Spyware / Malware / Virus Removal

z0g7ya1i0.com infection with redirection

16 min read

Looking for the outcome? Ask AI

miguelsal Topic Starter

Post #1June 12, 2010, 11:04 PM UTC

I have running Webroot spy swepper and Avast antivrus. I got infected with Anticirus Soft and was able to remove it. I then ran the antivirus, spy swepper and malware bytes on the machine and cleaned it out. I also removed the entries ins Appdata/local from the computer. Whenever I reboot I know get Spy Swepper come uo with a block that something is trying to access z0g7ya1i0.com. I also get redirects from google searches. Please help. I have pasted the results of DDS.txt. Regards, Miguel DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 15:41:59.69 on Sat 06/12/2010 Internet Explorer: 8.0.6001.18904 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3071.1914 [GMT -7:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\SYSTEM32\WISPTIS.EXE C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe g:\Program Files\Alwil Software\Avast4\aswUpdSv.exe g:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\SYSTEM32\WISPTIS.EXE C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\Explorer.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe G:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe G:\Program Files\CyberLink\PCM4Everio\EverioService.exe G:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe G:\Program Files\X-Rite\ColorMunki Photo\Tools\ColorMunki Photo Tray.exe C:\Program Files\Hotspot Shield\bin\openvpnas.exe g:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\system32\IoctlSvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\CyberLink\Shared Files\RichVideo.exe g:\Program Files\Photodex\ProShowGold\ScsiAccess.exe C:\Windows\System32\SonyIEx.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\Wacom_Tablet.exe C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\Windows\system32\WTablet\Wacom_TabletUser.exe C:\Windows\system32\Wacom_Tablet.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Program Files\X-Rite\Devices\Services\xritedeviced.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe g:\Program Files\Alwil Software\Avast4\ashMaiSv.exe g:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\wbem\unsecapp.exe g:\Program Files\Hotspot Shield\bin\openvpntray.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\Dwm.exe C:\Program Files\Webroot\WebrootSecurity\SSU.EXE C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\Miguel\Desktop\dds.scr ============== Pseudo HJT Report =============== uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe" uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" mRun: [MSWheel] mRun: [Adobe Reader Speed Launcher] "g:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [WD Drive Manager] "c:\program files\western digital\wd drive manager\WDBtnMgrUI.exe" mRun: [Adobe Acrobat Speed Launcher] "g:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "g:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe" mRun: [EverioService] "g:\program files\cyberlink\pcm4everio\EverioService.exe" mRun: [avast!] "g:\progra~1\alwils~1\avast4\ashDisp.exe" mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe" mRun: [SwitchBoard] "c:\program files\common files\adobe\switchboard\SwitchBoard.exe" mRun: [SpySweeper] "c:\program files\webroot\webrootsecurity\SpySweeperUI.exe" /startintray dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\colorm~1.lnk - g:\program files\x-rite\colormunki photo\gamma\CalibrationLoader.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\colorm~2.lnk - g:\program files\x-rite\colormunki photo\tools\ColorMunki Photo Tray.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: E&xport to Microsoft Excel - g:\progra~1\micros~1\office11\EXCEL.EXE/3000 IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~1\office11\REFIEBAR.DLL ============= SERVICES / DRIVERS =============== R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-11-13 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-11-13 20560] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-11-13 53328] R2 ColorMunkiService;X-Rite Device ColorMunki;c:\program files\x-rite\devices\services\colormunki\ColorMunkiDeviceService.exe [2009-8-10 148992] R2 HssSrv;Hotspot Shield Routing Service;g:\program files\hotspot shield\hsswpr\hsssrv.exe [2009-8-6 331824] R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [2009-2-21 176128] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-7-19 3406120] R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\western digital\wd drive manager\WDBtnMgrSvc.exe [2008-7-24 102400] R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-4-9 1201640] R2 xritedeviced;X-Rite Device Manager;c:\program files\x-rite\devices\services\xritedeviced.exe [2009-8-9 126976] R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392] R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [2009-9-15 37376] R3 taphss;Anchorfree HSS Adapter;c:\windows\system32\drivers\taphss.sys [2009-9-15 32768] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-7-19 15656] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvscpapisvr.exe –> c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [?] S3 colormunki;colormunki;c:\windows\system32\drivers\colormunki.sys [2009-2-20 29184] S3 epppdt;EPSON 1394.3 Class;c:\windows\system32\drivers\epppdt.sys [2008-7-19 31269] S3 epppdtpr;EPSON 1394.3 Printer Class;c:\windows\system32\drivers\epppdtpr.sys [2008-7-19 14457] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-7-19 21504] S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-12-14 30192] S3 HssTrayService;Hotspot Shield Tray Service;g:\program files\hotspot shield\bin\HssTrayService.exe [2009-8-10 57640] S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] S3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [2009-7-22 28592] S3 X-Rite;X-Rite USB Service;c:\windows\system32\drivers\XrUsb.sys [2008-7-19 18168] =============== Created Last 30 ================ 2010-06-09 01:15 –d—– c:\programdata\Office Genuine Advantage 2010-06-01 23:08 360 a——- c:\windows\system32\drivers\kgpfr2.cfg 2010-06-01 23:08 14,744 a——- c:\windows\system32\drivers\kgpcpy.cfg 2010-06-01 22:49 151,552 a—h— C:\SZKGFS.dat 2010-06-01 22:48 –d—– c:\programdata\SITEguard 2010-06-01 22:48 –d—– c:\progra~2\SITEguard 2010-06-01 22:47 –d—– c:\program files\common files\iS3 2010-06-01 22:47 –d—– c:\programdata\STOPzilla! 2010-06-01 22:47 –d—– c:\progra~2\STOPzilla! 2010-05-26 07:13 2,048 a——- c:\windows\system32\tzres.dll 2010-05-19 10:36 –d—– c:\programdata\GoodSync 2010-05-19 10:36 –d—– c:\progra~2\GoodSync 2010-05-15 22:46 –d—– c:\programdata\regid.1986-12.com.adobe 2010-05-15 22:46 –d—– c:\progra~2\regid.1986-12.com.adobe 2010-05-15 22:09 –d—– c:\program files\common files\Akamai 2010-05-15 11:54 738,816 a——- c:\windows\system32\inetcomm.dll ==================== Find3M ==================== 2010-06-12 15:17 135,626 a——- c:\programdata\nvModes.dat 2010-06-12 15:17 135,626 a——- c:\progra~2\nvModes.dat 2010-06-12 15:16 7,304 a——- c:\windows\TMP0001.TMP 2010-05-25 21:29 323,584 a——- c:\windows\system32\AUDIOGENIE2.DLL 2010-05-15 22:48 91,128 a——- c:\windows\system32\GDIPFONTCACHEV1.DAT 2010-05-12 11:21 221,568 ——– c:\windows\system32\MpSigStub.exe 2010-05-06 10:49 20 —-h— c:\programdata\PKP_DLbz.DAT 2010-05-06 10:49 20 —-h— c:\progra~2\PKP_DLbz.DAT 2010-04-29 15:39 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 15:39 20,952 a——- c:\windows\system32\drivers\mbam.sys 2009-12-09 21:14 143,360 a——- c:\windows\inf\infstrng.dat 2009-12-09 21:14 86,016 a——- c:\windows\inf\infstor.dat 2009-12-09 21:14 51,200 a——- c:\windows\inf\infpub.dat 2009-11-13 10:54 665,600 a——- c:\windows\inf\drvindex.dat 2008-07-19 09:32 33,600 a——- c:\windows\inf\drivers\XrUsb64.sys 2008-07-19 09:32 18,168 a——- c:\windows\inf\drivers\XrUsb.sys 2008-07-19 02:27 174 a–sh— c:\program files\desktop.ini 2007-01-11 14:36 33,600 a——- c:\windows\inf\xrusb\XrUsb64.sys 2007-01-11 14:36 18,168 a——- c:\windows\inf\xrusb\XrUsb.sys 2006-11-02 05:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 05:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 05:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 05:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 02:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 02:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 02:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 02:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2009-10-15 11:47 16,384 a–sh— c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-10-15 11:47 32,768 a–sh— c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-10-15 11:47 16,384 a–sh— c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat 2009-10-15 11:47 245,760 a–sh— c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat ============= FINISH: 15:42:44.10 ===============

CatByte

Post #2June 13, 2010, 12:11 PM UTC

Hi,

Please run the following:

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

miguelsal

Post #3June 13, 2010, 8:09 PM UTC

I downloaded and ran gmer.exe. Here is the logfile.

Regards,

Miguel

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-13 13:09:39
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Miguel\AppData\Local\Temp\uwriapog.sys

—- System - GMER 1.0.15 —-

SSDT 84FC1E40 ZwAllocateVirtualMemory
SSDT 85D22298 ZwCreateProcess
SSDT 84F6C020 ZwCreateProcessEx
SSDT 84FBC188 ZwCreateThread
SSDT 84FC1EB8 ZwQueueApcThread
SSDT 84FC1D50 ZwReadVirtualMemory
SSDT 84FC1FA8 ZwSetContextThread
SSDT 84FB24F0 ZwSetInformationProcess
SSDT 84FC1020 ZwSetInformationThread
SSDT 85D9F188 ZwSuspendProcess
SSDT 84FC1F30 ZwSuspendThread
SSDT 85D228D0 ZwTerminateProcess
SSDT 84FC0510 ZwTerminateThread
SSDT 84FC1DC8 ZwWriteVirtualMemory
SSDT 84FC1C60 ZwCreateThreadEx
SSDT 84FC1CD8 ZwCreateUserProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 131 826F2894 4 Bytes [40, 1E, FC, 84]
.text ntkrnlpa.exe!KeSetEvent + 209 826F296C 8 Bytes [98, 22, D2, 85, 20, C0, F6, …] {CWDE ; AND DL, DL; TEST [EAX], ESP; SAL DH, 0x84}
.text ntkrnlpa.exe!KeSetEvent + 221 826F2984 4 Bytes [88, C1, FB, 84]
.text ntkrnlpa.exe!KeSetEvent + 4E5 826F2C48 4 Bytes [B8, 1E, FC, 84]
.text ntkrnlpa.exe!KeSetEvent + 4FD 826F2C60 4 Bytes [50, 1D, FC, 84]
.text …

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\Explorer.EXE[1568] ntdll.dll!NtProtectVirtualMemory 77014D34 5 Bytes JMP 0046000A
.text C:\Windows\Explorer.EXE[1568] ntdll.dll!NtWriteVirtualMemory 77015674 5 Bytes JMP 0047000A
.text C:\Windows\Explorer.EXE[1568] ntdll.dll!KiUserExceptionDispatcher 77015DC8 5 Bytes JMP 0045000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2484] ntdll.dll!NtProtectVirtualMemory 77014D34 5 Bytes JMP 002F000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2484] ntdll.dll!NtWriteVirtualMemory 77015674 5 Bytes JMP 0031000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2484] ntdll.dll!KiUserExceptionDispatcher 77015DC8 5 Bytes JMP 002E000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2484] USER32.dll!DialogBoxParamW 760310B0 5 Bytes JMP 73305505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Windows\system32\svchost.exe[2536] ntdll.dll!NtProtectVirtualMemory 77014D34 5 Bytes JMP 0029000A
.text C:\Windows\system32\svchost.exe[2536] ntdll.dll!NtWriteVirtualMemory 77015674 5 Bytes JMP 002A000A
.text C:\Windows\system32\svchost.exe[2536] ntdll.dll!KiUserExceptionDispatcher 77015DC8 5 Bytes JMP 0028000A
.text C:\Windows\system32\svchost.exe[2536] ole32.dll!CoCreateInstance 75DA9EA6 5 Bytes JMP 0097000A
.text C:\Windows\system32\svchost.exe[2536] USER32.dll!GetCursorPos 76020B88 5 Bytes JMP 009E000A
.text C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe[2576] kernel32.dll!CreateThread + 1A 7575C928 4 Bytes CALL 00450771 C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe (Spy Sweeper Client Executable/Webroot Software, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[3116] ntdll.dll!NtProtectVirtualMemory 77014D34 5 Bytes JMP 003D000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3116] ntdll.dll!NtWriteVirtualMemory 77015674 5 Bytes JMP 0096000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3116] ntdll.dll!KiUserExceptionDispatcher 77015DC8 5 Bytes JMP 003C000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3116] USER32.dll!DialogBoxParamW 760310B0 5 Bytes JMP 73305505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3788] ntdll.dll!NtProtectVirtualMemory 77014D34 5 Bytes JMP 002B000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3788] ntdll.dll!NtWriteVirtualMemory 77015674 5 Bytes JMP 002C000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3788] ntdll.dll!KiUserExceptionDispatcher 77015DC8 5 Bytes JMP 002A000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3788] USER32.dll!DialogBoxParamW 760310B0 5 Bytes JMP 73305505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5340] ntdll.dll!NtProtectVirtualMemory 77014D34 5 Bytes JMP 002C000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5340] ntdll.dll!NtWriteVirtualMemory 77015674 5 Bytes JMP 002D000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5340] ntdll.dll!KiUserExceptionDispatcher 77015DC8 5 Bytes JMP 001B000A
.text C:\Program Files\Internet Explorer\iexplore.exe[5340] USER32.dll!DialogBoxParamW 760310B0 5 Bytes JMP 73305505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] ntdll.dll!KiUserExceptionDispatcher + A 77015DD2 5 Bytes JMP 00017DB0 C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!VirtualProtect 75711DC3 5 Bytes JMP 000169B0 C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!LoadLibraryExW 75739109 5 Bytes JMP 00016000 C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!VirtualFree 757540AA 5 Bytes JMP 00016990 C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!VirtualAlloc 7575AD55 3 Bytes JMP 00016960 C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!VirtualAlloc + 4 7575AD59 1 Byte [8A]
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!CreateFileA 7575CE5F 3 Bytes JMP 00016000 C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))
.text C:\Program Files\Webroot\WebrootSecurity\SSU.EXE[5536] kernel32.dll!CreateFileA + 4 7575CE63 1 Byte [8A]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

CatByte

Post #4June 13, 2010, 9:08 PM UTC

Hi,

Please do the following:

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

miguelsal

Post #5June 13, 2010, 11:08 PM UTC

Here is the ComboFix log:

ComboFix 10-06-13.01 - Miguel 06/13/2010 15:17:51.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3071.1633 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\%appdata%
O:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-05-13 to 2010-06-13 )))))))))))))))))))))))))))))))
.

2010-06-13 22:40 . 2010-06-13 22:40 680 —-a-w- c:\users\Miguel\AppData\Local\d3d9caps.dat
2010-06-13 22:28 . 2010-06-13 22:28 ——– d—–w- c:\users\Guest\AppData\Local\temp
2010-06-13 22:28 . 2010-06-13 22:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-06-13 22:28 . 2010-06-13 22:28 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-06-12 22:17 . 2010-06-13 22:40 ——– d—–w- c:\users\Miguel\AppData\Local\Temp
2010-06-09 08:15 . 2010-06-09 08:15 ——– d—–w- c:\programdata\Office Genuine Advantage
2010-06-02 05:49 . 2010-06-02 05:49 151552 —ha-w- C:\SZKGFS.dat
2010-06-02 05:48 . 2010-06-02 05:48 ——– d—–w- c:\programdata\SITEguard
2010-06-02 05:47 . 2010-06-02 05:47 ——– d—–w- c:\program files\Common Files\iS3
2010-06-02 05:47 . 2010-06-02 20:12 ——– d—–w- c:\programdata\STOPzilla!
2010-05-26 14:13 . 2010-04-23 14:13 2048 —-a-w- c:\windows\system32\tzres.dll
2010-05-19 17:36 . 2010-05-19 17:36 ——– d—–w- c:\programdata\GoodSync
2010-05-16 05:46 . 2010-05-16 05:46 ——– d—–w- c:\programdata\regid.1986-12.com.adobe
2010-05-16 05:09 . 2010-06-12 21:26 ——– d—–w- c:\program files\Common Files\Akamai
2010-05-15 18:54 . 2010-01-29 15:40 738816 —-a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-13 22:40 . 2009-08-29 20:45 135626 —-a-w- c:\programdata\nvModes.dat
2010-06-13 22:39 . 2008-07-19 17:47 ——– d—–w- c:\users\Miguel\AppData\Roaming\WTablet
2010-06-13 22:31 . 2008-07-19 07:57 7304 —-a-w- c:\windows\TMP0001.TMP
2010-06-13 18:49 . 2009-10-13 07:07 ——– d—–w- c:\users\Miguel\AppData\Roaming\GoodSync
2010-06-12 22:50 . 2008-08-05 07:06 ——– d—–w- c:\programdata\Google Updater
2010-06-12 21:26 . 2008-07-19 07:24 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-06-12 21:26 . 2008-07-19 14:55 ——– d—–w- c:\program files\Bonjour
2010-06-10 01:27 . 2009-04-10 19:04 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-09 02:34 . 2008-08-05 07:06 ——– d—–w- c:\program files\Google
2010-06-09 02:01 . 2009-04-10 18:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-06-09 02:01 . 2009-04-10 18:08 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-06-02 07:35 . 2010-06-02 06:08 14744 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-06-02 06:08 . 2010-06-02 06:08 360 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-06-02 05:59 . 2008-12-16 22:08 ——– d—–w- c:\program files\Palm
2010-05-31 20:38 . 2010-03-18 05:07 ——– d—–w- c:\users\Guest\AppData\Roaming\WTablet
2010-05-31 20:38 . 2008-07-19 08:00 ——– d—–w- c:\programdata\NVIDIA
2010-05-31 20:38 . 2010-03-18 05:10 680 —-a-w- c:\users\Guest\AppData\Local\d3d9caps.dat
2010-05-31 20:38 . 2010-03-18 05:07 91128 —-a-w- c:\users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-29 04:46 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-05-26 04:29 . 2009-06-19 01:38 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2010-05-19 17:36 . 2009-10-13 06:30 ——– d—–w- c:\program files\Siber Systems
2010-05-16 05:48 . 2008-10-13 07:27 91128 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-05-16 05:43 . 2008-07-19 14:47 ——– d—–w- c:\program files\Common Files\Adobe
2010-05-16 05:40 . 2009-08-21 19:42 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-05-16 05:39 . 2009-08-21 19:42 38784 —-a-w- c:\users\Miguel\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-12 18:21 . 2009-11-04 19:11 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-06 17:49 . 2008-07-19 18:43 20 —h–w- c:\programdata\PKP_DLbz.DAT
2010-04-29 22:39 . 2009-04-10 19:04 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2009-04-10 19:05 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-15 01:53 . 2009-08-19 13:58 ——– d—–w- c:\programdata\Yahoo! Companion
2010-03-26 17:33 . 2010-04-30 00:44 1496064 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-03-26 17:33 . 2010-04-30 00:44 43008 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-03-26 17:33 . 2010-04-30 00:44 339456 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-03-26 17:32 . 2010-04-30 00:44 346112 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-10-13 03:41 218160 —-a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-03-18 160328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="g:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560]
"Adobe Acrobat Speed Launcher"="g:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="g:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
"EverioService"="g:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-11-02 151552]
"avast!"="g:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-03-18 160328]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ColorMunki Gamma.lnk - g:\program files\X-Rite\ColorMunki Photo\Gamma\CalibrationLoader.exe [2009-8-10 802816]
ColorMunkiPhotoTray.exe.lnk - g:\program files\X-Rite\ColorMunki Photo\Tools\ColorMunki Photo Tray.exe [2009-8-10 1921024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

CatByte

Post #6June 14, 2010, 12:04 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/z0g7ya1i0_com_infection_redirection_t112585.html&view=findpost&p=659782#entry659782

Collect::
c:\windows\TEMP\TMP0000004A3347A3674AB083D9
c:\windows\TMP0001.TMP

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT:

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

miguelsal

Post #7June 14, 2010, 3:22 PM UTC

I ran the ComboFix Script, MalwareBytes and Kapersky. Here are the logfiles:

ComboFix:

ComboFix 10-06-13.01 - Miguel 06/13/2010 17:14:27.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3071.2009 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Miguel\Desktop\cfscript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

file zipped: c:\windows\TMP0001.TMP
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\%appdata%
c:\windows\TMP0001.TMP
c:\windows\system32\%appdata%\Microsoft\Windows\IETldCache\index.dat . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2010-05-14 to 2010-06-14 )))))))))))))))))))))))))))))))
.

2010-06-14 05:51 . 2010-06-14 05:51 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Roaming\Webroot
2010-06-14 05:51 . 2010-06-14 05:51 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Adobe
2010-06-14 00:41 . 2010-06-14 00:41 ——– d-sh–w- c:\windows\system32\%APPDATA%
2010-06-14 00:24 . 2010-06-14 05:51 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-06-14 00:24 . 2010-06-14 00:24 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-06-14 00:24 . 2010-06-14 00:24 ——– d—–w- c:\users\Miguel\AppData\Local\temp
2010-06-14 00:24 . 2010-06-14 00:24 ——– d—–w- c:\users\Guest\AppData\Local\temp
2010-06-14 00:24 . 2010-06-14 00:24 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-06-13 22:40 . 2010-06-13 22:40 680 —-a-w- c:\users\Miguel\AppData\Local\d3d9caps.dat
2010-06-09 08:15 . 2010-06-09 08:15 ——– d—–w- c:\programdata\Office Genuine Advantage
2010-06-02 05:49 . 2010-06-02 05:49 151552 —ha-w- C:\SZKGFS.dat
2010-06-02 05:48 . 2010-06-02 05:48 ——– d—–w- c:\programdata\SITEguard
2010-06-02 05:47 . 2010-06-02 05:47 ——– d—–w- c:\program files\Common Files\iS3
2010-06-02 05:47 . 2010-06-02 20:12 ——– d—–w- c:\programdata\STOPzilla!
2010-05-26 14:13 . 2010-04-23 14:13 2048 —-a-w- c:\windows\system32\tzres.dll
2010-05-19 17:36 . 2010-05-19 17:36 ——– d—–w- c:\programdata\GoodSync
2010-05-16 05:46 . 2010-05-16 05:46 ——– d—–w- c:\programdata\regid.1986-12.com.adobe
2010-05-16 05:09 . 2010-06-12 21:26 ——– d—–w- c:\program files\Common Files\Akamai
2010-05-15 18:54 . 2010-01-29 15:40 738816 —-a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-14 05:51 . 2009-08-29 20:45 135626 —-a-w- c:\programdata\nvModes.dat
2010-06-13 23:51 . 2008-08-05 07:06 ——– d—–w- c:\programdata\Google Updater
2010-06-13 23:06 . 2008-07-19 17:47 ——– d—–w- c:\users\Miguel\AppData\Roaming\WTablet
2010-06-13 18:49 . 2009-10-13 07:07 ——– d—–w- c:\users\Miguel\AppData\Roaming\GoodSync
2010-06-12 21:26 . 2008-07-19 07:24 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-06-12 21:26 . 2008-07-19 14:55 ——– d—–w- c:\program files\Bonjour
2010-06-10 01:27 . 2009-04-10 19:04 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-09 02:34 . 2008-08-05 07:06 ——– d—–w- c:\program files\Google
2010-06-09 02:01 . 2009-04-10 18:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-06-09 02:01 . 2009-04-10 18:08 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-06-02 07:35 . 2010-06-02 06:08 14744 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-06-02 06:08 . 2010-06-02 06:08 360 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-06-02 05:59 . 2008-12-16 22:08 ——– d—–w- c:\program files\Palm
2010-05-31 20:38 . 2010-03-18 05:07 ——– d—–w- c:\users\Guest\AppData\Roaming\WTablet
2010-05-31 20:38 . 2008-07-19 08:00 ——– d—–w- c:\programdata\NVIDIA
2010-05-31 20:38 . 2010-03-18 05:10 680 —-a-w- c:\users\Guest\AppData\Local\d3d9caps.dat
2010-05-31 20:38 . 2010-03-18 05:07 91128 —-a-w- c:\users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-29 04:46 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-05-26 04:29 . 2009-06-19 01:38 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2010-05-19 17:36 . 2009-10-13 06:30 ——– d—–w- c:\program files\Siber Systems
2010-05-16 05:48 . 2008-10-13 07:27 91128 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-05-16 05:43 . 2008-07-19 14:47 ——– d—–w- c:\program files\Common Files\Adobe
2010-05-16 05:40 . 2009-08-21 19:42 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-05-16 05:39 . 2009-08-21 19:42 38784 —-a-w- c:\users\Miguel\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-12 18:21 . 2009-11-04 19:11 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-06 17:49 . 2008-07-19 18:43 20 —h–w- c:\programdata\PKP_DLbz.DAT
2010-04-29 22:39 . 2009-04-10 19:04 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2009-04-10 19:05 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-26 17:33 . 2010-04-30 00:44 1496064 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-03-26 17:33 . 2010-04-30 00:44 43008 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-03-26 17:33 . 2010-04-30 00:44 339456 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-03-26 17:32 . 2010-04-30 00:44 346112 —-a-w- c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\pirtmabj.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-10-13 03:41 218160 —-a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-03-18 160328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="g:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560]
"Adobe Acrobat Speed Launcher"="g:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="g:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
"EverioService"="g:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-11-02 151552]
"avast!"="g:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-03-18 160328]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ColorMunki Gamma.lnk - g:\program files\X-Rite\ColorMunki Photo\Gamma\CalibrationLoader.exe [2009-8-10 802816]
ColorMunkiPhotoTray.exe.lnk - g:\program files\X-Rite\ColorMunki Photo\Tools\ColorMunki Photo Tray.exe [2009-8-10 1921024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

:4e,87,07,0d,b0,63,ca,01

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
R3 colormunki;colormunki;c:\windows\system32\Drivers\colormunki.sys [2007-11-13 29184]
R3 epppdt;EPSON 1394.3 Class;c:\windows\system32\DRIVERS\epppdt.sys [2004-08-31 31269]
R3 epppdtpr;EPSON 1394.3 Printer Class;c:\windows\system32\DRIVERS\epppdtpr.sys [2004-08-31 14457]
R3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-12-14 30192]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 X-Rite;X-Rite USB Service;c:\windows\system32\DRIVERS\XrUsb.sys [2007-01-11 18168]
S0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2009-11-06 29808]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-09-15 53328]
S2 ColorMunkiService;X-Rite Device ColorMunki;c:\program files\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe [2009-06-02 148992]
S2 SonyIEx;SonyIEx;c:\windows\System32\SonyIEx.exe [2006-11-28 176128]
S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-06-06 3406120]
S2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2008-07-24 102400]
S2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2010-02-10 1201640]
S2 xritedeviced;X-Rite Device Manager;c:\program files\X-Rite\Devices\Services\xritedeviced.exe [2009-06-02 126976]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2008-04-23 15656]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-06-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-05 06:58]

2010-06-13 c:\windows\Tasks\User_Feed_Synchronization-{96FAED89-5A7B-49A7-A2AF-5AB2D5B68C91}.job
- c:\windows\system32\msfeedssync.exe [2010-03-31 04:54]
.
.
——- Supplementary Scan ——-
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport; to Microsoft Excel - g:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-13 22:51
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
g:\program files\Alwil Software\Avast4\aswUpdSv.exe
g:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
g:\program files\Hotspot Shield\HssWPR\hsssrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
g:\program files\Photodex\ProShowGold\ScsiAccess.exe
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
g:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2010-06-13 22:57:24 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-14 05:57
ComboFix2.txt 2010-06-13 22:47

Pre-Run: 5,818,687,488 bytes free
Post-Run: 5,062,950,912 bytes free

- - End Of File - - A908E38219584C73172C4FE167ABD70E
Upload was successful

MalwareBytes Log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4195

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

6/13/2010 11:08:43 PM
mbam-log-2010-06-13 (23-08-43).txt

Scan type: Quick scan
Objects scanned: 142631
Time elapsed: 5 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Kapersky Log:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, June 14, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, June 14, 2010 04:21:57
Records in database: 4275080
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
O:\

Scan statistics:
Objects scanned: 368502
Threats found: 6
Infected objects found: 394
Suspicious objects found: 2
Scan duration: 05:45:16

File name / Threat / Threats count
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01900000.VBN Infected: Trojan.Win32.Agent2.jqi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06580001.VBN Infected: Trojan.Win32.Delf.fvq 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06580002.VBN Infected: Trojan.Win32.Delf.fvq 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300000\4E75B2E6.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300001\4E75B2F7.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300002\4E75B30B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300003\4E75B324.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300004\4E75B33A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300005\4E75B34E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300006\4E75B362.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300007\4E75B375.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300008.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300009.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000B\4E75B387.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300010.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300011.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300012.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300013.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300014.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300015.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300016.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300017.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\12080000\5BED23B4.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\12080001\5BED23D0.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\12340001.VBN Suspicious: Trojan.Win32.Patched.hs 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\13180000.VBN Infected: Trojan-Spy.Win32.Agent.akwj 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380000\5E3A06AD.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380001\5E3A06BE.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380002\5E3A06CF.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380003\5E3A06E2.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380004\5E3A06F8.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380005\5E3A070D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740000\5F7CA3CC.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740001\5F7CA3E1.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740002\5F7CA3FC.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740003\5F7CA41A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740004\5F7CA430.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740005\5F7CA447.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740006\5F7CA45C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740007\5F7CA473.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740008\5F7CA48B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740009\5F7CA4A6.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000A\5F7CA4C4.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000B\5F7CA4DB.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000C\5F7CA4F3.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000D\5F7CA509.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000E\5F7CA51D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000F\5F7CA531.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740010\5F7CA547.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740011\5F7CA55E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740012\5F7CA572.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740013\5F7CA58A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740014\5F7CA59D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740015\5F7CA5B1.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740016\5F7CA5C7.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740017\5F7CA5DF.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740018\5F7CA5F3.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740019\5F7CA607.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001A\5F7CA61E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001B\5F7CA632.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001C\5F7CA647.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001D\5F7CA65C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001E\5F7CA66F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001F\5F7CA684.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740020\5F7CA69B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740021\5F7CA6AE.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740022\5F7CA8C8.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740023.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740024.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740025.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740026.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740027.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740028.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740029.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740030.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740031.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740032.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740033.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740034.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740035.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740036.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740037.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740038.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740039.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740040.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740041.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740042.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740043.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740044.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740045.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740046.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740047.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740048.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740049.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740050.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740051.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740052.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740053.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740054.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740055.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740056.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740057.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740058.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740059.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40000\5FBD3A4C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40001.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40002.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40003.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40004.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40005.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40006.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40007.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40008.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40009.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A4000A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A4000B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280000\5E6EC87E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280001\5E6EC891.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280002\5E6EC8A8.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280003\5E6ECDA7.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280004\5E6ECDBA.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280005\5E782B3E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280006.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280007.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280008.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280009.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280010.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280011.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280012.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280013.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280014.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280015.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280016.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280017.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280018.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280019.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280020.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280021.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280022.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280023.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280024.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280025.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280026.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280027.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280028.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280029.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\17480000\5F4F0D51.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\17480001.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\17480002.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01900000.VBN Infected: Trojan.Win32.Agent2.jqi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06580001.VBN Infected: Trojan.Win32.Delf.fvq 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06580002.VBN Infected: Trojan.Win32.Delf.fvq 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300000\4E75B2E6.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300001\4E75B2F7.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300002\4E75B30B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300003\4E75B324.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300004\4E75B33A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300005\4E75B34E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300006\4E75B362.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300007\4E75B375.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300008.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300009.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000B\4E75B387.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C30000F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300010.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300011.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300012.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300013.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300014.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300015.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300016.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C300017.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\12080000\5BED23B4.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\12080001\5BED23D0.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\12340001.VBN Suspicious: Trojan.Win32.Patched.hs 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\13180000.VBN Infected: Trojan-Spy.Win32.Agent.akwj 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380000\5E3A06AD.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380001\5E3A06BE.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380002\5E3A06CF.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380003\5E3A06E2.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380004\5E3A06F8.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\14380005\5E3A070D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740000\5F7CA3CC.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740001\5F7CA3E1.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740002\5F7CA3FC.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740003\5F7CA41A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740004\5F7CA430.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740005\5F7CA447.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740006\5F7CA45C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740007\5F7CA473.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740008\5F7CA48B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740009\5F7CA4A6.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000A\5F7CA4C4.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000B\5F7CA4DB.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000C\5F7CA4F3.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000D\5F7CA509.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000E\5F7CA51D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574000F\5F7CA531.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740010\5F7CA547.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740011\5F7CA55E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740012\5F7CA572.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740013\5F7CA58A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740014\5F7CA59D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740015\5F7CA5B1.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740016\5F7CA5C7.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740017\5F7CA5DF.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740018\5F7CA5F3.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740019\5F7CA607.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001A\5F7CA61E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001B\5F7CA632.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001C\5F7CA647.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001D\5F7CA65C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001E\5F7CA66F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574001F\5F7CA684.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740020\5F7CA69B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740021\5F7CA6AE.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740022\5F7CA8C8.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740023.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740024.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740025.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740026.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740027.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740028.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740029.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574002F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740030.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740031.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740032.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740033.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740034.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740035.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740036.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740037.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740038.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740039.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574003F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740040.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740041.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740042.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740043.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740044.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740045.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740046.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740047.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740048.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740049.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574004F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740050.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740051.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740052.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740053.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740054.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740055.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740056.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740057.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740058.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15740059.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1574005F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40000\5FBD3A4C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40001.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40002.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40003.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40004.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40005.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40006.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40007.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40008.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A40009.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A4000A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\15A4000B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280000\5E6EC87E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280001\5E6EC891.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280002\5E6EC8A8.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280003\5E6ECDA7.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280004\5E6ECDBA.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280005\5E782B3E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280006.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280007.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280008.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280009.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628000F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280010.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280011.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280012.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280013.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280014.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280015.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280016.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280017.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280018.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280019.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628001F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280020.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280021.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280022.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280023.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280024.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280025.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280026.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280027.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280028.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\16280029.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002A.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002B.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002C.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002D.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002E.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\1628002F.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\17480000\5F4F0D51.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\17480001.VBN Infected: Trojan.Win32.Genome.fwmi 1
C:\Users\All Users\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\17480002.VBN Infected: Trojan.Win32.Genome.fwmi 1
D:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
D:\Program Files\RealVNC\VNC4\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
D:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
D:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1

Selected area has been scanned.

CatByte

Post #8June 14, 2010, 9:52 PM UTC

Hi,

Just some housekeeping to do now,

You can empty your Symantec quarantine.

NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Now to remove the rest of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs/tools remain on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox, IE and chrome.
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

miguelsal

Post #9June 16, 2010, 4:34 AM UTC

I did thr removals and ran TFC. However I still get the Inernet communication shield blocking access to ZoG7YaI0.com as well as the Avast Antivirus blocking access to sites that contain malware. So only part of the problem has been fixed since I can now browse and click google results and actually go to the website that is listed on the link. Can we resolve the access to ZoG7YaI0.com as well as the tries to go to malicious sites? Regards, Miguel

miguelsal

Post #10June 16, 2010, 4:56 AM UTC

Also I reinstalled google chrome and it does not work properly. I type in to go to the www.google.com site and it just hangs there. Thanks, Miguel

CatByte

Post #11June 16, 2010, 1:39 PM UTC

Please run this program:

Download TDSSKiller and save it to your Desktop.

Extract the file and run it.

Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)

please post the content of the TDSSKiller log

NEXT

Do you access the internet via a router?

If so, reset it, then flush the DNS

Let’s try to reset the router to its default configuration.

This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
If you don’t know the router's default password, you can look it up. HERE
You also need to reconfigure any security settings you had in place prior to the reset.
You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

next

Go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
Hit Enter.
You will get a confirmation that the flush was successful.
Close the command box.

miguelsal

Post #12June 18, 2010, 1:24 AM UTC

Here is the TDDSKiller log file. I also flushed the dns. Regards, Miguel 18:05:01:765 1496 TDSS rootkit removing tool [removed] May 31 2010 10:39:48 18:05:01:765 1496 ================================================================================ 18:05:01:765 1496 SystemInfo: 18:05:01:765 1496 OS Version: 6.0.6002 ServicePack: 2.0 18:05:01:765 1496 Product type: Workstation 18:05:01:765 1496 ComputerName: MIGUEL-RAID 18:05:01:765 1496 UserName: Miguel 18:05:01:765 1496 Windows directory: C:\Windows 18:05:01:765 1496 Processor architecture: Intel x86 18:05:01:765 1496 Number of processors: 2 18:05:01:765 1496 Page size: 0x1000 18:05:01:765 1496 Boot type: Normal boot 18:05:01:765 1496 ================================================================================ 18:05:02:264 1496 Initialize success 18:05:02:264 1496 18:05:02:264 1496 Scanning Services … 18:05:03:278 1496 Raw services enum returned 460 services 18:05:03:278 1496 18:05:03:278 1496 Scanning Drivers … 18:05:04:526 1496 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys 18:05:04:651 1496 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys 18:05:04:682 1496 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys 18:05:04:698 1496 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys 18:05:04:729 1496 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys 18:05:04:776 1496 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys 18:05:04:822 1496 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys 18:05:04:869 1496 aic78xx (cb387d65d0d73cad4d6661c389bd676c) C:\Windows\system32\DRIVERS\aic78xx.sys 18:05:04:916 1496 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys 18:05:04:978 1496 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys 18:05:05:010 1496 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys 18:05:05:025 1496 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys 18:05:05:072 1496 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys 18:05:05:103 1496 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys 18:05:05:134 1496 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys 18:05:05:166 1496 aswFsBlk (b4079a98f294a3e262872cb76f4849f0) C:\Windows\system32\DRIVERS\aswFsBlk.sys 18:05:05:181 1496 aswMonFlt (e2851cb7dbb831888eaea46c55c05e44) C:\Windows\system32\DRIVERS\aswMonFlt.sys 18:05:05:212 1496 aswRdr (8080d683489c99cbace813f6fa4069cc) C:\Windows\system32\drivers\aswRdr.sys 18:05:05:275 1496 aswSP (2e5a2ad5004b55df39b7606130a88142) C:\Windows\system32\drivers\aswSP.sys 18:05:05:337 1496 aswTdi (d4c83a37efadfa2c398362e0776e3773) C:\Windows\system32\drivers\aswTdi.sys 18:05:05:384 1496 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 18:05:05:415 1496 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys 18:05:05:462 1496 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 18:05:05:524 1496 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys 18:05:05:540 1496 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 18:05:05:571 1496 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 18:05:05:602 1496 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 18:05:05:618 1496 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 18:05:05:665 1496 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 18:05:05:712 1496 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 18:05:05:727 1496 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys 18:05:05:790 1496 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 18:05:05:852 1496 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys 18:05:05:914 1496 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys 18:05:05:961 1496 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys 18:05:06:008 1496 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys 18:05:06:039 1496 colormunki (f35b5d0cc142b87e687fc504baa69d82) C:\Windows\system32\Drivers\colormunki.sys 18:05:06:102 1496 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys 18:05:06:133 1496 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys 18:05:06:148 1496 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys 18:05:06:180 1496 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys 18:05:06:211 1496 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys 18:05:06:258 1496 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 18:05:06:320 1496 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys 18:05:06:382 1496 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys 18:05:06:429 1496 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys 18:05:06:460 1496 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys 18:05:06:476 1496 epppdt (8ac88c5c4a86e49f173712b2bda50b65) C:\Windows\system32\DRIVERS\epppdt.sys 18:05:06:523 1496 epppdtpr (2de718d6fa1f187a4fac135633b968c0) C:\Windows\system32\DRIVERS\epppdtpr.sys 18:05:06:585 1496 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys 18:05:06:616 1496 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys 18:05:06:648 1496 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys 18:05:06:710 1496 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 18:05:06:757 1496 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 18:05:06:788 1496 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 18:05:06:835 1496 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys 18:05:06:850 1496 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys 18:05:06:882 1496 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys 18:05:06:913 1496 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 18:05:06:944 1496 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 18:05:07:006 1496 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys 18:05:07:038 1496 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 18:05:07:084 1496 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 18:05:07:116 1496 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys 18:05:07:162 1496 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys 18:05:07:209 1496 HssDrv (30858b2d6dc0d8ed044dc28011ade6a2) C:\Windows\system32\DRIVERS\HssDrv.sys 18:05:07:287 1496 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys 18:05:07:334 1496 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys 18:05:07:365 1496 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 18:05:07:396 1496 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys 18:05:07:459 1496 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 18:05:07:568 1496 IntcAzAudAddService (c61b3b87f3856cef0c9f204028c6860d) C:\Windows\system32\drivers\RTKVHDA.sys 18:05:07:630 1496 intelide (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys 18:05:07:662 1496 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 18:05:07:724 1496 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 18:05:07:786 1496 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys 18:05:07:864 1496 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 18:05:07:927 1496 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 18:05:07:974 1496 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys 18:05:08:005 1496 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys 18:05:08:036 1496 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 18:05:08:052 1496 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 18:05:08:083 1496 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 18:05:08:161 1496 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys 18:05:08:192 1496 klmd23 (67e1faa88fb397b3d56909d7e04f4dd3) C:\Windows\system32\drivers\klmd.sys 18:05:08:223 1496 KMW_KBD (56c128e5a723f41fc254cdc01e31cf8e) C:\Windows\system32\DRIVERS\KMW_KBD.sys 18:05:08:286 1496 KMW_SYS (56ab6419f4a49b91964c5c6ded4b0fbe) C:\Windows\system32\DRIVERS\KMW_SYS.sys 18:05:08:379 1496 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys 18:05:08:426 1496 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 18:05:08:473 1496 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys 18:05:08:504 1496 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys 18:05:08:551 1496 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys 18:05:08:598 1496 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 18:05:08:660 1496 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys 18:05:08:707 1496 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 18:05:08:754 1496 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 18:05:08:800 1496 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 18:05:08:832 1496 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 18:05:08:847 1496 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 18:05:08:878 1496 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys 18:05:08:910 1496 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 18:05:08:956 1496 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 18:05:09:003 1496 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys 18:05:09:066 1496 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys 18:05:09:097 1496 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys 18:05:09:159 1496 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys 18:05:09:190 1496 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys 18:05:09:206 1496 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys 18:05:09:237 1496 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 18:05:09:253 1496 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 18:05:09:284 1496 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 18:05:09:315 1496 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 18:05:09:362 1496 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 18:05:09:424 1496 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys 18:05:09:456 1496 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 18:05:09:487 1496 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 18:05:09:534 1496 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys 18:05:09:596 1496 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys 18:05:09:658 1496 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys 18:05:09:768 1496 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 18:05:09:830 1496 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 18:05:09:892 1496 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys 18:05:09:908 1496 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 18:05:09:955 1496 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 18:05:10:002 1496 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys 18:05:10:048 1496 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 18:05:10:095 1496 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys 18:05:10:126 1496 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 18:05:10:173 1496 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys 18:05:10:220 1496 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 18:05:10:251 1496 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 18:05:10:298 1496 NVENETFD (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys 18:05:10:454 1496 nvlddmkm (c14e3c26a348e359b89b4a02279d76c4) C:\Windows\system32\DRIVERS\nvlddmkm.sys 18:05:10:610 1496 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys 18:05:10:641 1496 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys 18:05:10:688 1496 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys 18:05:10:766 1496 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys 18:05:10:797 1496 PalmUSBD (dc450992eba6f914080c1f7fbeeed72c) C:\Windows\system32\drivers\PalmUSBD.sys 18:05:10:828 1496 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 18:05:10:860 1496 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys 18:05:10:891 1496 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 18:05:10:938 1496 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys 18:05:10:969 1496 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys 18:05:11:016 1496 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys 18:05:11:047 1496 PdiPorts (18ed1d71fef6f71d38c24263500bbd01) C:\Windows\system32\Drivers\PdiPorts.sys 18:05:11:094 1496 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 18:05:11:172 1496 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 18:05:11:187 1496 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys 18:05:11:218 1496 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys 18:05:11:265 1496 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\Windows\system32\Drivers\PxHelp20.sys 18:05:11:296 1496 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys 18:05:11:343 1496 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 18:05:11:359 1496 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 18:05:11:390 1496 RasAcd (205f883804fdc67c1f237bc2ed2570a1) C:\Windows\system32\DRIVERS\rasacd.sys 18:05:11:390 1496 Suspicious file (Forged): C:\Windows\system32\DRIVERS\rasacd.sys. Real md5: 205f883804fdc67c1f237bc2ed2570a1, Fake md5: 147d7f9c556d259924351feb0de606c3 18:05:11:390 1496 File "C:\Windows\system32\DRIVERS\rasacd.sys" infected by TDSS rootkit … 18:05:11:530 1496 Backup copy found, using it.. 18:05:11:702 1496 will be cured on next reboot 18:05:11:780 1496 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 18:05:11:827 1496 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys 18:05:11:858 1496 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys 18:05:11:905 1496 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys 18:05:11:936 1496 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 18:05:11:983 1496 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys 18:05:12:030 1496 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 18:05:12:061 1496 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys 18:05:12:108 1496 RimUsb (f17713d108aca124a139fde877eef68a) C:\Windows\system32\Drivers\RimUsb.sys 18:05:12:201 1496 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys 18:05:12:264 1496 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys 18:05:12:326 1496 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 18:05:12:357 1496 sbp2port (37ca203f8ccf732cd272a27e55b268c4) C:\Windows\system32\DRIVERS\sbp2port.sys 18:05:12:404 1496 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 18:05:12:451 1496 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys 18:05:12:466 1496 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys 18:05:12:513 1496 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 18:05:12:544 1496 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys 18:05:12:591 1496 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys 18:05:12:622 1496 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys 18:05:12:654 1496 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 18:05:12:685 1496 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys 18:05:12:700 1496 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys 18:05:12:732 1496 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys 18:05:12:763 1496 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys 18:05:12:810 1496 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 18:05:12:872 1496 srv (0debafcc0e3591fca34f077cab62f7f7) C:\Windows\system32\DRIVERS\srv.sys 18:05:12:934 1496 srv2 (6b6f3658e0a58c6c50c5f7fbdf3df633) C:\Windows\system32\DRIVERS\srv2.sys 18:05:12:981 1496 srvnet (0c5ab1892ae0fa504218db094bf6d041) C:\Windows\system32\DRIVERS\srvnet.sys 18:05:13:028 1496 ssfs0bbc (a3cc244f1e043c2b7ae32899ff99a0a0) C:\Windows\system32\DRIVERS\ssfs0bbc.sys 18:05:13:075 1496 sshrmd (e041026dafa17af2610afc4da8f4ea14) C:\Windows\system32\DRIVERS\sshrmd.sys 18:05:13:106 1496 ssidrv (5a40b485825cc31b3a49bb4701b30d35) C:\Windows\system32\DRIVERS\ssidrv.sys 18:05:13:137 1496 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 18:05:13:168 1496 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 18:05:13:184 1496 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 18:05:13:200 1496 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 18:05:13:246 1496 tap0901 (34f1bcb847a924a161422f106a79b9ff) C:\Windows\system32\DRIVERS\tap0901.sys 18:05:13:278 1496 taphss (0c3b2a9c4bd2dd9a6c2e4084314dd719) C:\Windows\system32\DRIVERS\taphss.sys 18:05:13:356 1496 Tcpip (48cbe6d53632d0067c2d6b20f90d84ca) C:\Windows\system32\drivers\tcpip.sys 18:05:13:449 1496 Tcpip6 (48cbe6d53632d0067c2d6b20f90d84ca) C:\Windows\system32\DRIVERS\tcpip.sys 18:05:13:496 1496 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys 18:05:13:558 1496 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 18:05:13:621 1496 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 18:05:13:668 1496 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys 18:05:13:699 1496 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys 18:05:13:730 1496 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 18:05:13:761 1496 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 18:05:13:792 1496 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys 18:05:13:855 1496 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys 18:05:13:917 1496 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys 18:05:13:964 1496 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys 18:05:13:995 1496 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys 18:05:14:026 1496 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 18:05:14:058 1496 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 18:05:14:104 1496 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 18:05:14:167 1496 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 18:05:14:229 1496 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 18:05:14:260 1496 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys 18:05:14:307 1496 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys 18:05:14:338 1496 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys 18:05:14:370 1496 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys 18:05:14:401 1496 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys 18:05:14:432 1496 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS 18:05:14:463 1496 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys 18:05:14:494 1496 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys 18:05:14:526 1496 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 18:05:14:572 1496 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys 18:05:14:588 1496 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys 18:05:14:619 1496 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys 18:05:14:635 1496 viamraid (8c7e7769643d3d17b8b67f99a6416c5b) C:\Windows\system32\DRIVERS\viamraid.sys 18:05:14:666 1496 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 18:05:14:713 1496 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys 18:05:14:775 1496 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys 18:05:14:853 1496 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\DRIVERS\vsmraid.sys 18:05:14:962 1496 wacmoumonitor (7750604aeea6ea05096feeec5998611a) C:\Windows\system32\DRIVERS\wacmoumonitor.sys 18:05:15:009 1496 wacommousefilter (427a8bc96f16c40df81c2d2f4edd32dd) C:\Windows\system32\DRIVERS\wacommousefilter.sys 18:05:15:087 1496 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 18:05:15:134 1496 wacomvhid (73e6f16a1f187d71fb26af308551e54a) C:\Windows\system32\DRIVERS\wacomvhid.sys 18:05:15:259 1496 WacomVKHid (889459833432b161cb99cfdf84a1a9bb) C:\Windows\system32\DRIVERS\WacomVKHid.sys 18:05:15:352 1496 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 18:05:15:352 1496 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 18:05:15:430 1496 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys 18:05:15:477 1496 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 18:05:15:586 1496 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys 18:05:15:664 1496 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys 18:05:15:711 1496 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 18:05:15:758 1496 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 18:05:15:805 1496 X-Rite (9043050ba8c2da8d9da94908ef8a0fe7) C:\Windows\system32\DRIVERS\XrUsb.sys 18:05:15:805 1496 Reboot required for cure complete.. 18:05:16:070 1496 Cure on reboot scheduled successfully 18:05:16:070 1496 18:05:16:086 1496 Completed 18:05:16:086 1496 18:05:16:086 1496 Results: 18:05:16:086 1496 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 18:05:16:086 1496 File objects infected / cured / cured on reboot: 1 / 0 / 1 18:05:16:086 1496 18:05:16:086 1496 KLMD(ARK) unloaded successfully

miguelsal

Post #13June 18, 2010, 1:26 AM UTC

Also I just purchased and installed a new DLink wireless router. Regards, Miguel

CatByte

Post #14June 18, 2010, 1:43 AM UTC

How is the computer running now?

Interesting that TDSSKiller managed to find an infected driver, completely hidden from our other tools.

Please post a fresh DDS log.

I'll give you the link if you need to download it again:

LINK 1

miguelsal

Post #15June 18, 2010, 4:03 PM UTC

Yes I found the infected file by booting into the second OS I have installed on the machine but had no way of repaiting it. Would you recommned that the TDDSKiller be run on a regular basis? Here is the DDS log: DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 9:01:45.85 on Fri 06/18/2010 Internet Explorer: 8.0.6001.18904 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3071.1860 [GMT -7:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\nvvsvc.exe C:\Windows\SYSTEM32\WISPTIS.EXE C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\svchost.exe -k NetworkService g:\Program Files\Alwil Software\Avast4\aswUpdSv.exe g:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Hotspot Shield\bin\openvpnas.exe g:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\system32\IoctlSvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\CyberLink\Shared Files\RichVideo.exe g:\Program Files\Photodex\ProShowGold\ScsiAccess.exe C:\Windows\System32\SonyIEx.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\Wacom_Tablet.exe C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe C:\Windows\system32\taskeng.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Program Files\X-Rite\Devices\Services\xritedeviced.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\X-Rite\Devices\Services\ColorMunki\ColorMunkiDeviceService.exe C:\Windows\system32\WUDFHost.exe g:\Program Files\Alwil Software\Avast4\ashMaiSv.exe g:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\SYSTEM32\WISPTIS.EXE C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe C:\Windows\system32\WTablet\Wacom_TabletUser.exe G:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe G:\Program Files\CyberLink\PCM4Everio\EverioService.exe G:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe C:\Windows\system32\Wacom_Tablet.exe C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe G:\Program Files\X-Rite\ColorMunki Photo\Tools\ColorMunki Photo Tray.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Webroot\WebrootSecurity\SSU.EXE C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\Explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe g:\Program Files\Hotspot Shield\bin\openvpntray.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Miguel\Desktop\dds.com C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe" uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" uRun: [Google Update] "c:\users\miguel\appdata\local\google\update\GoogleUpdate.exe" /c mRun: [Adobe Reader Speed Launcher] "g:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [WD Drive Manager] "c:\program files\western digital\wd drive manager\WDBtnMgrUI.exe" mRun: [Adobe Acrobat Speed Launcher] "g:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "g:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe" mRun: [EverioService] "g:\program files\cyberlink\pcm4everio\EverioService.exe" mRun: [avast!] "g:\progra~1\alwils~1\avast4\ashDisp.exe" mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe" mRun: [SwitchBoard] "c:\program files\common files\adobe\switchboard\SwitchBoard.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [SpySweeper] "c:\program files\webroot\webrootsecurity\SpySweeperUI.exe" /startintray dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\colorm~1.lnk - g:\program files\x-rite\colormunki photo\gamma\CalibrationLoader.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\colorm~2.lnk - g:\program files\x-rite\colormunki photo\tools\ColorMunki Photo Tray.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: E&xport to Microsoft Excel - g:\progra~1\micros~1\office11\EXCEL.EXE/3000 IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~1\office11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\miguel\appdata\roaming\mozilla\firefox\profiles\quk3mt9t.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll FF - component: c:\users\miguel\appdata\roaming\mozilla\firefox\profiles\quk3mt9t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\users\miguel\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: g:\program files\adobe\reader 9.0\reader\browser\nppdf32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-11-13 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-11-13 20560] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-11-13 53328] R2 avast! Antivirus;avast! Antivirus;g:\program files\alwil software\avast4\ashServ.exe [2009-11-13 138680] R2 ColorMunkiService;X-Rite Device ColorMunki;c:\program files\x-rite\devices\services\colormunki\ColorMunkiDeviceService.exe [2009-8-10 148992] R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [2009-2-21 176128] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-7-19 3406120] R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\western digital\wd drive manager\WDBtnMgrSvc.exe [2008-7-24 102400] R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240] R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-4-9 1201640] R2 xritedeviced;X-Rite Device Manager;c:\program files\x-rite\devices\services\xritedeviced.exe [2009-8-9 126976] R3 avast! Mail Scanner;avast! Mail Scanner;g:\program files\alwil software\avast4\ashMaiSv.exe [2009-11-13 254040] R3 avast! Web Scanner;avast! Web Scanner;g:\program files\alwil software\avast4\ashWebSv.exe [2009-11-13 352920] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-7-19 15656] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvscpapisvr.exe –> c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [?] S3 colormunki;colormunki;c:\windows\system32\drivers\colormunki.sys [2009-2-20 29184] S3 epppdt;EPSON 1394.3 Class;c:\windows\system32\drivers\epppdt.sys [2008-7-19 31269] S3 epppdtpr;EPSON 1394.3 Printer Class;c:\windows\system32\drivers\epppdtpr.sys [2008-7-19 14457] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-7-19 21504] S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-12-14 30192] S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] S3 X-Rite;X-Rite USB Service;c:\windows\system32\drivers\XrUsb.sys [2008-7-19 18168] =============== Created Last 30 ================ 2010-06-16 04:45:53 0 d—–w- c:\program files\WOT 2010-06-16 02:36:30 7304 —-a-w- c:\windows\TMP0001.TMP 2010-06-16 01:57:04 0 d-s—w- C:\ComboFix 2010-06-14 08:19:16 0 d—–w- c:\programdata\Sun 2010-06-14 08:18:42 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-06-14 05:51:17 0 d—–w- C:\$RECYCLE.BIN 2010-06-14 00:41:58 0 d-sh–w- c:\windows\system32\%APPDATA% 2010-06-13 22:15:06 77312 —-a-w- c:\windows\MBR.exe 2010-06-13 22:15:06 256512 —-a-w- c:\windows\PEV.exe 2010-06-09 08:15:11 0 d—–w- c:\programdata\Office Genuine Advantage 2010-06-02 06:08:22 360 —-a-w- c:\windows\system32\drivers\kgpfr2.cfg 2010-06-02 06:08:11 14744 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg 2010-06-02 05:49:57 151552 —ha-w- C:\SZKGFS.dat 2010-06-02 05:48:57 0 d—–w- c:\programdata\SITEguard 2010-06-02 05:47:33 0 d—–w- c:\program files\common files\iS3 2010-06-02 05:47:32 0 d—–w- c:\programdata\STOPzilla! 2010-05-26 14:13:08 2048 —-a-w- c:\windows\system32\tzres.dll 2010-05-19 17:36:28 0 d—–w- c:\programdata\GoodSync ==================== Find3M ==================== 2010-06-18 01:13:39 135626 —-a-w- c:\programdata\nvModes.dat 2010-06-18 01:08:57 11776 —-a-w- c:\windows\system32\drivers\rasacd.sys 2010-05-26 04:29:06 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL 2010-05-21 21:14:28 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-05-16 05:48:01 91128 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT 2010-05-06 17:49:10 20 —h–w- c:\programdata\PKP_DLbz.DAT 2010-04-29 22:39:38 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 22:39:26 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-12-10 04:14:42 86016 —-a-w- c:\windows\inf\infstor.dat 2009-12-10 04:14:42 51200 —-a-w- c:\windows\inf\infpub.dat 2009-12-10 04:14:42 143360 —-a-w- c:\windows\inf\infstrng.dat 2009-11-13 17:54:54 665600 —-a-w- c:\windows\inf\drvindex.dat 2008-07-19 16:32:43 33600 —-a-w- c:\windows\inf\drivers\XrUsb64.sys 2008-07-19 16:32:43 18168 —-a-w- c:\windows\inf\drivers\XrUsb.sys 2008-07-19 09:27:29 174 –sha-w- c:\program files\desktop.ini 2007-01-11 21:36:55 33600 —-a-w- c:\windows\inf\xrusb\XrUsb64.sys 2007-01-11 21:36:54 18168 —-a-w- c:\windows\inf\xrusb\XrUsb.sys 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-10-15 18:47:52 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-10-15 18:47:52 32768 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-10-15 18:47:52 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat 2009-10-15 18:47:52 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-07-31 18:43:25 245760 –sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat ============= FINISH: 9:02:50.44 ===============

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

z0g7ya1i0.com infection with redirection

✨ Ask AI

Ask AI