What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Broswer Hijacked - HijackThis Log attached - Please help!

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please review the below HijackThis log, and let me know what I can do to remove this annoying matter. I have tried all the regular malware software that I can find for free (AVG, MalwareBytes, all the software available from Trend Micro, and more) to no avail. I am pretty computer literate, but this is driving me insane. Everytime I click the link from a search engine (yahoo, google, etc) the link takes me to a random advertisement/spam page or another random search engine that I've never heard of. Its a different site that it brings me to each time. Please help.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\Global Payments VPN\Global VPN Client\cvpnd.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PAYCLOCK\BTENG32M.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\PAYCLOCK\PCSCMGR.EXE
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\DELL\Dell Laser MFP 1815\NetworkScan\DNSCST.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe
C:\WINDOWS\Twain_32\Dell\Dell2335\Scan2pc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\GoldMine\gmw.exe
C:\WINDOWS\Seiko\Slppm.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = \\server01\intranet\index1.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://server01/intranet/index1.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://server01/intranet/index1.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\system32\igfxtray.exe"
O4 - HKLM\..\Run: [Persistence] "C:\WINDOWS\system32\igfxpers.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] "stsystra.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
O4 - HKLM\..\Run: [Synchronization Manager] "%SystemRoot%\system32\mobsync.exe" /logon
O4 - HKLM\..\Run: [PayClockServer] "C:\PAYCLOCK\PCSCMGR.EXE"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [vptray] "C:\PROGRA~1\SYMANT~1\VPTray.exe"
O4 - HKLM\..\Run: [DellNSCST_GRNCH] "C:\Program Files\DELL\Dell Laser MFP 1815\NetworkScan\DNSCST.exe" /HIDEUI
O4 - HKLM\..\Run: [AVG9_TRAY] "C:\PROGRA~1\AVG\AVG9\avgtray.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ScreenPrint32] "C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe" -startup
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Dell PanelMgr] C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [2335dn Scan2PC] "C:\WINDOWS\Twain_32\Dell\Dell2335\Scan2pc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-4089874284-3848830119-3993678026-1186\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Global Payments Inc. GPN VPN Client.lnk = C:\Program Files\Global Payments VPN\Global VPN Client\ipsecdialer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://server01/intranet/index.html
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = usbankcardservice.local
O17 - HKLM\Software\..\Telephony: DomainName = usbankcardservice.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA7FD878-5516-48BF-8D9D-979DF05821AB}: NameServer = 192.168.10.100
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = usbankcardservice.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = usbankcardservice.local
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Global Payments VPN\Global VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PayClock Database Service (PayClockServer) - MLB Computer Consulting - C:\PAYCLOCK\BTENG32M.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
Post #5
Here is the log from GooredFix, I couldn't figure out how to post the one from TDSSKiller, I don't know where/if it saved the log before making me reboot. What's your thoughts?


========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [23:22 09/06/2010]

C:\Documents and Settings\bmccarthy\Application Data\Mozilla\Firefox\Profiles\3dd6ljcv.default\extensions\
{0b457cAA-602d-484a-8fe7-c1d894a011ba} [17:19 07/07/2010]
{20a82645-c095-46ed-80e3-08825760534b} [16:02 10/06/2010]
{37E4D8EA-8BDA-4831-8EA1-89053939A250}(2) [15:38 14/06/2010]
{e001c731-5e37-4538-a5cb-8168736a2360} [15:44 14/06/2010]
{f199da35-0a9a-4ce9-8f59-c68524deba93}(2) [21:35 11/06/2010]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [10:05 22/08/2009]
"[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [18:11 08/06/2010]

-=E.O.F=-



I think it worked! but then again, I've thought that before…only to find a few days later that I was wrong.
Post #6
Lets keep going :thumbup:

Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:


Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have SP3, use the SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.
Post #7
I ran the ATFCleaner but am unable to get combofix to perform. I downloaded it, open it and just wait and the blue screen gets stuck on "preparing to run". I made sure not to touch it and to just let it do it's thing, I even left it running over the night to see if maybe it just takes a long time to complete…..no bueno. It didn't work…………what else can we do? Also, I've noticed since yesterday, that response from IE 8 is extremly lagged. For instance, if I click on the address bar, I have to click like 20 times before it actually gives me the typing cursor and allows me to type. Or if I want to resize a browser window, the little arrow sometimes doesn't popup when I hover around the corners……hmmm.
Post #8
Go ahead and end the task for combofix. It shouldn't take anymore than 30 mins at most. See if you can find the log from TDSS C:\ drive called TDSSKiller_* (* denotes version & date) If you find it, post the log.
Post #9
Here it is…. 15:04:47:356 4708 TDSS rootkit removing tool 2.3.2.2 Jun 30 2010 17:23:49 15:04:47:356 4708 ================================================================================ 15:04:47:356 4708 SystemInfo: 15:04:47:356 4708 OS Version: 5.1.2600 ServicePack: 3.0 15:04:47:356 4708 Product type: Workstation 15:04:47:356 4708 ComputerName: EXECASST 15:04:47:356 4708 UserName: bmccarthy 15:04:47:356 4708 Windows directory: C:\WINDOWS 15:04:47:356 4708 System windows directory: C:\WINDOWS 15:04:47:356 4708 Processor architecture: Intel x86 15:04:47:356 4708 Number of processors: 2 15:04:47:356 4708 Page size: 0x1000 15:04:47:356 4708 Boot type: Normal boot 15:04:47:356 4708 ================================================================================ 15:04:47:777 4708 Initialize success 15:04:47:777 4708 15:04:47:777 4708 Scanning Services … 15:04:47:887 4708 Raw services enum returned 389 services 15:04:47:902 4708 15:04:47:902 4708 Scanning Drivers … 15:04:49:605 4708 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS 15:04:49:698 4708 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 15:04:49:761 4708 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 15:04:49:823 4708 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys 15:04:49:902 4708 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 15:04:49:995 4708 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys 15:04:50:058 4708 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys 15:04:50:120 4708 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys 15:04:50:167 4708 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys 15:04:50:230 4708 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys 15:04:50:276 4708 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys 15:04:50:355 4708 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys 15:04:50:401 4708 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys 15:04:50:495 4708 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys 15:04:50:542 4708 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys 15:04:50:573 4708 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys 15:04:50:604 4708 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys 15:04:50:667 4708 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys 15:04:50:714 4708 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 15:04:50:776 4708 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 15:04:50:839 4708 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 15:04:50:901 4708 ATMDLC (7db8f75c18d5bf31ddfba350d70d154d) C:\WINDOWS\system32\DRIVERS\atmdlc.sys 15:04:50:932 4708 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 15:04:50:995 4708 AvgLdx86 (9c0a7e6d3cb9a8a7ad4e4575d9a42e94) C:\WINDOWS\System32\Drivers\avgldx86.sys 15:04:51:042 4708 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\System32\Drivers\avgmfx86.sys 15:04:51:089 4708 AvgTdiX (6e11bbc8dc5af836adc9c5f682fa3186) C:\WINDOWS\System32\Drivers\avgtdix.sys 15:04:51:120 4708 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 15:04:51:167 4708 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys 15:04:51:198 4708 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 15:04:51:229 4708 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys 15:04:51:260 4708 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 15:04:51:323 4708 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 15:04:51:385 4708 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 15:04:51:463 4708 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys 15:04:51:526 4708 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys 15:04:51:604 4708 CVPNDRV (f7b10264938d9515d13cbdaf8def905e) C:\WINDOWS\system32\Drivers\CVPNDRV.sys 15:04:51:651 4708 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys 15:04:51:682 4708 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys 15:04:51:729 4708 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 15:04:51:807 4708 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 15:04:51:885 4708 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 15:04:51:932 4708 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 15:04:51:963 4708 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 15:04:51:979 4708 DNE (01954d020887671fec9929172847f35d) C:\WINDOWS\system32\DRIVERS\dne2000.sys 15:04:52:088 4708 dpK00701 (8fe15fc80c9cbae53130e3c873f30080) C:\WINDOWS\system32\DRIVERS\dpK00701.sys 15:04:52:151 4708 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys 15:04:52:260 4708 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 15:04:52:354 4708 DSproct (2ac2372ffad9adc85672cc8e8ae14be9) C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys 15:04:52:432 4708 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys 15:04:52:526 4708 e1express (00192f0c612591d585594e9467e6ca8b) C:\WINDOWS\system32\DRIVERS\e1e5132.sys 15:04:52:635 4708 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 15:04:52:713 4708 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 15:04:52:776 4708 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 15:04:52:838 4708 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 15:04:52:916 4708 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 15:04:52:994 4708 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 15:04:53:041 4708 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 15:04:53:104 4708 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 15:04:53:150 4708 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 15:04:53:182 4708 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 15:04:53:228 4708 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys 15:04:53:307 4708 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 15:04:53:400 4708 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 15:04:53:463 4708 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 15:04:53:556 4708 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 15:04:53:650 4708 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys 15:04:53:713 4708 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys 15:04:53:791 4708 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 15:04:53:853 4708 ialm (0674ce8ae167d830b871a99c677c5c59) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 15:04:53:994 4708 iaStor (435f48fa1be0dd06b19841686bec1be5) C:\WINDOWS\system32\drivers\iaStor.sys 15:04:54:009 4708 Suspicious file (Forged): C:\WINDOWS\system32\drivers\iaStor.sys. Real md5: 435f48fa1be0dd06b19841686bec1be5, Fake md5: 019cf5f31c67030841233c545a0e217a 15:04:54:009 4708 File "C:\WINDOWS\system32\drivers\iaStor.sys" infected by TDSS rootkit … 15:04:55:353 4708 Backup copy found, using it.. 15:04:55:384 4708 will be cured on next reboot 15:04:55:493 4708 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 15:04:55:587 4708 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys 15:04:55:649 4708 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 15:04:55:712 4708 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 15:04:55:790 4708 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 15:04:55:821 4708 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 15:04:55:884 4708 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 15:04:55:962 4708 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 15:04:56:024 4708 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 15:04:56:087 4708 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 15:04:56:165 4708 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 15:04:56:227 4708 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 15:04:56:290 4708 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 15:04:56:352 4708 klmd23 (316353165feba3d0538eaa9c2f60c5b7) C:\WINDOWS\system32\drivers\klmd.sys 15:04:56:415 4708 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 15:04:56:430 4708 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 15:04:56:509 4708 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 15:04:56:555 4708 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 15:04:56:587 4708 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 15:04:56:649 4708 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 15:04:56:680 4708 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 15:04:56:758 4708 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys 15:04:56:837 4708 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 15:04:56:899 4708 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 15:04:57:024 4708 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 15:04:57:102 4708 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 15:04:57:180 4708 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 15:04:57:227 4708 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 15:04:57:290 4708 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 15:04:57:352 4708 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 15:04:57:430 4708 NAL (1e59aaed42a5e3a5ed86ec403f9c0776) C:\WINDOWS\system32\Drivers\iqvw32.sys 15:04:57:618 4708 NAVENG (83518e6cc82bdc3c3db0c12d1c9a2275) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20100521.002\naveng.sys 15:04:57:664 4708 NAVEX15 (85cf37740fe06c7a2eaa7f6c81f0819c) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20100521.002\navex15.sys 15:04:57:789 4708 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 15:04:57:867 4708 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 15:04:57:946 4708 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 15:04:58:008 4708 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 15:04:58:086 4708 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys 15:04:58:180 4708 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 15:04:58:274 4708 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 15:04:58:320 4708 NetworkX (5ef7dd401771693245d46f4b0b69fe2b) C:\WINDOWS\system32\ckldrv.sys 15:04:58:383 4708 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 15:04:58:461 4708 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 15:04:58:539 4708 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\WINDOWS\system32\DRIVERS\NuidFltr.sys 15:04:58:602 4708 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 15:04:58:695 4708 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 15:04:58:898 4708 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 15:04:58:945 4708 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 15:04:59:023 4708 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 15:04:59:086 4708 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 15:04:59:133 4708 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 15:04:59:195 4708 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 15:04:59:273 4708 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 15:04:59:336 4708 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 15:04:59:414 4708 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys 15:04:59:461 4708 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys 15:04:59:523 4708 Point32 (dcdf0421a1c14f2923e298a30fd7636d) C:\WINDOWS\system32\DRIVERS\point32.sys 15:04:59:586 4708 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 15:04:59:648 4708 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 15:04:59:679 4708 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 15:04:59:742 4708 pwipf6 (f13d0659bfc22b97cf0d3a4b9f43f62c) C:\WINDOWS\system32\drivers\pwipf6.sys 15:04:59:835 4708 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys 15:04:59:882 4708 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys 15:04:59:914 4708 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys 15:04:59:945 4708 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys 15:04:59:992 4708 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys 15:05:00:007 4708 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys 15:05:00:070 4708 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 15:05:00:117 4708 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 15:05:00:179 4708 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 15:05:00:210 4708 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 15:05:00:273 4708 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 15:05:00:288 4708 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 15:05:00:351 4708 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 15:05:00:491 4708 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 15:05:00:616 4708 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 15:05:00:695 4708 Revoflt (8b5b8a11306190c6963d3473f052d3c8) C:\WINDOWS\system32\DRIVERS\revoflt.sys 15:05:00:726 4708 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys 15:05:00:804 4708 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys 15:05:00:929 4708 SAVRT (c8023be4dda22a52cd2f60d9cb9b3985) C:\Program Files\Symantec AntiVirus\savrt.sys 15:05:01:007 4708 SAVRTPEL (30547fd7692dc799a0b397b2b918a158) C:\Program Files\Symantec AntiVirus\Savrtpel.sys 15:05:01:069 4708 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 15:05:01:116 4708 Ser2pl (2ec41a96d0dc98bd119bf325e0b9f392) C:\WINDOWS\system32\DRIVERS\ser2pl.sys 15:05:01:163 4708 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 15:05:01:210 4708 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 15:05:01:257 4708 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 15:05:01:319 4708 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys 15:05:01:397 4708 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys 15:05:01:460 4708 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 15:05:01:507 4708 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 15:05:01:585 4708 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys 15:05:01:632 4708 ssfs0bbc (a3cc244f1e043c2b7ae32899ff99a0a0) C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys 15:05:01:647 4708 sshrmd (e041026dafa17af2610afc4da8f4ea14) C:\WINDOWS\system32\DRIVERS\sshrmd.sys 15:05:01:679 4708 ssidrv (5a40b485825cc31b3a49bb4701b30d35) C:\WINDOWS\system32\DRIVERS\ssidrv.sys 15:05:01:772 4708 STHDA (797fcc1d859b203958e915bb82528da9) C:\WINDOWS\system32\drivers\sthda.sys 15:05:01:944 4708 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 15:05:02:007 4708 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 15:05:02:038 4708 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys 15:05:02:069 4708 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys 15:05:02:194 4708 SymEvent (42123611a49c33536ab29bdd852a9f5e) C:\Program Files\Symantec\SYMEVENT.SYS 15:05:02:241 4708 SYMREDRV (145eaae477f5b56f2621956150a143b0) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS 15:05:02:319 4708 SYMTDI (926efafc087d356bba50bdf6e640bc13) C:\WINDOWS\System32\Drivers\SYMTDI.SYS 15:05:02:350 4708 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys 15:05:02:381 4708 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys 15:05:02:428 4708 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 15:05:02:491 4708 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 15:05:02:553 4708 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 15:05:02:600 4708 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 15:05:02:647 4708 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 15:05:02:709 4708 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys 15:05:02:772 4708 TOUCHDSP (628b045d87cf7f0f5ba3f8c531354f9d) C:\WINDOWS\system32\Drivers\TOUCHDSP.sys 15:05:02:850 4708 TOUCHSTA (fba31f359f3f101be98c39ef400329f1) C:\WINDOWS\system32\drivers\TouchSta.sys 15:05:02:928 4708 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 15:05:02:991 4708 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys 15:05:03:053 4708 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 15:05:03:209 4708 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 15:05:03:256 4708 UsbdpFP (a3a421ace198652d2b198f1553c79243) C:\WINDOWS\system32\DRIVERS\UsbdpFP.sys 15:05:03:334 4708 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 15:05:03:412 4708 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 15:05:03:475 4708 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 15:05:03:553 4708 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 15:05:03:678 4708 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 15:05:03:725 4708 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 15:05:03:787 4708 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 15:05:03:850 4708 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys 15:05:03:897 4708 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys 15:05:03:943 4708 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 15:05:03:990 4708 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 15:05:04:053 4708 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 15:05:04:178 4708 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 15:05:04:256 4708 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 15:05:04:334 4708 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 15:05:04:365 4708 Reboot required for cure complete.. 15:05:04:428 4708 Cure on reboot scheduled successfully 15:05:04:428 4708 15:05:04:428 4708 Completed 15:05:04:428 4708 15:05:04:428 4708 Results: 15:05:04:428 4708 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 15:05:04:428 4708 File objects infected / cured / cured on reboot: 1 / 0 / 1 15:05:04:428 4708 15:05:04:428 4708 KLMD(ARK) unloaded successfully
Post #10
OK so there was a rootkit.

Try this

  • Now physically disconnect from the internet and STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields)
  • Click on your START button and choose Run. Then copy/paste the entire content of the following quotebox (Including the "" marks and the Symbols) into the run box.

    Go to [external image: Posted Image] -> Run -> copy/paste in the following single line command & click OK

    "%userprofile%\desktop\combofix.exe" /killall


    [external image: Posted Image]
  • Click OK and this will start ComboFix in a special way.
  • When finished, it will produce a log. Please save that log to a Notepad File to post in your next reply along with a fresh HJT log.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

* After you have saved the logs, restart your system to re-enable all the programs that were disabled during the running of ComboFix.

* Reconnect to the internet

* Post the following logs/Reports:
  • ComboFix.txt
Post #11
Here's the combofix log……I think. :) ComboFix 10-07-07.02 - bmccarthy 07/08/2010 9:38:01.1.2 - x86 Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe Command switches used :: /killall * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\gjones\g2mdlhlpx.exe C:\Documents and Settings\jburgeson\System C:\Documents and Settings\jburgeson\System\win_qs8.jqx C:\Documents and Settings\meudaily\g2mdlhlpx.exe C:\Documents and Settings\nbauereis\g2mdlhlpx.exe C:\LOG1.tmp C:\LOG13.tmp C:\LOG14.tmp C:\LOG1C3.tmp C:\LOG1E8.tmp C:\LOG1EB.tmp C:\LOG2.tmp C:\LOG21.tmp C:\LOG2AE.tmp C:\LOG2EA.tmp C:\LOG32A.tmp C:\LOG4.tmp C:\LOG58.tmp C:\LOG6E.tmp C:\LOG7.tmp C:\LOG8.tmp C:\LOG93.tmp C:\LOG9D.tmp C:\LOG9E.tmp C:\LOGC8.tmp C:\LOGD6.tmp C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.15-3.inf C:\WINDOWS\Downloaded Program Files\popcaploader.inf C:\WINDOWS\system32\3243037175.dat C:\WINDOWS\system32\Cache . ((((((((((((((((((((((((( Files Created from 2010-06-08 to 2010-07-08 ))))))))))))))))))))))))))))))) . 2010-07-07 21:40:01 . 2010-07-07 21:40:01 ——– d—–w- C:\Documents and Settings\bmccarthy\Local Settings\Application Data\Help 2010-07-07 19:59:06 . 2010-07-07 19:59:06 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\AdobeUM 2010-07-07 19:00:53 . 1997-04-09 03:08:10 299520 —-a-w- C:\WINDOWS\uninst.exe 2010-07-07 18:58:36 . 2010-07-07 18:58:36 ——– d—–w- C:\Lxk700 2010-07-06 18:56:57 . 2010-07-06 18:56:57 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2010-07-06 18:54:28 . 2010-07-06 18:54:28 ——– d—–w- C:\Program Files\Common Files\Adobe Systems Shared 2010-06-25 21:39:51 . 2010-06-25 21:40:07 ——– d—–w- C:\Program Files\Browser Hijack Recover 2010-06-24 20:33:16 . 2010-06-24 20:51:33 ——– d—–w- C:\Program Files\Free Window Registry Repair 2010-06-24 15:49:49 . 2010-06-24 15:53:48 ——– d—–w- C:\Documents and Settings\All Users\Application Data\WinZip 2010-06-22 18:43:39 . 2008-11-13 17:47:28 94208 —-a-w- C:\WINDOWS\system32\Dell2335Port_x86.dll 2010-06-22 17:59:09 . 2010-06-22 17:59:09 ——– d—–w- C:\found.000 2010-06-21 22:01:45 . 2010-06-21 22:02:13 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Attachmate 2010-06-21 22:01:36 . 2010-06-21 22:01:45 ——– d—–w- C:\Program Files\Attachmate 2010-06-21 22:00:58 . 2010-06-21 22:00:58 ——– d—–w- C:\Documents and Settings\bmccarthy\Local Settings\Application Data\Apple Computer 2010-06-18 17:24:40 . 2010-06-18 17:24:36 95024 —-a-w- C:\WINDOWS\system32\drivers\SBREDrv.sys 2010-06-18 17:06:51 . 2010-06-18 17:09:45 ——– d—–w- C:\Documents and Settings\bmccarthy\Local Settings\Application Data\Temp 2010-06-18 17:06:01 . 2010-06-24 20:58:31 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Lavasoft 2010-06-16 04:17:39 . 2010-06-16 04:17:39 ——– d—–w- C:\Documents and Settings\credit\Application Data\Office Genuine Advantage 2010-06-16 04:16:38 . 2010-06-16 04:16:38 ——– d—–w- C:\Documents and Settings\credit\Application Data\Webroot 2010-06-16 04:15:20 . 2010-06-16 04:15:21 ——– d—–w- C:\Documents and Settings\credit\Local Settings\Application Data\S2PC 2010-06-16 04:12:45 . 2010-06-16 04:12:45 ——– d-sh–w- C:\Documents and Settings\credit\IETldCache 2010-06-14 15:46:51 . 2010-06-14 15:46:51 ——– d—–w- C:\WINDOWS\system32\wbem\Repository 2010-06-14 15:44:51 . 2010-06-14 15:44:54 ——– d—–w- C:\Program Files\Malwarebytes' Anti-Malware 2010-06-14 15:44:51 . 2010-06-14 15:44:51 ——– d—–w- C:\Program Files\Microsoft Plus! Digital Media Edition 2010-06-14 15:43:40 . 2010-06-14 15:43:41 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Webroot 2010-06-14 15:43:40 . 2010-06-14 15:43:40 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\Webroot 2010-06-14 15:43:29 . 2010-06-14 15:43:29 ——– d—–w- C:\Program Files\Webroot 2010-06-14 15:38:14 . 2010-06-14 15:38:14 ——– d—–w- C:\Documents and Settings\Default User\IETldCache 2010-06-11 20:11:08 . 2010-06-14 15:43:30 ——– d—–w- C:\Program Files\Trend Micro 2010-06-11 15:33:46 . 2010-06-11 15:33:46 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\SUPERAntiSpyware.com 2010-06-10 18:28:20 . 2010-06-10 18:28:20 ——– d-sh–w- C:\WINDOWS\system32\config\systemprofile\IETldCache 2010-06-10 17:30:46 . 2010-06-10 17:30:46 ——– d—–w- C:\Program Files\MSSOAP 2010-06-10 17:30:36 . 2010-06-10 17:17:46 108880 —-a-w- C:\WINDOWS\system32\drivers\pwipf6.sys 2010-06-10 17:30:09 . 2009-11-06 22:19:42 1563008 —-a-w- C:\WINDOWS\WRSetup.dll 2010-06-10 17:19:17 . 2010-06-10 17:19:26 164 —-a-w- C:\WINDOWS\install.dat 2010-06-09 23:25:00 . 2010-06-09 23:25:00 0 —-a-w- C:\WINDOWS\nsreg.dat 2010-06-09 23:24:24 . 2010-06-09 23:24:24 ——– d—–w- C:\Documents and Settings\bmccarthy\Local Settings\Application Data\Mozilla 2010-06-09 20:20:26 . 2010-06-09 20:20:26 ——– d—–w- C:\Documents and Settings\All Users\CrypKey 2010-06-09 20:20:24 . 2010-06-09 20:20:25 4 —-a-w- C:\WINDOWS\vx86036.dat 2010-06-09 20:19:45 . 2008-05-07 23:29:38 122880 —-a-w- C:\WINDOWS\system32\Crypserv.exe 2010-06-09 20:19:45 . 2008-03-17 16:45:52 19584 —-a-w- C:\WINDOWS\system32\Ckldrv.sys 2010-06-09 20:19:45 . 1999-06-18 20:49:32 165888 —-a-w- C:\WINDOWS\Ckconfig.exe 2010-06-09 20:19:45 . 1996-05-03 16:21:20 27648 —-a-r- C:\WINDOWS\Setup_ck.exe 2010-06-09 20:19:45 . 1996-05-03 14:36:50 18432 —-a-w- C:\WINDOWS\Setup_ck.dll 2010-06-09 20:19:45 . 1995-07-04 17:33:04 11776 —-a-w- C:\WINDOWS\Ckrfresh.exe 2010-06-09 20:19:37 . 2006-04-17 18:56:50 1207808 —-a-w- C:\WINDOWS\system32\PhoenixDll.dll 2010-06-09 20:19:37 . 2004-10-17 04:46:54 178176 —-a-w- C:\WINDOWS\system32\StellarProfile.dll 2010-06-09 16:38:35 . 2010-06-09 16:38:49 ——– d—–w- C:\Documents and Settings\All Users\Application Data\NortonInstaller 2010-06-08 23:39:35 . 2010-06-09 00:31:03 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\U3 2010-06-08 23:39:14 . 2010-06-08 23:39:14 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\SharePod 2010-06-08 23:02:50 . 2010-06-08 23:02:50 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\VS Revo Group 2010-06-08 21:09:09 . 2010-06-08 21:09:09 ——– d—–w- C:\Documents and Settings\jburgeson\Local Settings\Application Data\S2PC 2010-06-08 21:08:00 . 2010-06-08 21:08:00 ——– d-sh–w- C:\Documents and Settings\jburgeson\IETldCache 2010-06-08 18:44:00 . 2010-06-08 18:44:00 ——– d-sh–w- C:\Documents and Settings\bmccarthy\IECompatCache 2010-06-08 18:43:23 . 2010-06-08 18:43:23 ——– d-sh–w- C:\Documents and Settings\bmccarthy\PrivacIE 2010-06-08 18:40:50 . 2010-06-08 18:40:50 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\Office Genuine Advantage 2010-06-08 18:37:57 . 2010-06-08 18:37:57 ——– d-sh–w- C:\Documents and Settings\NetworkService\IETldCache 2010-06-08 18:32:44 . 2010-06-08 18:32:44 ——– d-sh–w- C:\Documents and Settings\bmccarthy\IETldCache 2010-06-08 18:15:11 . 2010-06-08 18:15:25 ——– dc-h–w- C:\WINDOWS\ie8 2010-06-08 18:12:03 . 2010-06-08 18:11:16 411368 —-a-w- C:\WINDOWS\system32\deployJava1.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-07-08 16:17:11 . 2008-02-15 19:25:26 ——– d—–w- C:\Program Files\QuikChex 2010-07-07 22:12:15 . 2007-07-02 23:22:06 246784 —-a-w- C:\WINDOWS\system32\drivers\iaStor.sys 2010-07-07 21:40:01 . 2010-04-21 19:36:19 ——– d—–w- C:\Program Files\ScreenPrint32 v3 2010-07-07 19:01:30 . 2010-07-07 19:01:30 ——– d—–w- C:\Program Files\Lexmark Z700-P700 Series 2010-07-07 14:58:25 . 2009-07-17 23:53:44 ——– d—–w- C:\Documents and Settings\All Users\Application Data\NOS 2010-07-06 18:53:13 . 2007-07-02 23:50:52 ——– d—–w- C:\Program Files\Common Files\Adobe 2010-07-06 18:40:46 . 2010-04-06 17:46:33 ——– d—–w- C:\Program Files\Common Files\Adobe AIR 2010-07-01 17:49:05 . 2009-01-29 19:50:29 ——– d—–w- C:\Program Files\GoldMine 2010-06-25 00:07:08 . 2010-04-08 20:11:21 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Roxio 2010-06-22 17:43:08 . 2007-07-02 23:42:50 ——– d—–w- C:\Program Files\Dell 2010-06-21 17:11:16 . 2007-07-02 23:50:08 ——– d—–w- C:\Program Files\Google 2010-06-11 18:12:59 . 2007-08-29 21:54:40 ——– d—–w- C:\Program Files\MSN Messenger 2010-06-08 23:01:34 . 2008-11-06 20:35:15 ——– d—–w- C:\Program Files\Smart Label 2010-06-08 23:00:50 . 2008-01-23 16:41:52 ——– d—–w- C:\Documents and Settings\cgalloway\Application Data\Download Manager 2010-06-08 18:15:12 . 2010-06-07 23:41:01 ——– d—–w- C:\Program Files\Spybot - Search & Destroy 2010-06-08 18:15:12 . 2010-06-07 23:41:01 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2010-06-08 18:12:45 . 2007-07-02 23:38:09 ——– d—–w- C:\Program Files\Common Files\Java 2010-06-08 18:11:04 . 2007-07-02 23:38:10 ——– d—–w- C:\Program Files\Java 2010-06-08 15:35:27 . 2007-07-09 16:36:37 ——– d—–w- C:\Program Files\Yahoo! 2010-06-04 18:07:06 . 2010-06-04 18:07:06 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\Malwarebytes 2010-06-04 18:06:37 . 2010-06-04 18:06:37 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2010-06-02 17:44:51 . 2007-07-11 18:27:03 ——– d—–w- C:\Program Files\Global Payments VPN 2010-06-02 17:44:44 . 2007-07-02 23:42:10 ——– d–h–w- C:\Program Files\InstallShield Installation Information 2010-06-02 16:38:34 . 2010-06-01 19:00:55 242896 —-a-w- C:\WINDOWS\system32\drivers\avgtdix.sys 2010-06-02 16:38:32 . 2010-06-02 16:38:32 12464 —-a-w- C:\WINDOWS\system32\avgrsstx.dll 2010-06-02 16:38:32 . 2010-06-01 19:00:49 29584 —-a-w- C:\WINDOWS\system32\drivers\avgmfx86.sys 2010-06-02 16:37:46 . 2010-06-01 19:00:49 216200 —-a-w- C:\WINDOWS\system32\drivers\avgldx86.sys 2010-06-01 23:48:18 . 2010-06-01 23:48:18 ——– d—–w- C:\Program Files\VS Revo Group 2010-06-01 22:38:16 . 2010-04-08 20:08:45 ——– d—–w- C:\Program Files\Common Files\Research In Motion 2010-06-01 22:38:16 . 2010-04-08 20:08:43 ——– d—–w- C:\Program Files\Research In Motion 2010-06-01 22:38:12 . 2010-04-08 20:09:11 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Research In Motion 2010-06-01 18:56:46 . 2010-06-01 16:49:42 ——– d—–w- C:\Documents and Settings\All Users\Application Data\avg9 2010-06-01 18:04:45 . 2010-06-01 18:04:45 ——– d—–w- C:\Documents and Settings\All Users\Application Data\GTek 2010-06-01 18:04:45 . 2010-04-20 21:38:03 ——– d–h–w- C:\Documents and Settings\bmccarthy\Application Data\Gtek 2010-06-01 18:03:49 . 2010-06-01 18:03:49 ——– d—–w- C:\Program Files\Hewlett-Packard 2010-06-01 17:44:29 . 2008-04-10 18:47:58 ——– d—–w- C:\Program Files\Symantec AntiVirus 2010-06-01 17:17:25 . 2007-07-09 16:36:43 ——– d–h–r- C:\Documents and Settings\All Users\Application Data\yahoo! 2010-06-01 16:51:00 . 2010-06-01 16:51:00 12464 —-a-w- C:\WINDOWS\system32\avgrsstx(2).dll 2010-06-01 16:51:00 . 2010-06-01 16:50:59 360584 —-a-w- C:\WINDOWS\system32\drivers\avgtdix(2).sys 2010-06-01 16:50:51 . 2010-06-01 16:50:51 333192 —-a-w- C:\WINDOWS\system32\drivers\avgldx86(2).sys 2010-06-01 16:50:49 . 2010-06-01 16:50:49 28424 —-a-w- C:\WINDOWS\system32\drivers\avgmfx86(2).sys 2010-05-25 18:10:29 . 2010-05-25 18:10:29 4 —-a-w- C:\Documents and Settings\NetworkService\Application Data\ovczpx.dat 2010-05-25 00:02:52 . 2008-01-28 20:22:35 ——– d—–w- C:\Program Files\HP 2010-05-24 23:46:45 . 2008-02-05 05:46:59 ——– d—–w- C:\Documents and Settings\All Users\Application Data\SupportSoft 2010-05-24 23:46:44 . 2007-07-02 23:45:24 ——– d—–w- C:\Program Files\Dell Support Center 2010-05-24 23:46:23 . 2007-07-02 23:45:24 ——– d—–w- C:\Program Files\Common Files\supportsoft 2010-05-24 23:44:04 . 2010-04-02 23:45:45 ——– d–h–w- C:\Documents and Settings\jburgeson\Application Data\Gtek 2010-05-24 23:44:04 . 2008-03-04 23:16:26 ——– d–h–w- C:\Documents and Settings\credit\Application Data\Gtek 2010-05-24 23:44:04 . 2008-01-22 18:41:24 ——– d–h–w- C:\Documents and Settings\cgalloway\Application Data\Gtek 2010-05-24 23:44:04 . 2007-07-06 00:18:07 ——– d–h–w- C:\Documents and Settings\arobinson\Application Data\Gtek 2010-05-20 20:20:29 . 2010-05-20 20:20:29 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\Dell 2010-05-20 20:18:32 . 2010-05-20 20:18:32 ——– d—–w- C:\Documents and Settings\bmccarthy\Application Data\InstallShield 2010-04-29 22:39:38 . 2010-06-04 18:06:38 38224 —-a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2010-04-29 22:39:26 . 2010-06-04 18:06:36 20952 —-a-w- C:\WINDOWS\system32\drivers\mbam.sys 2010-04-21 19:36:10 . 2008-02-15 19:24:18 249856 ——w- C:\WINDOWS\Setup1.exe 2010-04-21 19:35:59 . 2010-04-21 19:35:59 73216 —-a-w- C:\WINDOWS\ST6UNST.EXE 2010-04-13 14:54:51 . 2010-04-13 01:43:32 256 ——w- C:\WINDOWS\system32\pool.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2006-07-21 21:48:02 98304] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2006-07-21 21:47:00 81920] "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 18:43:18 248040] "SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 15:20:00 282624] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 12:15:00 151552] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 08:12:00 94208] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2008-04-14 13:42:28 143360] "PayClockServer"="C:\PAYCLOCK\PCSCMGR.EXE" [2006-05-31 22:01:08 352256] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 17:24:00 16384] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 13:24:52 286720] "itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-22 01:08:57 813912] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 22:18:32 124128] "DellNSCST_GRNCH"="C:\Program Files\DELL\Dell Laser MFP 1815\NetworkScan\DNSCST.exe" [2006-12-06 02:09:44 278528] "AVG9_TRAY"="C:\PROGRA~1\AVG\AVG9\avgtray.exe" [2010-06-02 16:38:34 2065248] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 19:31:24 236016] "ScreenPrint32"="C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe" [2003-05-16 03:36:40 446464] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 17:23:56 202544] "Dell PanelMgr"="C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe" [2009-05-08 11:26:43 541936] "2335dn Scan2PC"="C:\WINDOWS\Twain_32\Dell\Dell2335\Scan2pc.exe" [2008-09-26 20:54:26 495616] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 08:57:28 35760] "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 08:06:33 976832] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 09:12:02 483328]
Post #13
Oooops…….here's the rest. …………"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 09:12:02 483328] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2010-7-6 25214] Global Payments Inc. GPN VPN Client.lnk - C:\Program Files\Global Payments VPN\Global VPN Client\ipsecdialer.exe [2010-6-2 1237066] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "DisablePersonalDirChange"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-06-02 16:38:32 12464 —-a-w- C:\WINDOWS\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Dell\\Dell Laser MFP 1600n\\NetworkScan\\DNSCST.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\Intuit\\QuickBooks 2007\\QBDBMgrN.exe"= "C:\\PAYCLOCK\\MAPDB.exe"= "C:\\PAYCLOCK\\MapDBWizard.exe"= "C:\\PAYCLOCK\\Bteng32m.exe"= "C:\\PAYCLOCK\\RBEdit.exe"= "C:\\PAYCLOCK\\Pcihsv.exe"= "C:\\PAYCLOCK\\Pcscmgr.exe"= "C:\\PAYCLOCK\\dbmgr.exe"= "C:\\PAYCLOCK\\RENYRUN.exe"= "C:\\PAYCLOCK\\TERMMGR.exe"= "C:\\PAYCLOCK\\Export32.exe"= "C:\\PAYCLOCK\\LicMgr32.exe"= "C:\\PAYCLOCK\\Reny.exe"= "C:\\PAYCLOCK\\RepWrite.exe"= "C:\\PAYCLOCK\\Register32.exe"= "C:\\PAYCLOCK\\QB02Sync.exe"= "C:\\PAYCLOCK\\QB03Sync.exe"= "C:\\PAYCLOCK\\QBSetup.exe"= "C:\\PAYCLOCK\\QB03Wiz.exe"= "C:\\PAYCLOCK\\MsgCheck.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Dell\\Dell Laser MFP 1815\\NetworkScan\\DNSCST.exe"= "C:\\WINDOWS\\twain_32\\Dell\\Dell2335\\Sscan2io.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
Post #14
There should be more after this one. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI