/09/28 14:50:05 | 000,116,224 | —- | C] () – C:\Windows\System32\UnzDll.dll
[2009/09/28 14:50:04 | 000,017,920 | —- | C] () – C:\Windows\System32\IMPLODE.DLL
[2009/09/26 23:00:41 | 000,413,696 | —- | C] () – C:\Windows\System32\MetaLib.dll
[2009/08/03 01:21:54 | 000,197,912 | —- | C] () – C:\Windows\System32\physxcudart_20.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2009/08/03 01:21:54 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2009/08/03 01:21:52 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2009/08/03 01:21:52 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2009/02/26 12:03:30 | 000,060,744 | —- | C] () – C:\Users\micheal\g2mdlhlpx.exe
[2009/02/07 02:30:54 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/08/26 13:35:03 | 000,004,556 | —- | C] () – C:\Windows\WinSig.ini
[2008/08/26 13:35:03 | 000,000,253 | —- | C] () – C:\Windows\WINROS.INI
[2008/08/26 13:35:03 | 000,000,070 | —- | C] () – C:\Windows\reader.ini
[2008/07/23 14:14:34 | 000,605,763 | —- | C] () – C:\Users\micheal\.fonts.cache-1
[2008/03/25 09:56:08 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1461.dll
[2008/01/02 17:57:36 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2007/11/02 07:09:50 | 000,000,000 | —- | C] () – C:\Users\micheal\AppData\Roaming\wklnhst.dat
[2007/11/02 06:55:07 | 000,000,000 | —- | C] () – C:\Users\micheal\.gtk-bookmarks
[2007/09/14 13:42:05 | 000,282,687 | —- | C] () – C:\Windows\System32\CyberFax.dll
[2007/09/14 13:42:05 | 000,254,053 | —- | C] () – C:\Windows\System32\AtlTapiGetID.dll
[2007/09/14 12:11:46 | 000,071,680 | —- | C] () – C:\Users\micheal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/07 12:02:24 | 000,000,810 | —- | C] () – C:\Windows\Rtcw.INI
[2007/08/24 04:46:48 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2007/06/10 14:08:14 | 000,000,416 | —- | C] () – C:\Windows\MAXLINK.INI
[2007/06/09 19:20:58 | 000,000,020 | -HS- | C] () – C:\Users\micheal\ntuser.ini
[2007/06/09 19:20:57 | 003,670,016 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT
[2007/06/09 19:20:57 | 000,524,288 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000002.regtrans-ms
[2007/06/09 19:20:57 | 000,524,288 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2007/06/09 19:20:57 | 000,262,144 | -H– | C] () – C:\Users\micheal\ntuser.dat.LOG1
[2007/06/09 19:20:57 | 000,065,536 | -HS- | C] () – C:\Users\micheal\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2007/06/09 19:20:57 | 000,000,000 | -H– | C] () – C:\Users\micheal\ntuser.dat.LOG2
[2007/03/27 11:58:19 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom24.dll
[2007/03/27 11:58:19 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes24.dll
[2007/03/27 11:49:46 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1132.dll
[2007/03/06 12:49:42 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1227.dll
[2007/01/10 04:56:34 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 00:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/08/10 23:00:40 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/08/10 23:00:40 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
[2004/09/16 13:26:40 | 000,012,634 | —- | C] () – C:\Windows\System32\drivers\ADFUUD.SYS
[2004/09/16 13:26:40 | 000,012,634 | —- | C] () – C:\Windows\ADFUUD.SYS
[2003/07/25 00:23:32 | 001,000,583 | —- | C] () – C:\Windows\System32\gnet-1.1.dll
[2002/12/12 22:24:04 | 000,653,824 | —- | C] () – C:\Windows\System32\libxml2.dll
[1996/12/03 16:00:00 | 000,022,016 | —- | C] () – C:\Windows\System32\DOCOBJ.DLL
[1996/12/03 16:00:00 | 000,012,288 | —- | C] () – C:\Windows\System32\HLINKPRX.DLL

========== LOP Check ==========

[2008/10/10 12:02:52 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Canon
[2008/04/25 13:20:45 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2009/06/26 10:43:54 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\counters
[2009/06/26 10:45:37 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\eSignal
[2009/11/26 12:40:09 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\FileZilla
[2010/03/05 13:58:16 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\GrabIt
[2009/12/20 14:31:03 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\gtk-2.0
[2007/08/12 17:43:08 | 000,000,000 | -H-D | M] – C:\Users\micheal\AppData\Roaming\ijjigame
[2009/11/05 18:26:38 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\KompoZer
[2010/02/26 13:35:41 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\NewzToolz-EZ
[2009/11/14 19:39:42 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Red Alert 3
[2007/06/10 14:07:59 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\ScanSoft
[2007/11/02 07:09:48 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Template
[2009/12/19 18:34:01 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Thunderbird
[2008/05/20 23:47:45 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Trading Rooms
[2007/09/14 14:45:34 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\Video DVD Maker FREE
[2008/09/29 16:04:54 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\VirtuaWin
[2007/06/10 20:19:26 | 000,000,000 | —D | M] – C:\Users\micheal\AppData\Roaming\WinBatch
[2010/04/15 10:11:26 | 000,032,560 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========



< MD5 for: RDPCDD.SYS >
[2006/11/02 02:02:01 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=794585276B5D7FCA9F3FC15543F9F0B9 – C:\Windows\System32\drivers\RDPCDD.sys
[2006/11/02 02:02:01 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=794585276B5D7FCA9F3FC15543F9F0B9 – C:\Windows\winsxs\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6000.16386_none_d2a4621f4153e710\RDPCDD.sys
[2008/01/18 23:01:08 | 000,006,144 | —- | M] (Microsoft Corporation) MD5=89E59BE9A564262A3FB6C4F4F1CD9899 – C:\Windows\SoftwareDistribution\Download\848c23cf13d83b3e0a6f1da97f3af588\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6001.18000_none_d4db241b3e3ef7e4\RDPCDD.sys
[2006/11/02 02:02:01 | 000,006,144 | —- | M] () MD5=CE8191374FB1B4BAB081A602D50C0741 – C:\Windows\maxdriver\RDPCDD.sys
< End of report >
Post #19
Michael,

We need to rename a file, then use the Recovery Environment to replace that infected driver. Please review the instructions carefully:

Open an elevated command window:
  • Click Start and type cmd in Start Search.
  • When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.
Copy the contents of the following code box then right click in the command window, select paste and press "Enter"

copy C:\Windows\SoftwareDistribution\Download\848c23cf13d83b3e0a6f1da97f3af588\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6001.18000_none_d4db241b3e3ef7e4\RDPCDD.sys c:\

You should see "1 file copied on the screen"

Type exit to close the command window.

(if you do not see 1 file copied, do not continue, but instead post back and let me know.)

Print out these instructions to use while in the Recovery Environment:

1. Restart your computer tapping the f8 key while it boots.
2. Select Repair your computer from the list of startup options.

If Repair your computer is not an option on the Advanced Startup menu, insert your Windows Vista DVD and restart the computer, then when prompted, select Repair your computer

3. Select your keyboard layout.
4. Enter your username and password (if you use one).
5. The System Recovery Options Menu should come up.
6. Select Command Prompt from the menu

This should open a x:\sources> prompt. This may vary depending on how you entered the Recovery Environment.

7. At the x:\sources> prompt, type the following bold entries, one at a time and press 'Enter' after each line. (refer to the quote box under the commands for the location of the spaces which are very important):

ren c:\windows\system32\drivers\RDPCDD.sys RDPCDD.old
copy c:\RDPCDD.sys c:\windows\system32\drivers\RDPCDD.sys
exit

renc:\windows\system32\drivers\RDPCDD.sysRDPCDD.old
copyc:\RDPCDD.sysc:\windows\system32\drivers\RDPCDD.sys
exit


You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.

If you do not see 1 file copied on the screen, even after ensuring the commands are correct, rename the file back to it's original name by typing the following command then hitting Enter.
ren RDPCDD.old RDPCDD.sys

renRDPCDD.oldRDPCDD.sys


8. Reboot normally

Press Start > Run or Windows Key + R then copy and paste the following command into the run box that opens and press "Enter"
cmd /c mbr -t>"%userprofile%\Desktop\mbr.txt"

That will place a file called MBR.txt on your desktop. Please copy and paste the contents of that file into your next post.
Post #20
Ok, done. looks like it had a bit of trouble with the MBR tho….

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

Thanks, Mike.
Post #21
RP, I don't want to jump the gun here… BUT I think it might be fixed now!! :thumbup: No redirects and no complaints from Norton at all about the TIDserv request for about an hour so far. Lets see! Thanks, Michael.
Post #22
Michael,

That's good news! Please run these for me now so I can be sure I have it all:

🖼Click to load external image (Posted Image) Run ComboFix

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts. If it wants to update, please allow it to.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Post #23
OK, looks like the Kaspersky scan caught some things the others missed…

Here are the reports:

ComboFix 10-04-15.05 - micheal 04/16/2010 9:04.4.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2047.1341 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton Security Suite *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Security Suite *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-03-16 to 2010-04-16 )))))))))))))))))))))))))))))))
.

2010-04-16 16:14 . 2010-04-16 16:14 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-04-16 16:14 . 2010-04-16 16:14 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-04-16 16:01 . 2010-04-16 16:01 ——– d—–w- C:\32788R22FWJFW
2010-04-16 07:31 . 2010-03-11 10:39 1647984 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\NAVEX32A.DLL
2010-04-16 07:31 . 2010-03-11 10:39 84912 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\NAVENG.SYS
2010-04-16 07:31 . 2010-03-11 10:39 177520 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\NAVENG32.DLL
2010-04-16 07:31 . 2010-03-11 10:39 1324720 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\NAVEX15.SYS
2010-04-16 07:31 . 2010-03-11 10:39 371248 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\EECTRL.SYS
2010-04-16 07:31 . 2010-03-11 10:39 2747440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\CCERASER.DLL
2010-04-16 07:31 . 2010-03-11 10:39 259440 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\ECMSVR32.DLL
2010-04-16 07:31 . 2010-03-11 10:39 102448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100415.036\ERASER.SYS
2010-04-16 06:21 . 2010-02-13 01:41 558448 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-04-16 06:20 . 2010-02-02 03:20 165240 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-04-16 03:45 . 2008-01-19 06:01 6144 —-a-w- c:\windows\system32\RDPCDD.sys
2010-04-16 02:41 . 2008-01-19 06:01 6144 —-a-w- C:\RDPCDD.sys
2010-04-15 00:58 . 2010-02-27 00:26 220024 —-a-w- c:\windows\sigcheck.exe
2010-04-15 00:48 . 2010-04-15 00:57 ——– d—–w- c:\windows\maxdriver
2010-04-14 20:32 . 2010-04-16 16:14 ——– d—–w- c:\users\micheal\AppData\Local\temp
2010-04-12 23:09 . 2010-04-12 23:09 ——– d—–w- c:\program files\ERUNT
2010-04-12 19:22 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSvix86.sys
2010-04-12 19:22 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\Scxpx86.dll
2010-04-12 19:22 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSxpx86.dll
2010-04-12 19:22 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSXpx86.sys
2010-04-12 19:22 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100409.001\IDSviA64.sys
2010-04-12 17:41 . 2010-04-12 17:41 388096 —-a-r- c:\users\micheal\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-12 17:41 . 2010-04-12 17:41 ——– d—–w- c:\program files\TrendMicro
2010-04-11 07:14 . 2010-04-11 07:14 ——– d—–w- C:\MGlogs
2010-04-11 05:22 . 2010-04-11 05:22 ——– d—–w- c:\users\micheal\AppData\Roaming\Malwarebytes
2010-04-11 05:21 . 2010-03-29 22:24 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-11 05:21 . 2010-04-11 05:21 ——– d—–w- c:\programdata\Malwarebytes
2010-04-11 05:21 . 2010-03-29 22:24 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-11 05:21 . 2010-04-11 05:22 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-11 03:12 . 2010-04-11 03:12 52224 —-a-w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-11 03:12 . 2010-04-11 03:12 117760 —-a-w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-11 03:11 . 2010-04-11 03:11 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2010-04-11 03:11 . 2010-04-12 22:41 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-11 03:11 . 2010-04-11 03:11 ——– d—–w- c:\users\micheal\AppData\Roaming\SUPERAntiSpyware.com
2010-04-11 01:44 . 2010-04-11 01:44 ——– d—–w- c:\program files\CCleaner
2010-04-11 01:41 . 2010-04-11 01:41 ——– d—–w- c:\program files\Common Files\Java
2010-04-11 01:39 . 2010-04-11 01:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-04-08 01:03 . 2010-04-08 01:03 ——– d—–w- c:\users\micheal\AppData\Local\ApplicationHistory
2010-04-08 00:10 . 2010-04-11 07:13 214821 —-a-w- C:\MGlogs.zip
2010-04-08 00:09 . 2010-04-11 07:13 ——– d—–w- C:\MGtools
2010-04-08 00:07 . 2010-04-08 00:06 2388895 —-a-w- C:\MGtools.exe
2010-04-06 01:55 . 2010-04-06 01:55 ——– d—–w- c:\windows\Sun
2010-04-06 01:01 . 2009-10-28 22:37 811896 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\Scxpx86.dll
2010-04-06 01:01 . 2009-10-28 22:37 343088 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSvix86.sys
2010-04-06 01:01 . 2009-10-28 22:37 488312 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSxpx86.dll
2010-04-06 01:01 . 2009-10-28 22:37 466992 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSviA64.sys
2010-04-06 01:01 . 2009-10-28 22:37 329592 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSXpx86.sys
2010-03-27 03:12 . 2010-03-27 03:12 ——– d—–w- c:\programdata\WindowsSearch

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 06:42 . 2010-02-22 00:50 33069 —-a-w- c:\programdata\nvModes.dat
2010-04-16 06:21 . 2010-02-22 00:45 ——– d—–w- c:\programdata\NVIDIA
2010-04-16 06:19 . 2007-09-01 07:19 ——– d—–w- c:\program files\Google
2010-04-12 22:41 . 2010-02-22 00:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-04-12 20:09 . 2008-02-14 19:24 21560 ——w- c:\windows\system32\drivers\atapi.sys
2010-04-11 01:39 . 2007-06-11 22:30 ——– d—–w- c:\program files\Java
2010-04-06 22:38 . 2010-02-06 21:39 ——– d—–w- c:\program files\Trade Guider RT V4
2010-04-04 03:55 . 2007-06-18 21:04 ——– d—–w- c:\users\micheal\AppData\Roaming\OpenOffice.org2
2010-03-12 03:39 . 2007-03-27 19:50 ——– d—–w- c:\programdata\Symantec
2010-03-11 21:54 . 2007-03-27 19:50 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-03-11 21:39 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-03-11 21:34 . 2010-03-11 21:31 ——– d—–w- c:\programdata\Norton
2010-03-11 21:34 . 2007-09-14 19:08 ——– d—–w- c:\program files\Movie Maker 2.6
2010-03-11 21:32 . 2010-03-11 21:32 ——– d—–w- c:\program files\Symantec
2010-03-11 21:32 . 2010-03-11 21:32 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-03-11 21:32 . 2010-03-11 21:32 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-03-11 21:32 . 2010-03-11 21:32 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-03-11 21:31 . 2010-03-11 21:33 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-11 21:31 . 2010-03-11 21:33 25648 —-a-r- c:\windows\system32\drivers\SymIMV.sys
2010-03-11 21:31 . 2010-03-11 21:31 1291104 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2010-03-11 21:31 . 2010-03-11 21:31 136840 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2010-03-11 21:31 . 2010-03-11 21:33 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2010-03-11 21:31 . 2010-03-11 21:31 776952 —-a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2010-03-11 21:31 . 2010-03-11 21:31 ——– d—–w- c:\program files\Norton Security Suite
2010-03-11 21:30 . 2010-03-11 21:30 ——– d—–w- c:\programdata\NortonInstaller
2010-03-11 21:30 . 2010-03-11 21:30 ——– d—–w- c:\program files\NortonInstaller
2010-03-11 20:59 . 2007-06-10 02:55 ——– d—–w- c:\programdata\McAfee
2010-03-09 16:54 . 2010-03-31 04:23 832512 —-a-w- c:\windows\system32\wininet.dll
2010-03-09 16:50 . 2010-03-31 04:23 56320 —-a-w- c:\windows\system32\iesetup.dll
2010-03-09 16:50 . 2010-03-31 04:23 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-09 16:50 . 2010-03-31 04:23 52736 —-a-w- c:\windows\AppPatch\iebrshim.dll
2010-03-09 16:48 . 2010-03-31 04:23 72704 —-a-w- c:\windows\system32\admparse.dll
2010-03-09 14:17 . 2010-03-31 04:23 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2010-03-09 12:43 . 2010-03-31 04:23 48128 —-a-w- c:\windows\system32\mshtmler.dll
2010-03-07 00:07 . 2009-02-07 09:29 ——– d—–w- c:\users\micheal\AppData\Roaming\Skype
2010-03-07 00:06 . 2007-06-10 02:29 89032 —-a-w- c:\users\micheal\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-05 22:07 . 2009-06-26 17:43 ——– d—–w- c:\programdata\performance
2010-03-05 20:58 . 2009-12-20 01:41 ——– d—–w- c:\users\micheal\AppData\Roaming\GrabIt
2010-02-26 20:52 . 2010-02-26 20:51 ——– d—–w- c:\program files\iTunes
2010-02-26 20:51 . 2010-02-26 20:51 ——– d—–w- c:\program files\iPod
2010-02-26 20:51 . 2007-07-20 02:59 ——– d—–w- c:\program files\Common Files\Apple
2010-02-26 20:43 . 2010-02-26 20:43 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-26 20:35 . 2009-08-22 19:46 ——– d—–w- c:\users\micheal\AppData\Roaming\NewzToolz-EZ
2010-02-24 17:16 . 2010-02-22 10:10 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\users\micheal\AppData\Roaming\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 139152 —-a-w- c:\users\micheal\AppData\Roaming\PnkBstrK.sys
2010-02-22 06:50 . 2010-02-22 06:50 111928 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-02-22 06:50 . 2010-02-22 06:50 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2010-02-22 06:50 . 2010-02-22 06:50 794408 —-a-w- c:\windows\system32\pbsvc.exe
2010-02-22 06:50 . 2007-03-27 19:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-22 06:11 . 2010-01-23 02:40 ——– d—–w- c:\program files\Activision
2010-02-22 00:47 . 2010-02-22 00:34 1356 —-a-w- c:\users\micheal\AppData\Local\d3d9caps.dat
2010-02-22 00:44 . 2010-02-22 00:44 ——– d—–w- c:\program files\NVIDIA Corporation
2010-02-22 00:44 . 2010-02-22 00:44 ——– d—–w- c:\program files\AGEIA Technologies
2010-02-19 23:47 . 2010-02-19 23:47 3604480 —-a-w- c:\windows\system32\GPhotos.scr
2010-02-16 08:38 . 2010-02-09 18:38 ——– d—–w- c:\program files\EOD Downloader
2010-01-25 12:58 . 2010-02-24 11:45 473088 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:58 . 2010-02-24 11:45 154624 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:58 . 2010-02-24 11:45 154112 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:58 . 2010-02-24 11:45 472576 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 12:56 . 2010-02-24 11:45 312320 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:36 . 2010-02-24 11:45 435712 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:36 . 2010-02-24 11:45 515584 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:36 . 2010-02-24 11:45 431104 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:35 . 2010-02-24 11:45 523776 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-23 08:05 . 2010-02-24 11:47 2048 —-a-w- c:\windows\system32\tzres.dll
2001-07-24 00:09 . 2007-09-14 20:42 696320 —-a-w- c:\program files\Common Files\sapi.dll
2007-06-28 21:01 . 2007-06-28 21:01 22 –sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-05-16 95536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-06-10 1006264]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-01 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-01 133656]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2008-05-16 54576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2006-11-20 155648]
"MaxtorOneTouch"="c:\program files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-24 44136]

c:\users\micheal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-3 111376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2010-03-11 259632]
S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2010-03-11 482432]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100409.001\IDSvix86.sys [2009-10-28 343088]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-03-11 102448]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
.
——- Supplementary Scan ——-
.
IE: Add to AMV Convert Tool… - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Media Manager… - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\users\micheal\AppData\Roaming\Mozilla\Firefox\Profiles\3rw8dwwn.default\
FF - prefs.js: browser.startup.homepage - hxxp://sfgate.com/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-16 09:14
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3655264125-3525235294-3771617924-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:de,b4,e8,31,28,58,bb,6d,d1,44,85,85,7f,72,60,d2,35,cc,59,5b,6a,ad,2e,
92,c0,32,2d,77,4f,41,73,83,b2,65,b5,dd,6f,8a,55,83,74,f5,35,29,e8,ae,be,1a,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-3655264125-3525235294-3771617924-1000\Software\SecuROM\License information*]
"datasecu"=hex:f0,08,b2,91,3a,69,1d,b9,8c,73,1e,bb,c9,08,ab,bf,8f,b4,84,5f,2c,
1a,43,a4,87,35,71,5c,3f,6b,d1,f1,1c,d6,99,75,3d,45,3d,04,bb,16,dd,07,64,eb,\
"rkeysecu"=hex:71,8d,fd,90,a1,c1,52,00,47,2a,4b,c0,49,a3,a2,b2

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(1164)
c:\windows\System32\netshell.dll
c:\windows\system32\pnidui.dll
.
Completion time: 2010-04-16 09:20:40
ComboFix-quarantined-files.txt 2010-04-16 16:20
ComboFix2.txt 2010-04-14 20:50
ComboFix3.txt 2010-04-11 06:30

Pre-Run: 19,250,716,672 bytes free
Post-Run: 19,327,840,256 bytes free

- - End Of File - - F487565CEBEFFE01F27138FA5DE33453

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3997

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

4/16/2010 9:33:52 AM
mbam-log-2010-04-16 (09-33-52).txt

Scan type: Quick scan
Objects scanned: 108862
Time elapsed: 5 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, April 16, 2010
Operating system: Microsoft Windows Vista Home Basic Edition, 32-bit (build 6000)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, April 16, 2010 15:43:01
Records in database: 3949583
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 233031
Threats found: 3
Infected objects found: 6
Suspicious objects found: 0
Scan duration: 04:07:27


File name / Threat / Threats count
C:\MGtools.exe Infected: Trojan-Dropper.Win32.Agent.bvop 1
C:\Program Files\Trade Guider RT V4\primateremoteassistance.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c 1
C:\Users\micheal\Downloads\MGtools.exe Infected: Trojan-Dropper.Win32.Agent.bvop 1
C:\Windows\maxdriver\RDPCDD.sys Infected: Rootkit.Win32.TDSS.ap 1
C:\Windows\System32\drivers\RDPCDD.old Infected: Rootkit.Win32.TDSS.ap 1
C:\Windows\winsxs\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6000.16386_none_d2a4621f4153e710\RDPCDD.sys Infected: Rootkit.Win32.TDSS.ap 1

Selected area has been scanned.


MGtools was downloaded a few days ago to get rid of the first virus!!

Thanks for the help with this, have a great weekend!
Post #24
Michael,

Everything looks good - the MGTools detection is a false positive, but you can remove it if your done with it. I have some important cleanup and housekeeping for you to take care of now:

🖼Click to load external image (Posted Image) Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Files
C:\Windows\System32\drivers\RDPCDD.old
C:\Windows\winsxs\x86_microsoft-windows-t..niportdisplaydriver_31bf3856ad364e35_6.0.6000.16386_none_d2a4621f4153e710\RDPCDD.sys

:Commands
[EmptyTemp]
[EmptyFlash]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, it will reboot when it is done and produce a log
🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 20. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
🖼Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

🖼Click to load external image (Posted Image) Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens:
    Combofix /Uninstall
🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Go to Start > Run and copy/paste the following command into the Run box and click OK:
maxlook -cleanup

🖼Click to load external image (Posted Image) Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
  • Manually delete any remaining logs or tools.
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Consider running in a limited user account. See this post for more information.
  • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #25
RP, Thank you very much for taking the time to help me clean up my computer :thumbup: I was almost going to by a new one!!! I have had a virus or 2 over the years ( I have been using or servicing computers since 1984… ) and they were usually pretty easy to cleanup. Now with firewalls, security suites etc I thought I would be pretty safe. This bit of malware was tough though!!! All of my virus scanners didn't even see it!! ( this still confuses me, why Norton couldn't clean or protect me from this???) I think I got this nasty bit of code from a freeware screen capture utility, seemed pretty reputable, straight from a google search, not from a newsgroup or a torrent or anything. Anyway a lesson learned. Thanks again!! Michael.
Post #26
You're welcome Michael. The infection you had was very new, I don't think any AV would have detected it. Thanks for your patience. Take care!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI