What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

help....unknown sypware issue

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I'm really running out of options to try. I've run mbam and checked with avg but nothing is being found…worse off, when I try to put a hijackthis logfile either here or through an analizer website I keep getting connection being reset or just not being able to go any further with the page…any suggestions?
Post #2
Hello zacr and :welcome:

My name is JonTom.

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 5 days your thread will be closed.


when I try to put a hijackthis logfile either here or through an analizer website I keep getting connection being reset or just not being able to go any further with the page

I am not sure exactly what you mean here. Are you unable to copy and paste logs into your replies? Please let me know.

Before we begin I would like to take a closer look at your system with some scans. If you encounter any difficulties (or if you are unable to paste the logs into your reply) come back and let me know.


  • Download and run OTL by Oldtimer


    • Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop.
    • Close all open windows on your computer then Double click on the OTL.exe icon to run the program.
    • Check the boxes beside "LOP Check" and "Purity Check".
    • Under Custom Scan paste this in:

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /90
    CREATERESTOREPOINT


    • Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.

    • When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
    • Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
    • Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.

  • Please scan your system with GMER


    [external image: Posted Image]
    Download GMER Rootkit Scanner from here or here.
    • Extract the contents of the zipped file to desktop.
    • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

      [external image: Posted Image]
      Click the image to enlarge it
    • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please provide the OTL logs and GMER log in your next reply.
Post #3
Ok. I don't know why I didn't think of it before but I can use my laptop to put in the files. When I try to use the computer that's having issues, anytime I try and paste the logfile for hijackthis it basically does page can't be displayed and when I try to upload the file, it just sits and spins. here's the logfile for highjackthis and for otl….

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:59:36 AM, on 19/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
d:\utilities\AVG9\avgchsvx.exe
d:\utilities\AVG9\avgrsx.exe
d:\utilities\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
d:\utilities\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\IoctlSvc.exe
d:\utilities\AVG9\avgam.exe
C:\WINDOWS\system32\HPZipm12.exe
d:\utilities\AVG9\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\UTILIT~1\AVG9\avgtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
d:\utilities\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - d:\utilities\AVG9\avgssie.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AVG9_TRAY] d:\UTILIT~1\AVG9\avgtray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://D:\UTILIT~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1256943299296
O18 - Protocol: intu-qt2008 - {05E53CE9-66C8-4A9E-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll
O18 - Protocol: intu-qt2009 - {03947252-2355-4E9B-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - d:\utilities\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - d:\utilities\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - Unknown owner - c:\docume~1\zacr\locals~1\temp\cdm\{c173c3a9-7fe7-4717-af0b-a2c67dc36561}\STacSV.exe (file missing)

–
End of file - 6872 bytes


OTL logfile created on: 19/06/2010 7:03:55 AM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 79.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 24.75 Gb Free Space | 44.28% Space Free | Partition Type: NTFS
Drive D: | 70.26 Gb Total Space | 1.59 Gb Free Space | 2.27% Space Free | Partition Type: NTFS
Drive E: | 149.05 Gb Total Space | 3.83 Gb Free Space | 2.57% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PRIMARY
Current User Name: zacr
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/19 06:57:38 | 000,572,416 | —- | M] (OldTimer Tools) – E:\OTL.exe
PRC - [2010/06/02 07:22:20 | 002,065,248 | —- | M] (AVG Technologies CZ, s.r.o.) – D:\utilities\AVG9\avgtray.exe
PRC - [2010/06/02 07:22:07 | 000,620,896 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgnsx.exe
PRC - [2010/06/02 07:22:07 | 000,515,424 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgrsx.exe
PRC - [2010/06/02 07:20:53 | 000,722,784 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgcsrvx.exe
PRC - [2010/06/02 07:20:51 | 001,101,152 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgchsvx.exe
PRC - [2010/03/04 10:00:51 | 000,308,064 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgwdsvc.exe
PRC - [2010/03/04 10:00:34 | 000,836,888 | —- | M] (AVG Technologies CZ, s.r.o.) – d:\utilities\AVG9\avgam.exe
PRC - [2008/04/14 06:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2006/03/03 22:03:10 | 000,069,632 | —- | M] (HP) – C:\WINDOWS\system32\HPZipm12.exe
PRC - [2005/08/12 14:43:58 | 000,045,056 | —- | M] (ATI Technologies Inc.) – C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/02/16 08:15:20 | 000,081,920 | —- | M] (InstallShield Software Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/06/19 06:57:38 | 000,572,416 | —- | M] (OldTimer Tools) – E:\OTL.exe
MOD - [2008/04/14 06:00:00 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/03/04 10:00:51 | 000,308,064 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – d:\utilities\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2010/01/26 12:41:08 | 000,652,800 | —- | M] (Nokia) [On_Demand | Stopped] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2009/09/23 17:37:30 | 000,051,168 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2008/04/10 20:08:44 | 000,212,992 | —- | M] (IDT, Inc.) [Auto | Stopped] – C:\WINDOWS\system32\stacsv.exe – (STacSV)
SRV - [2006/03/03 22:03:10 | 000,069,632 | —- | M] (HP) [Unknown | Running] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - [2010/06/02 07:22:08 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2010/06/02 07:22:07 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2010/03/04 10:00:42 | 000,216,200 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2010/03/04 10:00:35 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\System32\Drivers\avgrkx86.sys – (AvgRkx86)
DRV - [2010/01/21 14:53:16 | 000,018,048 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ccdcmb.sys – (nmwcd)
DRV - [2009/12/30 11:30:56 | 000,007,936 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys – (UsbserFilt)
DRV - [2009/12/30 11:30:48 | 000,022,016 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ccdcmbo.sys – (nmwcdc)
DRV - [2009/12/30 11:30:48 | 000,007,936 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbser_lowerflt.sys – (upperdev)
DRV - [2009/12/30 11:25:12 | 000,137,344 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmwcdnsu.sys – (nmwcdnsu)
DRV - [2009/12/30 11:25:12 | 000,008,320 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmwcdnsuc.sys – (nmwcdnsuc)
DRV - [2009/07/14 15:35:30 | 000,019,720 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LGBusEnum.sys – (LGBusEnum)
DRV - [2008/08/26 09:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2008/04/14 06:00:00 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2008/04/14 01:15:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2008/04/13 23:05:40 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2008/04/10 20:10:10 | 001,271,032 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sthda.sys – (STHDA)
DRV - [2007/08/06 18:15:07 | 000,033,052 | —- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\scdemu.sys – (SCDEmu)
DRV - [2005/12/01 08:49:20 | 001,412,608 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2001/08/17 15:02:32 | 000,008,576 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hidgame.sys – (hidgame)
DRV - [2001/08/17 13:19:34 | 000,040,704 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\es1371mp.sys – (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)
DRV - [2001/08/17 12:19:34 | 000,036,480 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sfmanm.sys – (sfman) Creative SoundFont Manager Driver (WDM)
DRV - [2001/08/17 12:19:28 | 000,006,912 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctlfacem.sys – (emu10k1) Creative Interface Manager Driver (WDM)
DRV - [2001/08/17 12:19:26 | 000,283,904 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\emu10k1m.sys – (emu10k) Creative SB Live! (WDM)
DRV - [2001/08/17 12:19:20 | 000,003,712 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ctljystk.sys – (ctljystk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: {F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}:2.2009.7.21
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.23

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/07 07:31:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/22 20:52:21 | 000,000,000 | —D | M]

[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Extensions
[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Extensions\[removed]
[2009/10/30 14:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\fkaw992v.default\extensions
[2010/06/18 22:27:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions
[2009/10/30 15:09:39 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/30 15:09:39 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010/06/18 22:27:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2009/11/05 18:06:48 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/10/30 15:09:38 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2009/10/30 15:09:38 | 000,000,000 | —D | M] (DriverAgent Plugin for Firefox and Opera) – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\{F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}
[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\[removed]
[2009/09/01 07:34:43 | 000,002,171 | —- | M] () – C:\Documents and Settings\zacr\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\searchplugins\bing.xml
[2010/06/18 22:27:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/11/11 01:38:54 | 000,663,552 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2010/01/27 01:33:42 | 000,077,824 | —- | M] (Kaneva, LLC.) – C:\Program Files\Mozilla Firefox\plugins\npkanevapatch.dll

O1 HOSTS File: ([2008/04/14 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - d:\utilities\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] d:\utilities\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = FF 00 00 00 [binary data]
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\utilities\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\utilities\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1256943299296 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\intu-qt2008 {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - C:\Program Files\QuickTax 2008\ic2008pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - d:\utilities\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/18 15:08:34 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\SETUP.EXE – File not found
O33 - MountPoints2\M\Shell - "" = AutoRun
O33 - MountPoints2\M\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\M\Shell\AutoRun\command - "" = M:\autorun.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/10/30 07:38:30 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (67849080138629120)

========== Files/Folders - Created Within 30 Days ==========

[2010/06/18 22:27:45 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\QuickScan
[2010/06/16 22:55:05 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\My Documents\QuickTax
[2010/06/16 07:53:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AnswerWorks 4.0
[2010/06/16 07:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intuit
[2010/06/16 07:53:31 | 000,000,000 | —D | C] – C:\Program Files\QuickTax 2008
[2010/06/11 20:09:27 | 000,000,000 | —D | C] – C:\WINDOWS\Lost in the City
[2010/06/11 20:09:27 | 000,000,000 | —D | C] – C:\Program Files\Lost in the City
[2010/06/07 19:31:24 | 000,000,000 | —D | C] – C:\Program Files\MagicISO
[2010/06/05 08:26:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\F-Secure
[2010/06/03 06:32:22 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/03 06:32:07 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/01 21:35:12 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Local Settings\Application Data\{A460926E-F5E9-41F7-9B64-F03315ECDFAF}
[2010/05/31 21:16:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
[2010/05/31 21:12:18 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/05/31 18:20:32 | 000,000,000 | —D | C] – C:\Program Files\Davilex
[2010/05/27 21:45:36 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\Activision
[2010/05/27 21:45:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Activision
[2010/05/22 20:15:30 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Saved Games
[2010/05/22 20:15:30 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\Flood Light Games
[2010/05/22 20:15:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Flood Light Games
[2010/05/22 20:13:53 | 000,000,000 | —D | C] – C:\WINDOWS\Dr Lynch Grave Secrets
[2010/05/21 19:15:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TheRace_dev
[2010/05/21 19:15:16 | 000,000,000 | —D | C] – C:\WINDOWS\The Race
[2010/05/21 19:13:06 | 000,000,000 | —D | C] – C:\Documents and Settings\zacr\Application Data\MysteryStudio
[2010/05/21 18:59:47 | 000,000,000 | —D | C] – C:\games
[2009/11/26 22:40:16 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/19 06:59:21 | 000,003,713 | —- | M] () – C:\Documents and Settings\zacr\Desktop\Document.rtf
[2010/06/19 06:24:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/19 04:24:16 | 061,219,236 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/06/18 22:35:29 | 006,291,456 | —- | M] () – C:\Documents and Settings\zacr\ntuser.dat
[2010/06/18 21:46:52 | 000,000,086 | —- | M] () – C:\Documents and Settings\zacr\default.pls
[2010/06/18 21:46:41 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/06/18 20:40:12 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/18 20:40:05 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/18 20:39:45 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/18 20:39:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/18 07:09:56 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\zacr\ntuser.ini
[2010/06/18 07:09:49 | 002,111,500 | -H– | M] () – C:\Documents and Settings\zacr\Local Settings\Application Data\IconCache.db
[2010/06/16 20:31:18 | 000,030,048 | —- | M] () – C:\Documents and Settings\zacr\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/16 20:29:48 | 000,139,648 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/11 20:09:41 | 000,001,676 | —- | M] () – C:\Documents and Settings\zacr\Desktop\Lost in the City.lnk
[2010/06/05 19:12:13 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/02 07:22:08 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/06/02 07:22:07 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/06/02 06:55:11 | 000,000,554 | —- | M] () – C:\WINDOWS\win.ini
[2010/06/02 06:55:11 | 000,000,282 | -HS- | M] () – C:\boot.ini
[2010/06/02 06:55:11 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/02 06:03:09 | 000,054,016 | —- | M] () – C:\WINDOWS\System32\drivers\wneeu.sys
[2010/06/01 21:35:14 | 000,000,120 | —- | M] () – C:\WINDOWS\Mvukecava.dat
[2010/06/01 21:35:14 | 000,000,000 | —- | M] () – C:\WINDOWS\Qcunezakobo.bin
[2010/06/01 21:34:36 | 000,000,000 | —- | M] () – C:\Documents and Settings\zacr\Application Data\chrtmp
[2010/05/27 21:29:35 | 000,000,843 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Transformers™ - Revenge of the Fallen™.lnk
[2010/05/27 21:08:53 | 000,164,864 | —- | M] () – C:\Documents and Settings\zacr\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/20 19:48:43 | 000,000,011 | —- | M] () – C:\WINDOWS\SBWIN.INI
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/19 06:59:21 | 000,003,713 | —- | C] () – C:\Documents and Settings\zacr\Desktop\Document.rtf
[2010/06/11 20:09:41 | 000,001,676 | —- | C] () – C:\Documents and Settings\zacr\Desktop\Lost in the City.lnk
[2010/06/02 06:03:09 | 000,054,016 | —- | C] () – C:\WINDOWS\System32\drivers\wneeu.sys
[2010/06/01 21:35:14 | 000,000,120 | —- | C] () – C:\WINDOWS\Mvukecava.dat
[2010/06/01 21:35:14 | 000,000,000 | —- | C] () – C:\WINDOWS\Qcunezakobo.bin
[2010/06/01 21:34:36 | 000,000,000 | —- | C] () – C:\Documents and Settings\zacr\Application Data\chrtmp
[2010/05/28 23:09:29 | 006,291,456 | —- | C] () – C:\Documents and Settings\zacr\ntuser.dat
[2010/05/27 21:29:35 | 000,000,843 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Transformers™ - Revenge of the Fallen™.lnk
[2010/04/18 19:25:04 | 000,000,377 | —- | C] () – C:\WINDOWS\ACTIVITY.INI
[2010/04/10 19:58:16 | 000,000,256 | —- | C] () – C:\WINDOWS\KA.INI
[2010/04/10 09:08:34 | 000,001,420 | —- | C] () – C:\WINDOWS\compedia.ini
[2010/03/28 22:58:14 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2010/03/05 23:31:00 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2010/02/19 12:10:14 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/01/06 21:33:53 | 000,004,767 | —- | C] () – C:\WINDOWS\Irremote.ini
[2010/01/03 10:43:36 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\TTSServer.dll
[2010/01/03 10:42:31 | 000,000,000 | —- | C] () – C:\WINDOWS\Setup32.INI
[2010/01/03 10:23:16 | 000,000,208 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2009/12/24 11:41:19 | 000,000,388 | —- | C] () – C:\WINDOWS\TCII.ini
[2009/11/26 22:41:08 | 000,000,011 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2009/11/26 13:34:11 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2009/11/19 13:21:10 | 000,000,247 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2009/11/15 10:27:28 | 000,000,068 | —- | C] () – C:\WINDOWS\TONKA_SR.INI
[2009/11/01 08:26:49 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/10/30 17:04:38 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2001/07/07 04:00:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1999/01/12 12:39:16 | 000,032,769 | —- | C] () – C:\WINDOWS\System32\llretal.dll
[1999/01/12 12:39:16 | 000,024,577 | —- | C] () – C:\WINDOWS\System32\vepital.dll

========== LOP Check ==========

[2010/03/11 20:29:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\3rd Eye Solutions
[2010/05/27 21:45:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Activision
[2010/05/07 13:27:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Alawar Stargaze
[2010/04/27 19:14:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Auslogics
[2010/06/02 06:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9
[2009/10/30 20:30:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Azureus
[2010/06/05 08:26:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\F-Secure
[2010/05/22 20:15:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Flood Light Games
[2010/05/05 21:53:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Gogii Games
[2010/05/22 08:23:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Harley-Davidson_ Race to the Rally Saves
[2010/03/29 08:08:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
[2010/03/16 13:41:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\JollyBear
[2010/03/29 08:12:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Nokia
[2010/04/22 13:53:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Particles
[2010/03/29 08:04:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
[2010/05/09 20:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PlayFirst
[2010/04/29 21:26:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Playrix Entertainment
[2010/05/04 15:14:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2010/05/21 19:15:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TheRace_dev
[2009/12/27 21:00:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ubisoft
[2009/12/04 11:20:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/10/30 15:17:02 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Acoustica
[2010/05/27 21:45:36 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Activision
[2010/05/22 02:15:30 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Any Video Converter
[2009/10/30 15:17:08 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Avanquest
[2009/10/30 15:17:08 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Avocent AdminWorks
[2010/06/16 06:56:30 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Azureus
[2009/10/30 15:18:15 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Coby Media Manager
[2010/05/18 21:02:44 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2010/05/22 20:15:30 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Flood Light Games
[2010/05/05 21:53:40 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Gogii Games
[2009/10/30 15:18:17 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\HTML Executable
[2009/10/30 15:18:17 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Image Zone Express
[2010/04/30 20:03:42 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\JoyBits
[2009/10/30 15:18:18 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Leadertech
[2010/03/07 00:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\LucasArts
[2009/10/30 15:18:30 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Ludia
[2009/10/30 15:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\MSNInstaller
[2010/05/21 19:13:06 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\MysteryStudio
[2010/04/09 14:07:14 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Nokia
[2010/03/29 08:04:54 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\PC Suite
[2010/05/07 10:48:45 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Pirateville
[2010/05/09 20:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\PlayFirst
[2009/10/30 15:09:40 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\ProtectDisc
[2010/06/18 22:31:54 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\QuickScan
[2010/05/13 20:43:50 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\SecretIslandEng
[2010/05/02 19:43:29 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Stereoscopic Player
[2010/04/30 09:50:10 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\TitanicMystery
[2009/12/20 07:26:37 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Webfoot
[2009/10/30 17:12:15 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Windows Desktop Search
[2009/12/05 21:12:29 | 000,000,000 | —D | M] – C:\Documents and Settings\zacr\Application Data\Windows Search

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/04/14 06:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 06:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 06:00:00 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 06:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 06:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2008/07/20 23:44:44 | 000,324,120 | —- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 – C:\WINDOWS\Dell\Intel\IaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 06:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 06:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll

< MD5 for: NVGTS.SYS >
[2008/01/21 12:15:22 | 000,102,400 | —- | M] (NVIDIA Corporation) MD5=A0B3F3A5049931657164F0FFCF0B208E – C:\WINDOWS\Dell\NVidia\nvgts.sys

< MD5 for: NVRD32.SYS >
[2008/01/21 12:15:22 | 000,128,000 | —- | M] (NVIDIA Corporation) MD5=C9128FE14E5C1E55710781B5C276F2ED – C:\WINDOWS\Dell\NVidia\nvrd32.sys

< MD5 for: SCECLI.DLL >
[2008/04/14 06:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 06:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< MD5 for: SYMMPI.SYS >
[2007/02/10 00:06:00 | 000,100,096 | —- | M] (LSI Logic) MD5=A42F863305943869BA00A613C8EE8C7E – C:\WINDOWS\Dell\LSI\symmpi.sys

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/10/30 07:44:23 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/10/30 07:44:23 | 001,089,536 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/10/30 07:44:22 | 000,933,888 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2010/06/02 07:22:07 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgmfx86.sys
[2010/06/02 07:22:08 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgtdix.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2010/06/02 06:03:09 | 000,054,016 | —- | M] () – C:\WINDOWS\system32\drivers\wneeu.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:090FB735
@Alternate Data Stream - 96 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D48500F8
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F64FC07C
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:61B54B15
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D0668210
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2D7D575C
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2E49D185
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:98DFF516
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:AD7183FA
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7C60A173
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5F95AE81
< End of report >

OTL Extras logfile created on: 19/06/2010 7:03:55 AM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = E:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 79.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 24.75 Gb Free Space | 44.28% Space Free | Partition Type: NTFS
Drive D: | 70.26 Gb Total Space | 1.59 Gb Free Space | 2.27% Space Free | Partition Type: NTFS
Drive E: | 149.05 Gb Total Space | 3.83 Gb Free Space | 2.57% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PRIMARY
Current User Name: zacr
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\utilities\AVG9\avgam.exe" = D:\utilities\AVG9\avgam.exe:*:Enabled:avgam.exe – (AVG Technologies CZ, s.r.o.)
"D:\utilities\AVG9\avgdiagex.exe" = D:\utilities\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe – (AVG Technologies CZ, s.r.o.)
"D:\utilities\AVG9\avgupd.exe" = D:\utilities\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"D:\utilities\AVG9\avgnsx.exe" = D:\utilities\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"D:\utilities\mIRC\mirc.exe" = D:\utilities\mIRC\mirc.exe:*:Enabled:mIRC – (mIRC Co. Ltd.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe – ( )
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe" = C:\Program Files\Common Files\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup – (Nero AG)
"K:\Exe\loco.exe" = K:\Exe\loco.exe:*:Enabled:LOCO Executable – File not found
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process – (Nokia Corporation)
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater – (Nokia Corporation)
"C:\Program Files\Vuze\Azureus.exe" = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze – (Vuze Inc.)
"E:\games\Transformers - Revenge of the Fallen\Transformers2.exe" = E:\games\Transformers - Revenge of the Fallen\Transformers2.exe:*:Enabled:Transformers™ - Revenge of the Fallen™ – (Activision Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode
"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION
"{08F173A8-AB81-4760-AEB0-CE91F3B05AEF}" = Activision®
"{11192AA7-FBE3-4150-9667-EE7279CCC769}" = LEGO® Indiana Jones™ 2
"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool
"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM
"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{2AFAF78F-78BC-4304-8452-0EB8ABA89BE8}" = ATI Catalyst Control Center
"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart
"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{398AB469-77FC-4935-820B-D419388C0A6A}" = LEGO® Batman™
"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{49F51417-DF8C-4272-94E3-A0D4B64060EA}" = TONKA Firefighter
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A62A775-A29A-4CE1-BBC2-4A9CD0B211EF}" = Nero Live Help
"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision
"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help
"{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help
"{5C9BB0B3-E830-4814-BBA4-D93535E1C7B9}" = Nero Live
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{7397EDED-F38A-4654-B669-BF61065803D0}" = PC Connectivity Solution
"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed
"{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed
"{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed
"{7A4AC21A-EA37-4F2A-918F-CC1D3034AEAF}_is1" = Star Wars: Rogue Squadron™ 3D
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85967580-EBC2-11D4-AEA3-0050046A88ED}" = LEGO Island 2
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express
"{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}" = LEGO® Indiana Jones™
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress
"{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA0D2D5F-612B-45D3-8759-DA87206E5CC9}" = QuickTax 2008
"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool
"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor
"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help
"{B9C9DB4C-6D77-4AE9-AD1C-C708C23239A0}" = Nokia Connectivity Cable Driver
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCC68887-6E07-4438-A035-7C22EFBDC15E}" = Intel® Network Connections [removed]
"{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0B5F130-CA18-4CF7-AD7D-8286192CFAA4}" = Tonka® On the Job
"{D596980D-17BE-4425-B8F0-5640719AADE9}" = LEGO® Star Wars™: The Complete Saga
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help
"{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}" = Nokia Software Updater
"{DAF39C60-EA29-4948-B029-8F44189D13E6}" = Fun & Learning - Puzzles & Challenges
"{E100A066-697B-419D-BC40-CDB1B00975A2}" = Harley-Davidson Race to the Rally
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget
"{E7E254C0-94AA-4B33-AF6D-5276A169A680}" = TONKA Search & Rescue 2
"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help
"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1033}" = Nero 7 Ultra Edition
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows Driver Package - Nokia Modem (10/05/2009 4.2)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"8461-7759-5462-8226" = Vuze
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.4)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"AVG9Uninstall" = AVG 9.0
"ClueFinders 3rd Grade Adventures" = ClueFinders 3rd Grade Adventures
"Comical_is1" = Comical 0.8
"Dogz" = Dogz (remove only)
"FG_2.4" = JumpStart First Grade v2.4
"Free Audio Converter_is1" = Free Audio Converter version 1.2
"gBurner" = gBurner
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"Hot Wheels 2 - Get'n Dirty" = Hot Wheels® Stunt Track Driver 2 - GET'N DIRTY™
"ie8" = Windows Internet Explorer 8
"InstallShield_{08F173A8-AB81-4760-AEB0-CE91F3B05AEF}" = Transformers™ - Revenge of the Fallen™
"InstallShield_{11192AA7-FBE3-4150-9667-EE7279CCC769}" = LEGO® Indiana Jones™ 2: The Adventure Continues
"InstallShield_{398AB469-77FC-4935-820B-D419388C0A6A}" = LEGO® Batman™
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"InstallShield_{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}" = LEGO® Indiana Jones™
"InstallShield_{D596980D-17BE-4425-B8F0-5640719AADE9}" = LEGO® Star Wars™: The Complete Saga
"Kid Pix Deluxe 3" = Kid Pix Deluxe 3
"Knight Rider" = Knight Rider
"Knight Rider 2" = Knight Rider 2
"Lost in the City1.1" = Lost in the City
"LucasArts' XvT: Flight School" = LucasArts' XvT: Flight School
"LucasArts' X-Wing" = LucasArts' X-Wing
"Magic ISO Maker v5.4 (build 0239)" = Magic ISO Maker v5.4 (build 0239)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"Nokia PC Suite" = Nokia PC Suite
"OpenAL" = OpenAL
"Photo Viewer" = Photo Viewer V208G2
"PowerISO" = PowerISO
"Reader Rabbit Learn To Read With Phonics" = Reader Rabbit Learn To Read With Phonics
"Spelling Blaster Ages 6-9" = Spelling Blaster Ages 6-9
"Stunt Track Driver" = Stunt Track Driver
"System47" = System47 Screen Saver
"Tonka Construction 2" = Tonka Construction 2
"Tonka Search and Rescue" = Tonka Search and Rescue
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7
"Yahoo! Messenger" = Yahoo! Messenger
"Zen V Series Media Explorer" = ZEN V Series Media Explorer

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 09/04/2010 1:23:13 PM | Computer Name = PRIMARY | Source = Windows Search Service | ID = 3013
Description = The entry in the hash map cannot be updated.

Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

Error - 09/04/2010 3:39:32 PM | Computer Name = PRIMARY | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module emzdecmp4_h263.dll, version 2.9.0.0, fault address 0x00002847.

Error - 09/04/2010 5:03:43 PM | Computer Name = PRIMARY | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module emzdecmp4_h263.dll, version 2.9.0.0, fault address 0x00002847.

Error - 09/04/2010 10:04:57 PM | Computer Name = PRIMARY | Source = MsiInstaller | ID = 10005
Description = Product: Microsoft Office Professional Edition 2003 – Error 25090.
Office Setup encountered a problem with the Office Source Engine, system error:
-2147023179. Please open D:\utilities\Microsoft Office\OFFICE11\1033\SETUP.CHM
and look for "Office Source Engine" for information on how to resolve this problem.

Error - 10/04/2010 12:28:29 AM | Computer Name = PRIMARY | Source = Application Error | ID = 1000
Description = Faulting application pit droids.exe, version 1.0.0.1, faulting module
pit droids.exe, version 1.0.0.1, fault address 0x0005b906.

Error - 10/04/2010 12:28:50 AM | Computer Name = PRIMARY | Source = Application Error | ID = 1000
Description = Faulting application pit droids.exe, version 1.0.0.1, faulting module
pit droids.exe, version 1.0.0.1, fault address 0x0005b906.

Error - 10/04/2010 11:08:35 AM | Computer Name = PRIMARY | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/04/2010 6:51:25 PM | Computer Name = PRIMARY | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/04/2010 6:51:25 PM | Computer Name = PRIMARY | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/04/2010 8:46:12 PM | Computer Name = PRIMARY | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module emzdecmp4_h263.dll, version 2.9.0.0, fault address 0x00002847.

[ System Events ]
Error - 18/06/2010 9:12:35 AM | Computer Name = PRIMARY | Source = Service Control Manager | ID = 7000
Description = The Audio Service service failed to start due to the following error:
%%2

Error - 18/06/2010 12:26:33 PM | Computer Name = PRIMARY | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 18/06/2010 9:59:14 PM | Computer Name = PRIMARY | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 18/06/2010 9:59:14 PM | Computer Name = PRIMARY | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 18/06/2010 9:59:14 PM | Computer Name = PRIMARY | Source = Ftdisk | ID = 262189
Description = The system could not sucessfully load the crash dump driver.

Error - 18/06/2010 9:59:14 PM | Computer Name = PRIMARY | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 18/06/2010 9:59:25 PM | Computer Name = PRIMARY | Source = Service Control Manager | ID = 7000
Description = The Audio Service service failed to start due to the following error:
%%2

Error - 18/06/2010 10:39:55 PM | Computer Name = PRIMARY | Source = Ftdisk | ID = 262189
Description = The system could not sucessfully load the crash dump driver.

Error - 18/06/2010 10:39:55 PM | Computer Name = PRIMARY | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 18/06/2010 10:40:08 PM | Computer Name = PRIMARY | Source = Service Control Manager | ID = 7000
Description = The Audio Service service failed to start due to the following error:
%%2


< End of report >
Post #4
Hello zacr

Thank you for the OTL log.

Please post the GMER log when you can. If you are having trouble getting the scan to complete let me know.
Post #6
Hello zacr

  • GMER


    • If you are having trouble getting GMER to complete a scan, please run it again, but this time uncheck everything EXCEPT "Sections" and "C:\".
    • If GMER does not produce a log please try running it from Safe Mode.

    • How to use the F8 method to Start Your Computer in Safe Mode

    • Restart your computer.
    • As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
    • Use the arrow keys to select the Safe mode menu item.
    • Press Enter.

    • If GMER in safe mode does not work, please try RootRepeal:

  • RootRepeal


    • Please download RootRepeal to your desktop
    • Physically disconnect your machine from the internet as your system will be unprotected.
    • Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
    • Click the Report tab at the bottom and then the Scan button.
    • A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
    • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
    • The scan will take a little while to run, so let it go unhindered.
    • Once it is done, click the "Save Report" button, call it RepealScan and save the log to your desktop.
    • Reconnect to the internet.

    Please provide the GMER/Rootrepeal log in your next reply. If you are still having trouble, come back and let me know.
Post #7
ok…I think I got it to do a scan…not sure…it popped up with results and didn't seem to be asking anything…I've uploaded the file
Post #9
no worries… :) here it is…

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-06-20 09:40:58
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\zacr\LOCALS~1\Temp\ufldapod.sys


—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8AA25EC5

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-
Post #10
Hello zacr

Thank you for the log.

Please work your way through the following steps:


  • Download Combofix and RE-NAME it BEFORE saving


  • Download Combofix from either of the links below. You must rename it to zacr.exe before saving it.
  • Save it to your desktop. Change the "save as file type" to "all files".
  • Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop.


  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".


Link 1
Link 2



  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.


  • NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.


  • Double click on the renamed ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.
Post #11
ok…here's the combofix log.

ComboFix 09-06-04.09 - Administrator 05/06/2009 7:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2473 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ADMINI~1\LOCALS~1\Temp\tmp2.tmp
c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\gxvxckawwryukjvmiutosljmxcunqodwglhpg.sys.rmv.rmv
c:\windows\system32\drivers\gxvxcserv.sys
c:\windows\system32\drivers\gxvxctkbefnldguypvbnpyggkmxdullkdrtql.sys.rmv
c:\windows\system32\drivers\gxvxcujwswuruyapulvhomlwncgurubopevxe.sys.rmv.rmv
c:\windows\system32\drivers\gxvxcvnorvdkmovrdqpsbaapnlgomuwyngxlt.sys
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
c:\windows\system32\gxvxcqxnkyortknsvyufibxernqeqkltppkkq.dll.rmv.rmv
c:\windows\system32\gxvxcvacrnultxmkvmdutygwhhhngdkpwffyl.dll.rmv.rmv
c:\windows\system32\msupdte.exe
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gxvxcserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.

2009-06-04 23:11 . 2008-04-13 17:39 5504 -c–a-w- c:\windows\system32\dllcache\mstee.sys
2009-06-04 23:11 . 2008-04-13 17:39 5504 —-a-w- c:\windows\system32\drivers\MSTEE.sys
2009-06-04 23:11 . 2008-04-13 17:46 10880 -c–a-w- c:\windows\system32\dllcache\ndisip.sys
2009-06-04 23:11 . 2008-04-13 17:46 10880 —-a-w- c:\windows\system32\drivers\NdisIP.sys
2009-06-04 23:11 . 2008-04-13 17:46 15232 -c–a-w- c:\windows\system32\dllcache\streamip.sys
2009-06-04 23:11 . 2008-04-13 17:46 15232 —-a-w- c:\windows\system32\drivers\StreamIP.sys
2009-06-04 23:11 . 2008-04-13 17:46 11136 -c–a-w- c:\windows\system32\dllcache\slip.sys
2009-06-04 23:11 . 2008-04-13 17:46 11136 —-a-w- c:\windows\system32\drivers\SLIP.sys
2009-06-04 23:11 . 2008-04-13 17:46 19200 -c–a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-06-04 23:11 . 2008-04-13 17:46 19200 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-06-04 23:10 . 2008-04-13 17:46 85248 -c–a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-06-04 23:10 . 2008-04-13 17:46 85248 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-06-04 23:10 . 2008-04-13 17:46 17024 -c–a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-06-04 23:10 . 2008-04-13 17:46 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-06-04 23:10 . 2001-08-18 04:36 20480 -c–a-w- c:\windows\system32\dllcache\icam5ext.dll
2009-06-04 23:10 . 2001-08-18 04:36 20480 —-a-w- c:\windows\system32\Icam5EXT.dll
2009-06-04 23:10 . 2001-08-17 20:06 100992 -c–a-w- c:\windows\system32\dllcache\icam5usb.sys
2009-06-04 23:10 . 2001-08-17 20:06 100992 —-a-w- c:\windows\system32\drivers\Icam5USB.sys
2009-06-04 23:10 . 2001-08-18 04:36 45056 -c–a-w- c:\windows\system32\dllcache\icam5com.dll
2009-06-04 23:10 . 2001-08-18 04:36 45056 —-a-w- c:\windows\system32\Icam5com.dll
2009-06-04 23:10 . 2008-04-13 23:12 53760 -c–a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-06-04 23:10 . 2008-04-13 23:12 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-06-03 17:40 . 2009-06-03 17:40 ——– d—–w- c:\documents and settings\Administrator\Application Data\Creative
2009-06-03 17:36 . 1999-12-13 15:01 44032 ——w- c:\windows\system32\CTSVCCDA.EXE
2009-06-03 17:36 . 1999-11-18 15:00 25088 ——w- c:\windows\system32\CTSVCCTL.EXE
2009-06-03 17:36 . 2009-06-03 17:36 ——– d—–w- c:\program files\Common Files\Creative
2009-06-03 17:36 . 2009-06-03 17:37 ——– d–h–w- c:\program files\Creative Installation Information
2009-06-02 05:11 . 2009-06-02 05:08 724992 —-a-w- c:\windows\iun6002.exe
2009-05-31 21:17 . 2009-05-31 21:17 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-31 21:17 . 2009-05-31 21:17 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-31 21:17 . 2009-05-31 21:17 ——– d—–w- c:\documents and settings\Administrator\Application Data\Yahoo!
2009-05-31 21:16 . 2009-05-31 21:17 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-31 21:16 . 2009-05-13 22:53 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-31 21:15 . 2009-05-31 21:17 ——– d—–w- c:\program files\Yahoo!
2009-05-28 17:31 . 2009-05-28 17:31 ——– d—–w- c:\program files\Trend Micro
2009-05-28 04:46 . 2009-05-28 04:47 ——– d—–w- c:\documents and settings\Administrator\Application Data\MSNInstaller
2009-05-23 06:41 . 2009-05-23 06:42 ——– d—–w- c:\documents and settings\Administrator\Application Data\SecondLife
2009-05-23 06:40 . 2009-05-23 06:41 ——– d—–w- c:\program files\SecondLife
2009-05-23 02:19 . 2009-05-27 18:59 ——– d—–w- c:\documents and settings\Administrator\.housecall6.6
2009-05-23 02:16 . 2009-05-23 02:16 ——– d—–w- c:\windows\Sun
2009-05-23 02:08 . 2009-05-23 02:08 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-05-23 02:08 . 2009-05-23 02:08 ——– d—–w- c:\program files\Java
2009-05-23 02:06 . 2009-05-23 02:06 152576 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-23 02:06 . 2009-05-23 02:06 ——– d—–w- c:\documents and settings\Administrator\.java

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 05:16 . 2008-10-19 07:10 ——– d—–w- c:\documents and settings\Administrator\Application Data\Azureus
2009-06-03 17:37 . 2008-11-22 15:51 ——– d—–w- c:\program files\Creative
2009-06-03 17:36 . 2008-10-18 23:01 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-02 16:50 . 2008-10-24 03:45 ——– d—–w- c:\documents and settings\Administrator\Application Data\dvdcss
2009-05-22 21:09 . 2008-10-18 23:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-05-22 14:11 . 2008-10-19 07:09 ——– d—–w- c:\program files\Vuze
2009-03-11 14:36 . 2008-12-05 14:50 18080 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-13 4351216]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2007-04-26 774168]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2006-06-07 9129984]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-09 1601304]
"PWRISOVM.EXE"="f:\utilities\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]
"ipTray.exe"="c:\program files\Intel\IDU\iptray.exe" [2005-12-03 1687552]
"awTray.exe"="c:\program files\Intel\IDU\awtray.exe" [2005-12-01 1305600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-23 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-05 13:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"e:\\games\\Monster Garage\\MonsterGarage.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SecondLife\\SecondLife.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"22583:TCP"= 22583:TCP:BitComet 22583 TCP
"22583:UDP"= 22583:UDP:BitComet 22583 UDP
"9999:UDP"= 9999:UDP:IDU Service UDP Port
"2804:TCP"= 2804:TCP:IDU Service TCP Port

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [24/10/2008 7:53 PM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [24/10/2008 7:52 PM 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [24/10/2008 7:53 PM 107272]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [29/07/2008 11:51 PM 277736]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [09/01/2009 10:32 AM 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [09/01/2009 10:32 AM 298264]
.
Contents of the 'Scheduled Tasks' folder

2009-05-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ca.yahoo.com
mStart Page = hxxp://ca.yahoo.com
uSearchURL,(Default) = hxxp://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://ca.search.yahoo.com
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x7axhqgf.default\extensions\[removed]\components\BkMrkExt.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_10\bin\NPJava11.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_10\bin\NPJava12.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_10\bin\NPJava131_10.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_10\bin\NPJava32.dll
FF - plugin: c:\program files\JavaSoft\JRE\1.3.1_10\bin\NPOJI600.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 07:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-299502267-1637723038-682003330-500\Software\SecuROM\License information*]
"datasecu"=hex:d8,74,a1,9a,29,cf,27,14,93,00,f0,cc,1e,5c,58,b4,0f,91,9b,46,37,
db,bc,7a,01,58,d9,1b,74,39,64,66,f7,31,96,bf,67,96,fa,c3,59,fd,3d,0c,fa,1f,\
"rkeysecu"=hex:db,df,8c,c5,08,68,00,81,d0,61,5e,c8,18,6e,d0,ea
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(848)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(908)
c:\windows\system32\relog_ap.dll

- - - - - - - > 'explorer.exe'(3004)
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\phonebrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng-us.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Intel\IDU\awServ.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe.old
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Executive Software\Diskeeper\DkService.exe
c:\progra~1\AVANQU~1\Fix-It\mxtask.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PnkBstrA.exe
c:\progra~1\AVANQU~1\Fix-It\mxtask.exe
c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
c:\windows\system32\searchindexer.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
c:\progra~1\MICROS~2\rapimgr.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-06-05 7:57 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-05 13:55

Pre-Run: 34,816,053,248 bytes free
Post-Run: 35,443,851,264 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

250 — E O F — 2009-04-23 03:58
Post #12
Hello zacr

Thank you for the log.

If you are saving the logs from the infected machine to a flash drive (USB stick) and transferring them to your clean system for posting onto the forum, please do the following:


  • Please download Flash Disinfector


    • Click here to download Flash Disinfector and save the file (called Flash_Disinfector.exe) to your desktop.
    • Double click on the Flash_Disinfector.exe icon to run the program and follow any prompts that may appear.
    • The program may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so if prompted.
    • Wait until Flash disinfector has finished scanning and then exit the program.
    • Reboot your computer.


    Before we continue, I would like to run some more scans (I have the feeling that there may be more to this infection than meets the eye).

  • DeFogger


    • Please download DeFogger to your desktop.
    • Double click DeFogger to run the tool.
    • The application window will appear
    • Click the Disable button to disable your CD Emulation drivers
    • Click Yes to continue
    • A 'Finished!' message will appear
    • Click OK
    • DeFogger will now ask to reboot the machine - click OK
      IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
      Do not re-enable these drivers until otherwise instructed.

  • GMER


    • Double click GMER.exe.
    • If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    • In the right panel, you will see several boxes that have been checked. Uncheck the following …

    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)

    • Please make sure that "Sections" box is checked.

    • Then click the Scan button & wait for it to finish.
    • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
    • Save it where you can easily find it, such as your desktop, and attach it in your reply.

    If GMER fails to complete, try the scan from safe mode.

    Are you still having trouble posting on the forum using the infected machine? Please let me know (important).

    Please include the GMER log and your machine symptoms in the next reply.
Post #13
well, I always figured there was more to the issue…I just couldn't figure out what…got the most recent gmer log done in safe mode….I think it's much more than it was… :)

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-22 06:01:26
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\zacr\LOCALS~1\Temp\ufldapod.sys


—- Kernel code sections - GMER 1.0.15 —-

.rsrc C:\WINDOWS\system32\drivers\atapi.sys entry point in ".rsrc" section [0xF74B0794]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[588] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 009A000A
.text C:\WINDOWS\system32\svchost.exe[588] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 009B000A
.text C:\WINDOWS\system32\svchost.exe[588] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0099000C
.text C:\WINDOWS\system32\svchost.exe[588] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0142000A
.text C:\WINDOWS\Explorer.EXE[1072] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B7000A
.text C:\WINDOWS\Explorer.EXE[1072] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00C1000A
.text C:\WINDOWS\Explorer.EXE[1072] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B6000C

—- Devices - GMER 1.0.15 —-

Device -> \Driver\atapi \Device\Harddisk0\DR0 8AAD5EC5

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@E:\games\LEGO\xae Indiana Jones\x2122 2\Audio\Audio.CFG 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@E:\games\LEGO\xae Indiana Jones\x2122 2\Audio\_CutScenes\AkatorHub_Intro.ogg 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@E:\games\LEGO\xae Indiana Jones\x2122 2\Audio\_Music\1_0_HUB_1Nepal_Qui.ogg 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@E:\games\LEGO\xae Indiana Jones\x2122 2\Movies\PC\attract.bik 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 1

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-
Post #14
as for the symptoms, well, there are 3 most notable. first is that it's very slow in doing anything and most video is very choppy and lags alot. second is that while my brower is open, I get a popup at least once every 15 minutes or so. third is that after a few hours of the computer being on, I have no control of sound settings because it says there's nothing for sound devices until I restart. those are the biggest things I'm seeing.
Post #15
Hello zacr

Please do the following:


  • Please run the following command


    • Click on "Start" and then on "Run".
    • Copy and paste the following single line command into the Run box and click OK:

    cmd /c "mbr -t" >Log.txt&Log.txt&del Log.txt

    • A Notepad file will open.
    • Post the contents of the Log.txt in your next reply.

  • FileLister


    • Please download FileLister by clicking here and save the file (called Filelister.zip) to your desktop.
    • Right click , select ->> "Extract all" ->> And extract it to your Desktop.
    • Additional help on extracting zip files can be found Here
    • Open the File Lister Folder.
    • Note: Leave the FileLister.vbe file in the folder and run it from there.

    [external image: Posted Image]

    • Right Click on "FileLister.vbe" ->> Select "Open", then Open to confirm.
    • When the program is finshed it will produce a log for you at C:\Files.txt

    Please provide both logs in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI