Spyware / Malware / Virus Removal

yahoo redirect

9 min read

Looking for the outcome? Ask AI

paulr13 Topic Starter

Post #1July 22, 2010, 9:29 AM UTC last edited July 22, 2010, 9:37 AM UTC

hi can anyone help please. everytime i use a search engine, whenever i click on a result it takes me to a different site. usually shopping sites etc. thanks DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 10:35:06.34 on 22/07/2010 Internet Explorer: 7.0.6001.18000 Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.952.215 [GMT 1:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Windows\RtHDVCpl.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\agrsmsvc.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe C:\Program Files\Acer\Empowering Technology\Service\ETService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Acer\Mobility Center\MobilityService.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Windows\system32\igfxext.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Paul\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://uk.yahoo.com/ mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0710&m=aspire_5335 BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll BHO: Partner BHO Class: {83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} - c:\programdata\partner\partner.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [BkupTray] "c:\program files\newtech infosystems\nti backup now 5\BkupTray.exe" mRun: [ArcadeDeluxeAgent] "c:\program files\acer arcade deluxe\acer arcade deluxe\ArcadeDeluxeAgent.exe" mRun: [CLMLServer] "c:\program files\acer arcade deluxe\acer arcade deluxe\kernel\clml\CLMLSvc.exe" mRun: [PlayMovie] "c:\program files\acer arcade deluxe\playmovie\PMVService.exe" mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [Skytel] Skytel.exe mRun: [LManager] c:\progra~1\launch~1\LManager.exe mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe" mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Notify: igfxcui - igfxdev.dll AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll ============= SERVICES / DRIVERS =============== R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\acer arcade deluxe\playmovie\000.fcl [2008-5-15 61424] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384] R2 CLHNService;CLHNService;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\CLHNService.exe [2008-5-15 81504] R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-5-15 24576] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-7-19 304464] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-7 50424] R2 NTIPPKernel;NTIPPKernel;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\NTIPPKernel.sys [2008-5-15 122368] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-7-19 20952] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-4 131072] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-1-21 179712] S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2010-7-7 30192] S3 Partner Service;Partner Service;c:\programdata\partner\partner.exe [2010-7-7 110576] =============== Created Last 30 ================ 2010-07-21 22:26 a-dshr– C:\autorun.inf 2010-07-21 22:14 –dsh— C:\$RECYCLE.BIN 2010-07-21 22:02 256,512 a——- c:\windows\PEV.exe 2010-07-21 22:02 161,792 a——- c:\windows\SWREG.exe 2010-07-21 22:02 98,816 a——- c:\windows\sed.exe 2010-07-21 22:02 77,312 a——- c:\windows\MBR.exe 2010-07-21 12:55 –d—– c:\program files\Championship Manager 01-02 2010-07-21 12:55 306,688 a——- c:\windows\IsUninst.exe 2010-07-21 12:39 –d—– c:\program files\PowerISO 2010-07-20 17:38 378,368 a——- c:\windows\system32\winhttp.dll 2010-07-20 17:38 411,136 a——- c:\windows\system32\drivers\http.sys 2010-07-20 17:38 31,232 a——- c:\windows\system32\httpapi.dll 2010-07-20 17:38 24,064 a——- c:\windows\system32\nshhttp.dll 2010-07-19 21:27 499,712 a——- c:\windows\system32\kerberos.dll 2010-07-19 21:27 270,848 a——- c:\windows\system32\schannel.dll 2010-07-19 14:49 –d—– c:\users\paul\appdata\roaming\Malwarebytes 2010-07-19 14:49 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-19 14:49 –d—– c:\programdata\Malwarebytes 2010-07-19 14:49 –d—– c:\progra~2\Malwarebytes 2010-07-19 14:49 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-07-19 14:49 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-07-19 14:38 –d—– c:\program files\uTorrent 2010-07-19 14:38 –d—– c:\users\paul\appdata\roaming\uTorrent 2010-07-19 11:47 –d—– c:\program files\Codemasters 2010-07-15 19:29 221,568 ——– c:\windows\system32\MpSigStub.exe 2010-07-10 03:02 1,130,824 a——- c:\windows\system32\dfshim.dll 2010-07-10 03:02 297,808 a——- c:\windows\system32\mscoree.dll 2010-07-10 03:02 295,264 a——- c:\windows\system32\PresentationHost.exe 2010-07-10 03:02 99,176 a——- c:\windows\system32\PresentationHostProxy.dll 2010-07-10 03:02 49,472 a——- c:\windows\system32\netfxperf.dll 2010-07-08 23:13 97,800 a——- c:\windows\system32\infocardapi.dll 2010-07-08 23:13 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2010-07-08 23:13 37,384 a——- c:\windows\system32\infocardcpl.cpl 2010-07-08 23:13 622,080 a——- c:\windows\system32\icardagt.exe 2010-07-08 23:13 11,264 a——- c:\windows\system32\icardres.dll 2010-07-08 23:13 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll 2010-07-08 23:05 158,720 a——- c:\windows\system32\mscorier.dll 2010-07-08 23:05 83,968 a——- c:\windows\system32\mscories.dll 2010-07-07 23:58 293,376 a——- c:\windows\system32\browserchoice.exe 2010-07-07 23:54 –d—– c:\program files\MSXML 4.0 2010-07-07 23:47 28,672 a——- c:\windows\system32\Apphlpdm.dll 2010-07-07 23:47 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll 2010-07-07 23:45 156,672 a——- c:\windows\system32\t2embed.dll 2010-07-07 23:45 430,080 a——- c:\windows\system32\vbscript.dll 2010-07-07 23:45 241,152 a——- c:\windows\system32\PortableDeviceApi.dll 2010-07-07 23:45 301,568 a——- c:\windows\system32\drivers\srv.sys 2010-07-07 23:45 98,304 a——- c:\windows\system32\drivers\srvnet.sys 2010-07-07 23:44 104,960 a——- c:\windows\system32\netiohlp.dll 2010-07-07 23:44 27,136 a——- c:\windows\system32\NETSTAT.EXE 2010-07-07 23:44 19,968 a——- c:\windows\system32\ARP.EXE 2010-07-07 23:44 10,240 a——- c:\windows\system32\finger.exe 2010-07-07 23:44 9,728 a——- c:\windows\system32\TCPSVCS.EXE 2010-07-07 23:44 8,704 a——- c:\windows\system32\HOSTNAME.EXE 2010-07-07 23:44 17,920 a——- c:\windows\system32\ROUTE.EXE 2010-07-07 23:44 11,264 a——- c:\windows\system32\MRINFO.EXE 2010-07-07 23:44 17,920 a——- c:\windows\system32\netevent.dll 2010-07-07 23:42 62,464 a——- c:\windows\system32\l3codeca.acm 2010-07-07 23:42 523,776 a——- c:\windows\system32\RMActivate_isv.exe 2010-07-07 23:42 511,488 a——- c:\windows\system32\RMActivate.exe 2010-07-07 23:42 472,576 a——- c:\windows\system32\secproc_isv.dll 2010-07-07 23:42 472,064 a——- c:\windows\system32\secproc.dll 2010-07-07 23:42 347,136 a——- c:\windows\system32\RMActivate_ssp.exe 2010-07-07 23:42 346,624 a——- c:\windows\system32\RMActivate_ssp_isv.exe 2010-07-07 23:41 329,216 a——- c:\windows\system32\msdrm.dll 2010-07-07 23:41 151,040 a——- c:\windows\system32\secproc_ssp_isv.dll 2010-07-07 23:41 151,040 a——- c:\windows\system32\secproc_ssp.dll 2010-07-07 23:41 1,645,568 a——- c:\windows\system32\connect.dll 2010-07-07 23:41 3,598,216 a——- c:\windows\system32\ntkrnlpa.exe 2010-07-07 23:41 3,545,992 a——- c:\windows\system32\ntoskrnl.exe 2010-07-07 23:39 738,304 a——- c:\windows\system32\inetcomm.dll 2010-07-07 23:39 212,992 a——- c:\windows\system32\drivers\mrxsmb10.sys 2010-07-07 23:39 105,984 a——- c:\windows\system32\drivers\mrxsmb.sys 2010-07-07 23:39 78,848 a——- c:\windows\system32\drivers\mrxsmb20.sys 2010-07-07 23:39 2,868,224 a——- c:\windows\system32\mf.dll 2010-07-07 23:38 71,680 a——- c:\windows\system32\atl.dll 2010-07-07 23:38 296,960 a——- c:\windows\system32\gdi32.dll 2010-07-07 23:33 2,048 a——- c:\windows\system32\tzres.dll 2010-07-07 23:32 160,256 a——- c:\windows\system32\wkssvc.dll 2010-07-07 23:32 562,176 a——- c:\windows\system32\msdtcprx.dll 2010-07-07 23:32 38,912 a——- c:\windows\system32\xolehlp.dll 2010-07-07 23:32 2,066,432 a——- c:\windows\system32\mstscax.dll 2010-07-07 23:32 303,616 a——- c:\windows\system32\wmpeffects.dll 2010-07-07 23:32 289,792 a——- c:\windows\system32\atmfd.dll 2010-07-07 23:32 72,704 a——- c:\windows\system32\fontsub.dll 2010-07-07 23:32 34,304 a——- c:\windows\system32\atmlib.dll 2010-07-07 23:32 10,240 a——- c:\windows\system32\dciman32.dll 2010-07-07 23:31 714,240 a——- c:\windows\system32\timedate.cpl 2010-07-07 23:31 636,928 a——- c:\windows\system32\localspl.dll 2010-07-07 23:31 2,927,104 a——- c:\windows\explorer.exe 2010-07-07 23:30 499,200 a——- c:\windows\system32\wbem\WmiPrvSD.dll 2010-07-07 23:30 615,424 a——- c:\windows\system32\wbem\fastprox.dll 2010-07-07 23:30 551,424 a——- c:\windows\system32\rpcss.dll 2010-07-07 23:30 247,296 a——- c:\windows\system32\wbem\WmiPrvSE.exe 2010-07-07 23:30 666,624 a——- c:\windows\system32\printfilterpipelinesvc.exe 2010-07-07 23:30 129,024 a——- c:\windows\system32\wbem\WmiDcPrv.dll 2010-07-07 23:30 26,112 a——- c:\windows\system32\printfilterpipelineprxy.dll 2010-07-07 23:30 183,296 a——- c:\windows\system32\sdohlp.dll 2010-07-07 23:30 98,304 a——- c:\windows\system32\iasrecst.dll 2010-07-07 23:30 54,784 a——- c:\windows\system32\iasads.dll 2010-07-07 23:30 44,032 a——- c:\windows\system32\iasdatastore.dll 2010-07-07 23:30 17,408 a——- c:\windows\system32\iashost.exe 2010-07-07 23:28 389,632 a——- c:\windows\system32\html.iec 2010-07-07 23:28 78,336 a——- c:\windows\system32\ieencode.dll 2010-07-07 23:28 26,624 a——- c:\windows\system32\ieUnatt.exe 2010-07-07 23:28 1,383,424 a——- c:\windows\system32\mshtml.tlb 2010-07-07 23:28 1,314,816 a——- c:\windows\system32\quartz.dll 2010-07-07 23:27 24,064 a——- c:\windows\system32\amxread.dll 2010-07-07 23:27 13,824 a——- c:\windows\system32\apilogen.dll 2010-07-07 23:27 712,704 a——- c:\windows\system32\WindowsCodecs.dll 2010-07-07 23:27 425,472 a——- c:\windows\system32\PhotoMetadataHandler.dll 2010-07-07 23:27 347,136 a——- c:\windows\system32\WindowsCodecsExt.dll 2010-07-07 23:24 147,456 a——- c:\windows\system32\Faultrep.dll 2010-07-07 23:24 125,952 a——- c:\windows\system32\wersvc.dll 2010-07-07 23:23 443,392 a——- c:\windows\system32\win32spl.dll 2010-07-07 23:23 625,152 a——- c:\windows\system32\drivers\dxgkrnl.sys 2010-07-07 23:23 565,248 a——- c:\windows\system32\emdmgmt.dll 2010-07-07 23:23 148,480 a——- c:\windows\system32\drivers\nwifi.sys 2010-07-07 23:23 45,056 a——- c:\windows\system32\dataclen.dll 2010-07-07 23:23 36,864 a——- c:\windows\system32\cdd.dll 2010-07-07 23:23 313,344 a——- c:\windows\system32\wmpdxm.dll 2010-07-07 23:23 43,520 a——- c:\windows\system32\msdxm.tlb 2010-07-07 23:23 18,432 a——- c:\windows\system32\amcompat.tlb 2010-07-07 23:19 996,352 a——- c:\windows\system32\WMNetMgr.dll 2010-07-07 23:19 94,720 a——- c:\windows\system32\logagent.exe 2010-07-07 23:19 61,440 a——- c:\windows\system32\msasn1.dll 2010-07-07 23:19 784,896 a——- c:\windows\system32\rpcrt4.dll 2010-07-07 23:19 144,896 a——- c:\windows\system32\drivers\srv2.sys 2010-07-07 23:18 2,036,224 a——- c:\windows\system32\win32k.sys 2010-07-07 13:12 281,600 a——- c:\windows\system32\raschap.dll 2010-07-07 13:12 244,224 a——- c:\windows\system32\rastls.dll 2010-07-07 13:12 351,232 a——- c:\windows\system32\WSDApi.dll 2010-07-07 13:09 31,744 a——- c:\windows\system32\msvidc32.dll 2010-07-07 13:09 13,312 a——- c:\windows\system32\msrle32.dll 2010-07-07 13:09 91,136 a——- c:\windows\system32\avifil32.dll 2010-07-07 13:09 50,176 a——- c:\windows\system32\iyuv_32.dll 2010-07-07 13:09 22,528 a——- c:\windows\system32\msyuv.dll 2010-07-07 13:09 11,776 a——- c:\windows\system32\tsbyuv.dll 2010-07-07 13:09 82,944 a——- c:\windows\system32\mciavi32.dll 2010-07-07 13:09 123,904 a——- c:\windows\system32\msvfw32.dll 2010-07-07 13:09 65,024 a——- c:\windows\system32\avicap32.dll 2010-07-07 13:08 604,672 a——- c:\windows\system32\WMSPDMOD.DLL 2010-07-07 13:07 310,784 a——- c:\windows\system32\unregmp2.exe 2010-07-07 13:07 7,680 a——- c:\windows\system32\spwmp.dll 2010-07-07 13:07 4,096 a——- c:\windows\system32\msdxm.ocx 2010-07-07 13:07 4,096 a——- c:\windows\system32\dxmasf.dll 2010-07-07 13:07 8,147,456 a——- c:\windows\system32\wmploc.DLL 2010-07-07 12:15 171,520 a——- c:\windows\system32\wintrust.dll 2010-07-07 12:15 98,304 a——- c:\windows\system32\cabview.dll 2010-07-07 08:56 3,600 a–sh— C:\Patch.rev 2010-07-07 08:56 380,928 a——- c:\windows\AcerStore.exe 2010-07-07 08:56 49,152 a——- c:\windows\Interop.IWshRuntimeLibrary.dll 2010-07-07 08:56 1,302 a——- c:\windows\AceSto02.cfg 2010-07-07 08:56 199,176 a——- c:\windows\GVUni.exe 2010-07-07 08:56 1,279 a——- c:\windows\system32\AcerScre.cfg 2010-07-07 08:53 361,984 a——- c:\windows\system32\IPSECSVC.DLL 2010-07-07 08:50 12,240,896 a——- c:\windows\system32\NlsLexicons0007.dll 2010-07-07 08:50 2,644,480 a——- c:\windows\system32\NlsLexicons0009.dll 2010-07-07 08:50 801,280 a——- c:\windows\system32\NaturalLanguage6.dll 2010-07-07 08:49 72,192 a——- c:\windows\system32\drivers\pacer.sys 2010-07-07 08:49 15,360 a——- c:\windows\system32\pacerprf.dll 2010-07-07 08:49 180,224 a——- c:\windows\system32\scrobj.dll 2010-07-07 08:49 172,032 a——- c:\windows\system32\scrrun.dll 2010-07-07 08:49 155,648 a——- c:\windows\system32\wscript.exe 2010-07-07 08:49 135,168 a——- c:\windows\system32\wshom.ocx 2010-07-07 08:49 135,168 a——- c:\windows\system32\cscript.exe 2010-07-07 08:49 90,112 a——- c:\windows\system32\wshext.dll 2010-07-07 08:48 885,248 a——- c:\windows\system32\RacEngn.dll 2010-07-07 08:48 9,127 a——- c:\windows\system32\RacUR.xml 2010-07-07 08:48 153 a——- c:\windows\system32\RacUREx.xml 2010-07-07 08:47 113,664 a——- c:\windows\system32\drivers\rmcast.sys 2010-07-07 08:46 428,544 a——- c:\windows\system32\EncDec.dll 2010-07-07 08:46 293,376 a——- c:\windows\system32\psisdecd.dll 2010-07-07 08:46 218,624 a——- c:\windows\system32\psisrndr.ax 2010-07-07 08:46 57,856 a——- c:\windows\system32\MSDvbNP.ax 2010-07-07 08:45 1,695,744 a——- c:\windows\system32\gameux.dll 2010-07-07 08:44 988,216 a——- c:\windows\system32\winload.exe 2010-07-07 08:44 927,288 a——- c:\windows\system32\winresume.exe 2010-07-07 08:44 615,992 a——- c:\windows\system32\ci.dll 2010-07-07 08:44 378,368 a——- c:\windows\system32\srcore.dll 2010-07-07 08:44 318,464 a——- c:\windows\system32\rstrui.exe 2010-07-07 08:44 46,592 a——- c:\windows\system32\setbcdlocale.dll 2010-07-07 08:44 40,960 a——- c:\windows\system32\srclient.dll 2010-07-07 08:44 19,000 a——- c:\windows\system32\kd1394.dll 2010-07-07 08:44 14,848 a——- c:\windows\system32\srdelayed.exe 2010-07-07 08:44 6,656 a——- c:\windows\system32\kbd106n.dll 2010-07-07 08:43 –d—– c:\windows\Users 2010-07-07 08:41 20,480 a——- c:\windows\PATCHFUL.EXE 2010-07-07 08:41 201 a——- c:\windows\USER.XML 2010-07-07 08:41 –d—– c:\windows\Lan 2010-07-07 08:07 920,088 a——- c:\windows\system32\igxpun.exe 2010-07-07 08:07 319,456 a——- c:\windows\system32\difxapi.dll 2010-07-07 08:07 –d—– c:\windows\system32\Lang 2010-07-07 08:06 6,416,928 a——- c:\windows\system\DriveIcon.dll 2010-07-07 08:06 61,440 a——- c:\windows\system32\drivers\RTSTOR.sys 2010-07-07 08:06 5,430 a——- c:\windows\system\MyMulti.ico 2010-07-07 08:06 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2010-07-07 00:39 92 a——- c:\windows\GridV.UNI 2010-07-07 00:39 –d—– c:\program files\Acer Inc 2010-07-07 00:38 –d—– c:\programdata\eSobi 2010-07-07 00:38 –d—– c:\progra~2\eSobi 2010-07-07 00:38 –d—– c:\program files\eSobi 2010-07-07 00:37 14,544 a——- c:\windows\system32\drivers\TVicPort.sys 2010-07-07 00:37 6,080 a——- c:\windows\system32\drivers\zntport.sys 2010-07-07 00:37 238,080 a——- c:\windows\system32\ITEIO_64.dll 2010-07-07 00:36 0 a——- c:\windows\system32\LogConfigTemp.xml 2010-07-07 00:34 204,800 a——- c:\windows\system32\SysHook.dll 2010-07-07 00:30 2,421,760 a——- c:\windows\system32\wucltux.dll 2010-07-07 00:28 87,552 a——- c:\windows\system32\wudriver.dll 2010-07-07 00:28 83 a——- c:\windows\LManager.UNI 2010-07-07 00:28 –d—– c:\program files\Launch Manager 2010-07-07 00:28 171,608 a——- c:\windows\system32\wuwebv.dll 2010-07-07 00:28 33,792 a——- c:\windows\system32\wuapp.exe 2010-07-07 00:27 553 a——- c:\windows\USetup.iss 2010-07-07 00:27 290,816 a——- c:\windows\RTKVADDA.EXE 2010-07-07 00:26 –d—– c:\windows\system32\RTCOM 2010-07-07 00:25 –d—– c:\program files\Realtek 2010-07-07 00:19 –d—– c:\program files\Convesoft 2010-07-07 00:19 –d—– c:\programdata\Partner 2010-07-07 00:19 –d—– c:\progra~2\Partner 2010-07-07 00:19 –d—– c:\programdata\Google 2010-07-07 00:17 14,618 a——- c:\windows\system32\results.xml 2010-07-07 00:16 –d—– c:\users\paul\appdata\roaming\Acer GameZone Console 2010-07-07 00:16 –d—– c:\users\Paul ==================== Find3M ==================== 2010-07-07 08:47 665,600 a——- c:\windows\inf\drvindex.dat 2010-07-07 08:45 2,560 a——- c:\windows\apppatch\AcRes.dll 2010-07-07 08:43 28,728 a——- c:\windows\system32\drivers\msahci.sys 2010-07-07 08:43 21,560 a——- c:\windows\system32\drivers\atapi.sys 2010-07-07 00:29 86,016 a——- c:\windows\inf\infstrng.dat 2010-07-07 00:29 51,200 a——- c:\windows\inf\infpub.dat 2010-07-07 00:28 86,016 a——- c:\windows\inf\infstor.dat 2010-07-07 00:25 319,456 a——- c:\windows\DIFxAPI.dll 2010-07-07 00:25 315,392 a——- c:\windows\HideWin.exe 2010-05-04 19:42 833,024 a——- c:\windows\system32\wininet.dll 2008-01-21 03:57 174 a–sh— c:\program files\desktop.ini 2006-11-02 13:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 13:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 13:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 13:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat ============= FINISH: 10:35:55.89 ===============

LDTate

Post #2July 23, 2010, 1:16 PM UTC

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Ensure all Firefox windows are closed.
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
When prompted to run the scan, click Yes.
It doesn't take long to run, once it is finished move onto the next step

Download TDSSKiller and save it to your Desktop.

Make sure all other windows are closed and to let it run uninterrupted.
Extract the file and run it.
Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
Reboot your machine and see if the infection is gone
Please post the contents of that log TDSSKiller and GooredFix log.

paulr13

Post #3July 23, 2010, 8:18 PM UTC

GooredFix by jpshortstuff (03.07.10.1) Log created at 21:14 on 23/07/2010 (Paul) Firefox version [Unable to determine] ========== GooredScan ========== ========== GooredLog ========== C:\Program Files\Mozilla Firefox\extensions\ (none) [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "{20a82645-c095-46ed-80e3-08825760534b}"="C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [22:17 08/07/2010] ———- Old Logs ———- GooredFix[09.21.38_22-07-2010].txt -=E.O.F=-

paulr13

Post #4July 23, 2010, 8:20 PM UTC

2010/07/23 21:15:45.0658 TDSS rootkit removing tool 2.4.0.0 Jul 22 2010 16:09:49 2010/07/23 21:15:45.0658 ================================================================================ 2010/07/23 21:15:45.0658 SystemInfo: 2010/07/23 21:15:45.0658 2010/07/23 21:15:45.0658 OS Version: 6.0.6001 ServicePack: 1.0 2010/07/23 21:15:45.0658 Product type: Workstation 2010/07/23 21:15:45.0658 ComputerName: PAUL-PC 2010/07/23 21:15:45.0658 UserName: Paul 2010/07/23 21:15:45.0658 Windows directory: C:\Windows 2010/07/23 21:15:45.0658 System windows directory: C:\Windows 2010/07/23 21:15:45.0658 Processor architecture: Intel x86 2010/07/23 21:15:45.0658 Number of processors: 1 2010/07/23 21:15:45.0658 Page size: 0x1000 2010/07/23 21:15:45.0658 Boot type: Normal boot 2010/07/23 21:15:45.0658 ================================================================================ 2010/07/23 21:15:50.0525 Initialize success 2010/07/23 21:15:53.0146 ================================================================================ 2010/07/23 21:15:53.0146 Scan started 2010/07/23 21:15:53.0146 Mode: Manual; 2010/07/23 21:15:53.0146 ================================================================================ 2010/07/23 21:15:58.0466 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys 2010/07/23 21:15:59.0074 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys 2010/07/23 21:16:00.0057 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys 2010/07/23 21:16:00.0821 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys 2010/07/23 21:16:01.0196 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys 2010/07/23 21:16:01.0601 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys 2010/07/23 21:16:02.0132 AgereSoftModem (38325c6aa8eae011897d61ce48ec6435) C:\Windows\system32\DRIVERS\AGRSM.sys 2010/07/23 21:16:02.0662 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys 2010/07/23 21:16:03.0068 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 2010/07/23 21:16:03.0442 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys 2010/07/23 21:16:03.0848 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys 2010/07/23 21:16:04.0191 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys 2010/07/23 21:16:04.0628 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys 2010/07/23 21:16:05.0018 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys 2010/07/23 21:16:05.0470 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys 2010/07/23 21:16:05.0860 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys 2010/07/23 21:16:06.0281 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 2010/07/23 21:16:06.0702 atapi (0d83c87a801a3dfcd1bf73893fe7518c) C:\Windows\system32\drivers\atapi.sys 2010/07/23 21:16:07.0217 athr (7fa516fc81dd5931f389b56279a27a3e) C:\Windows\system32\DRIVERS\athr.sys 2010/07/23 21:16:07.0872 b57nd60x (502f1c30bd50b32d00ce4dcaecc3d3c7) C:\Windows\system32\DRIVERS\b57nd60x.sys 2010/07/23 21:16:08.0247 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 2010/07/23 21:16:08.0652 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys 2010/07/23 21:16:09.0011 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys 2010/07/23 21:16:09.0386 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 2010/07/23 21:16:09.0729 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 2010/07/23 21:16:10.0119 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 2010/07/23 21:16:10.0478 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 2010/07/23 21:16:10.0899 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 2010/07/23 21:16:11.0258 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 2010/07/23 21:16:11.0648 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys 2010/07/23 21:16:12.0147 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 2010/07/23 21:16:12.0521 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys 2010/07/23 21:16:12.0989 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys 2010/07/23 21:16:13.0317 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys 2010/07/23 21:16:13.0722 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys 2010/07/23 21:16:14.0081 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys 2010/07/23 21:16:14.0424 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys 2010/07/23 21:16:14.0768 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys 2010/07/23 21:16:15.0126 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys 2010/07/23 21:16:15.0516 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys 2010/07/23 21:16:15.0938 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys 2010/07/23 21:16:16.0328 DKbFltr (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys 2010/07/23 21:16:16.0718 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 2010/07/23 21:16:17.0139 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys 2010/07/23 21:16:17.0544 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys 2010/07/23 21:16:18.0137 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys 2010/07/23 21:16:18.0543 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys 2010/07/23 21:16:18.0933 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys 2010/07/23 21:16:19.0307 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys 2010/07/23 21:16:19.0713 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys 2010/07/23 21:16:20.0118 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys 2010/07/23 21:16:20.0524 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 2010/07/23 21:16:20.0930 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 2010/07/23 21:16:21.0413 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 2010/07/23 21:16:21.0803 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys 2010/07/23 21:16:22.0193 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys 2010/07/23 21:16:22.0568 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys 2010/07/23 21:16:22.0973 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 2010/07/23 21:16:23.0363 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys 2010/07/23 21:16:23.0738 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 2010/07/23 21:16:24.0112 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 2010/07/23 21:16:24.0471 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys 2010/07/23 21:16:24.0830 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys 2010/07/23 21:16:25.0235 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS 2010/07/23 21:16:25.0641 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS 2010/07/23 21:16:26.0093 HTTP (33b02459e86d0a2b86a6b9fe19139390) C:\Windows\system32\drivers\HTTP.sys 2010/07/23 21:16:26.0499 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys 2010/07/23 21:16:26.0936 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 2010/07/23 21:16:27.0357 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys 2010/07/23 21:16:27.0825 igfx (0627fc0c422cd6e0f23e1b0d1d9f0899) C:\Windows\system32\DRIVERS\igdkmd32.sys 2010/07/23 21:16:28.0418 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 2010/07/23 21:16:28.0792 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys 2010/07/23 21:16:29.0260 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys 2010/07/23 21:16:29.0775 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys 2010/07/23 21:16:30.0149 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 2010/07/23 21:16:30.0539 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2010/07/23 21:16:31.0194 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys 2010/07/23 21:16:31.0288 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 2010/07/23 21:16:31.0335 irda (e50a95179211b12946f7e035d60af560) C:\Windows\system32\DRIVERS\irda.sys 2010/07/23 21:16:31.0350 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 2010/07/23 21:16:31.0397 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys 2010/07/23 21:16:31.0803 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys 2010/07/23 21:16:32.0193 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 2010/07/23 21:16:32.0630 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 2010/07/23 21:16:32.0988 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 2010/07/23 21:16:33.0441 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys 2010/07/23 21:16:33.0846 klmd24 (6485ad0a17a0d6286b4d44c652adabb2) C:\Windows\system32\drivers\klmd.sys 2010/07/23 21:16:34.0252 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys 2010/07/23 21:16:34.0658 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 2010/07/23 21:16:35.0032 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys 2010/07/23 21:16:35.0438 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys 2010/07/23 21:16:35.0796 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys 2010/07/23 21:16:36.0171 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 2010/07/23 21:16:36.0576 MBAMProtector (67b48a903430c6d4fb58cbaca1866601) C:\Windows\system32\drivers\mbam.sys 2010/07/23 21:16:36.0966 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys 2010/07/23 21:16:37.0388 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys 2010/07/23 21:16:37.0871 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 2010/07/23 21:16:38.0246 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 2010/07/23 21:16:38.0823 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 2010/07/23 21:16:39.0213 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 2010/07/23 21:16:39.0603 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 2010/07/23 21:16:39.0993 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys 2010/07/23 21:16:40.0383 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 2010/07/23 21:16:40.0773 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 2010/07/23 21:16:41.0147 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys 2010/07/23 21:16:41.0537 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys 2010/07/23 21:16:41.0943 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2010/07/23 21:16:42.0333 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2010/07/23 21:16:42.0707 msahci (f70590424eefbf5c27a40c67afdb8383) C:\Windows\system32\drivers\msahci.sys 2010/07/23 21:16:43.0082 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys 2010/07/23 21:16:43.0472 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 2010/07/23 21:16:43.0846 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 2010/07/23 21:16:44.0220 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 2010/07/23 21:16:44.0626 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 2010/07/23 21:16:45.0032 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 2010/07/23 21:16:45.0406 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys 2010/07/23 21:16:45.0843 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 2010/07/23 21:16:46.0202 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 2010/07/23 21:16:46.0607 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys 2010/07/23 21:16:47.0013 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys 2010/07/23 21:16:47.0418 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys 2010/07/23 21:16:47.0824 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 2010/07/23 21:16:48.0198 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 2010/07/23 21:16:48.0729 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys 2010/07/23 21:16:49.0119 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 2010/07/23 21:16:49.0493 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 2010/07/23 21:16:49.0914 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys 2010/07/23 21:16:50.0351 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 2010/07/23 21:16:50.0741 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys 2010/07/23 21:16:51.0131 NSCIRDA (6d8d2e5652fc2442c810c5d8be784148) C:\Windows\system32\DRIVERS\nscirda.sys 2010/07/23 21:16:51.0521 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 2010/07/23 21:16:52.0052 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys 2010/07/23 21:16:52.0457 NTIDrvr (2757d2ba59aee155209e24942ab127c9) C:\Windows\system32\DRIVERS\NTIDrvr.sys 2010/07/23 21:16:52.0676 NTIPPKernel (547bfa3591c70674b0bfc99354ab78b3) C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys 2010/07/23 21:16:53.0081 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 2010/07/23 21:16:53.0456 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 2010/07/23 21:16:53.0924 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys 2010/07/23 21:16:54.0314 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys 2010/07/23 21:16:54.0719 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys 2010/07/23 21:16:55.0296 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys 2010/07/23 21:16:55.0359 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 2010/07/23 21:16:55.0406 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys 2010/07/23 21:16:55.0780 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 2010/07/23 21:16:56.0170 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys 2010/07/23 21:16:56.0544 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys 2010/07/23 21:16:56.0950 pcmcia (b7c5a8769541900f6dfa6fe0c5e4d513) C:\Windows\system32\DRIVERS\pcmcia.sys 2010/07/23 21:16:57.0356 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 2010/07/23 21:16:57.0761 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 2010/07/23 21:16:58.0120 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys 2010/07/23 21:16:58.0526 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys 2010/07/23 21:16:58.0916 PSDFilter (1dcbb35090cc4b2bd3d661e6089523c6) C:\Windows\system32\DRIVERS\psdfilter.sys 2010/07/23 21:16:59.0430 PSDNServ (e26e46d619469964ac3609620f443867) C:\Windows\system32\DRIVERS\PSDNServ.sys 2010/07/23 21:16:59.0836 psdvdisk (3e1d134af2806867d06047c4cc33cc65) C:\Windows\system32\DRIVERS\PSDVdisk.sys 2010/07/23 21:17:00.0335 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys 2010/07/23 21:17:00.0803 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 2010/07/23 21:17:01.0178 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 2010/07/23 21:17:01.0552 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys 2010/07/23 21:17:02.0004 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 2010/07/23 21:17:02.0379 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys 2010/07/23 21:17:02.0753 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys 2010/07/23 21:17:03.0128 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys 2010/07/23 21:17:03.0471 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 2010/07/23 21:17:03.0845 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys 2010/07/23 21:17:04.0266 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 2010/07/23 21:17:04.0672 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys 2010/07/23 21:17:05.0062 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 2010/07/23 21:17:05.0514 RTSTOR (9ea88492b1dab90dce43a6f2c0e133bd) C:\Windows\system32\drivers\RTSTOR.SYS 2010/07/23 21:17:05.0873 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 2010/07/23 21:17:06.0326 SCDEmu (20b2751cd4c8f3fd989739ca661b9f30) C:\Windows\system32\drivers\SCDEmu.sys 2010/07/23 21:17:06.0716 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys 2010/07/23 21:17:07.0090 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 2010/07/23 21:17:07.0464 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys 2010/07/23 21:17:07.0854 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys 2010/07/23 21:17:08.0260 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 2010/07/23 21:17:08.0650 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys 2010/07/23 21:17:09.0024 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys 2010/07/23 21:17:09.0555 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys 2010/07/23 21:17:09.0960 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 2010/07/23 21:17:10.0366 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys 2010/07/23 21:17:10.0740 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys 2010/07/23 21:17:11.0146 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys 2010/07/23 21:17:11.0536 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys 2010/07/23 21:17:11.0895 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 2010/07/23 21:17:12.0316 srv (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys 2010/07/23 21:17:12.0768 srv2 (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys 2010/07/23 21:17:13.0174 srvnet (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys 2010/07/23 21:17:13.0595 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 2010/07/23 21:17:14.0016 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 2010/07/23 21:17:14.0406 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 2010/07/23 21:17:14.0781 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 2010/07/23 21:17:15.0171 SynTP (4c9bb4b3b9eac26211484c30b914c6dc) C:\Windows\system32\DRIVERS\SynTP.sys 2010/07/23 21:17:15.0608 Tcpip (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers\tcpip.sys 2010/07/23 21:17:16.0060 Tcpip6 (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS\tcpip.sys 2010/07/23 21:17:16.0434 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys 2010/07/23 21:17:16.0840 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 2010/07/23 21:17:17.0308 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 2010/07/23 21:17:17.0698 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys 2010/07/23 21:17:18.0072 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys 2010/07/23 21:17:18.0494 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 2010/07/23 21:17:18.0884 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 2010/07/23 21:17:19.0336 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys 2010/07/23 21:17:19.0866 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys 2010/07/23 21:17:20.0256 UBHelper (f763e070843ee2803de1395002b42938) C:\Windows\system32\drivers\UBHelper.sys 2010/07/23 21:17:20.0646 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys 2010/07/23 21:17:21.0114 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys 2010/07/23 21:17:21.0489 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys 2010/07/23 21:17:21.0863 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 2010/07/23 21:17:22.0238 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 2010/07/23 21:17:22.0628 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 2010/07/23 21:17:23.0018 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 2010/07/23 21:17:23.0408 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 2010/07/23 21:17:23.0798 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys 2010/07/23 21:17:24.0188 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys 2010/07/23 21:17:24.0609 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys 2010/07/23 21:17:24.0983 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys 2010/07/23 21:17:25.0358 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2010/07/23 21:17:25.0794 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys 2010/07/23 21:17:26.0200 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys 2010/07/23 21:17:26.0574 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys 2010/07/23 21:17:26.0980 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 2010/07/23 21:17:27.0354 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys 2010/07/23 21:17:27.0744 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys 2010/07/23 21:17:28.0134 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys 2010/07/23 21:17:28.0556 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 2010/07/23 21:17:28.0977 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys 2010/07/23 21:17:29.0398 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys 2010/07/23 21:17:29.0882 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys 2010/07/23 21:17:30.0287 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 2010/07/23 21:17:30.0677 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 2010/07/23 21:17:30.0693 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 2010/07/23 21:17:31.0052 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys 2010/07/23 21:17:31.0504 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 2010/07/23 21:17:31.0988 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS 2010/07/23 21:17:32.0424 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys 2010/07/23 21:17:32.0799 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 2010/07/23 21:17:33.0189 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 2010/07/23 21:17:33.0594 yukonwlh (3e1c915c6291ab5d1cfca680e1bd6bad) C:\Windows\system32\DRIVERS\yk60x86.sys 2010/07/23 21:17:33.0750 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (4d840c6af3c020ed3a35efba9025cf4a) C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl 2010/07/23 21:17:33.0875 ================================================================================ 2010/07/23 21:17:33.0875 Scan finished 2010/07/23 21:17:33.0875 ================================================================================ 2010/07/23 21:17:45.0279 Deinitialize success

LDTate

Post #5July 23, 2010, 9:05 PM UTC

DO NOT use any TOOLS such as Combofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

Note: If you have SP3, use the SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

paulr13

Post #6July 23, 2010, 9:42 PM UTC

hi. still having the redirect problem but other than the computer is runnin ok. here's the log

ComboFix 10-07-23.01 - Paul 23/07/2010 22:22:15.3.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.952.324 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 )))))))))))))))))))))))))))))))
.

2010-07-23 21:29 . 2010-07-23 21:29 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-07-21 11:55 . 2010-07-21 12:01 ——– d—–w- c:\program files\Championship Manager 01-02
2010-07-21 11:55 . 1998-10-29 15:45 306688 —-a-w- c:\windows\IsUninst.exe
2010-07-21 11:39 . 2010-07-21 11:39 ——– d—–w- c:\program files\PowerISO
2010-07-20 16:38 . 2009-08-24 12:16 378368 —-a-w- c:\windows\system32\winhttp.dll
2010-07-20 16:38 . 2009-11-03 22:17 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-07-20 16:38 . 2009-11-03 22:15 31232 —-a-w- c:\windows\system32\httpapi.dll
2010-07-20 16:38 . 2009-11-03 19:53 411136 —-a-w- c:\windows\system32\drivers\http.sys
2010-07-19 20:27 . 2009-06-15 15:21 499712 —-a-w- c:\windows\system32\kerberos.dll
2010-07-19 20:27 . 2009-06-15 15:24 270848 —-a-w- c:\windows\system32\schannel.dll
2010-07-19 13:49 . 2010-07-19 13:49 ——– d—–w- c:\users\Paul\AppData\Roaming\Malwarebytes
2010-07-19 13:49 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-19 13:49 . 2010-07-19 13:49 ——– d—–w- c:\programdata\Malwarebytes
2010-07-19 13:49 . 2010-07-19 13:49 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-19 13:49 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-19 13:38 . 2010-07-19 13:38 ——– d—–w- c:\program files\uTorrent
2010-07-19 13:38 . 2010-07-21 11:52 ——– d—–w- c:\users\Paul\AppData\Roaming\uTorrent
2010-07-19 10:47 . 2010-07-19 10:47 ——– d—–w- c:\program files\Codemasters
2010-07-18 07:58 . 2010-07-18 07:58 516784 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb1F9F.tmp.exe
2010-07-17 12:46 . 2010-07-17 12:46 516784 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb7B50.tmp.exe
2010-07-16 14:16 . 2010-07-16 14:16 516784 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb4E9C.tmp.exe
2010-07-15 18:29 . 2010-05-21 13:14 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-07-11 07:55 . 2010-07-11 07:55 501936 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtbA9FB.tmp.exe
2010-07-10 02:02 . 2009-11-08 09:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-07-10 02:02 . 2009-11-08 09:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-07-10 02:02 . 2009-11-08 09:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-07-10 02:02 . 2009-11-08 09:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-07-10 02:02 . 2009-11-08 09:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-07-10 00:54 . 2010-07-10 00:54 501936 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb4329.tmp.exe
2010-07-08 22:13 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2010-07-08 22:13 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-07-08 22:13 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2010-07-08 22:13 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2010-07-08 22:13 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-07-08 22:05 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2010-07-08 22:05 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2010-07-08 21:52 . 2010-07-08 21:52 501936 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb4107.tmp.exe
2010-07-08 21:35 . 2010-07-08 21:35 509552 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtbF5F4.tmp.exe
2010-07-07 22:58 . 2010-02-12 10:48 293376 —-a-w- c:\windows\system32\browserchoice.exe
2010-07-07 22:54 . 2010-07-07 22:54 ——– d—–w- c:\program files\MSXML 4.0
2010-07-07 22:47 . 2010-04-16 16:05 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-07-07 22:47 . 2010-04-16 14:17 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-07-07 22:45 . 2009-10-19 14:27 156672 —-a-w- c:\windows\system32\t2embed.dll
2010-07-07 22:45 . 2010-03-04 18:54 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-07-07 22:45 . 2008-10-22 03:57 241152 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2010-07-07 22:45 . 2009-12-11 12:07 301568 —-a-w- c:\windows\system32\drivers\srv.sys
2010-07-07 22:45 . 2009-12-11 12:07 98304 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-07-07 22:44 . 2009-08-14 16:29 104960 —-a-w- c:\windows\system32\netiohlp.dll
2010-07-07 22:44 . 2009-08-14 14:16 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2010-07-07 22:44 . 2009-08-14 14:16 19968 —-a-w- c:\windows\system32\ARP.EXE
2010-07-07 22:44 . 2009-08-14 14:16 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2010-07-07 22:44 . 2009-08-14 14:16 10240 —-a-w- c:\windows\system32\finger.exe
2010-07-07 22:44 . 2009-08-14 14:16 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2010-07-07 22:44 . 2009-08-14 14:16 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2010-07-07 22:44 . 2009-08-14 14:16 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2010-07-07 22:44 . 2009-08-14 16:29 17920 —-a-w- c:\windows\system32\netevent.dll
2010-07-07 22:42 . 2010-01-25 08:35 523776 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-07-07 22:42 . 2010-01-25 08:34 511488 —-a-w- c:\windows\system32\RMActivate.exe
2010-07-07 22:42 . 2010-01-25 12:48 472576 —-a-w- c:\windows\system32\secproc_isv.dll
2010-07-07 22:42 . 2010-01-25 12:48 472064 —-a-w- c:\windows\system32\secproc.dll
2010-07-07 22:42 . 2010-01-25 08:35 346624 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-07-07 22:42 . 2010-01-25 08:34 347136 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-07-07 22:41 . 2010-01-25 12:48 151040 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-07-07 22:41 . 2010-01-25 12:48 151040 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-07-07 22:41 . 2010-01-25 12:45 329216 —-a-w- c:\windows\system32\msdrm.dll
2010-07-07 22:41 . 2008-10-21 05:25 1645568 —-a-w- c:\windows\system32\connect.dll
2010-07-07 22:41 . 2010-02-18 14:49 3598216 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-07-07 22:41 . 2010-02-18 14:49 3545992 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-07-07 22:39 . 2010-01-29 16:21 738304 —-a-w- c:\windows\system32\inetcomm.dll
2010-07-07 22:39 . 2010-02-23 11:32 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-07-07 22:39 . 2010-02-23 11:32 105984 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-07-07 22:39 . 2010-02-23 11:32 78848 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-07-07 22:39 . 2009-06-10 12:11 2868224 —-a-w- c:\windows\system32\mf.dll
2010-07-07 22:38 . 2009-07-17 14:35 71680 —-a-w- c:\windows\system32\atl.dll
2010-07-07 22:38 . 2008-10-21 05:25 296960 —-a-w- c:\windows\system32\gdi32.dll
2010-07-07 22:33 . 2010-04-23 13:55 2048 —-a-w- c:\windows\system32\tzres.dll
2010-07-07 22:32 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll
2010-07-07 22:32 . 2008-06-06 03:27 38912 —-a-w- c:\windows\system32\xolehlp.dll
2010-07-07 22:32 . 2008-06-06 03:27 562176 —-a-w- c:\windows\system32\msdtcprx.dll
2010-07-07 22:32 . 2009-06-04 12:34 2066432 —-a-w- c:\windows\system32\mstscax.dll
2010-07-07 22:32 . 2008-06-26 03:29 303616 —-a-w- c:\windows\system32\wmpeffects.dll
2010-07-07 22:32 . 2010-05-26 14:25 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-07-07 22:32 . 2010-05-26 16:16 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-07-07 22:32 . 2009-10-19 14:24 72704 —-a-w- c:\windows\system32\fontsub.dll
2010-07-07 22:32 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2010-07-07 22:31 . 2009-04-23 12:42 636928 —-a-w- c:\windows\system32\localspl.dll
2010-07-07 22:31 . 2008-10-29 06:29 2927104 —-a-w- c:\windows\explorer.exe
2010-07-07 22:30 . 2009-03-03 04:40 499200 —-a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2010-07-07 22:30 . 2009-03-03 04:39 551424 —-a-w- c:\windows\system32\rpcss.dll
2010-07-07 22:30 . 2009-03-03 04:36 615424 —-a-w- c:\windows\system32\wbem\fastprox.dll
2010-07-07 22:30 . 2009-03-03 02:16 247296 —-a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2010-07-07 22:30 . 2009-03-03 04:40 129024 —-a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2010-07-07 22:30 . 2009-03-03 03:04 666624 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2010-07-07 22:30 . 2009-03-03 04:39 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2010-07-07 22:30 . 2009-03-03 04:39 183296 —-a-w- c:\windows\system32\sdohlp.dll
2010-07-07 22:30 . 2009-03-03 04:37 98304 —-a-w- c:\windows\system32\iasrecst.dll
2010-07-07 22:30 . 2009-03-03 04:37 54784 —-a-w- c:\windows\system32\iasads.dll
2010-07-07 22:30 . 2009-03-03 04:37 44032 —-a-w- c:\windows\system32\iasdatastore.dll
2010-07-07 22:30 . 2009-03-03 02:38 17408 —-a-w- c:\windows\system32\iashost.exe
2010-07-07 22:28 . 2010-05-04 18:37 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-07-07 22:28 . 2010-05-04 16:53 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2010-07-07 22:28 . 2010-04-16 16:10 1314816 —-a-w- c:\windows\system32\quartz.dll
2010-07-07 22:27 . 2009-03-17 03:38 13824 —-a-w- c:\windows\system32\apilogen.dll
2010-07-07 22:27 . 2009-03-17 03:38 24064 —-a-w- c:\windows\system32\amxread.dll
2010-07-07 22:27 . 2008-08-28 03:40 712704 —-a-w- c:\windows\system32\WindowsCodecs.dll
2010-07-07 22:27 . 2008-08-28 03:40 347136 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2010-07-07 22:27 . 2008-08-28 03:40 425472 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2010-07-07 22:24 . 2008-09-18 04:56 125952 —-a-w- c:\windows\system32\wersvc.dll
2010-07-07 22:24 . 2008-09-18 04:56 147456 —-a-w- c:\windows\system32\Faultrep.dll
2010-07-07 22:23 . 2008-08-12 03:39 443392 —-a-w- c:\windows\system32\win32spl.dll
2010-07-07 22:23 . 2008-08-02 01:01 625152 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-07-07 22:23 . 2008-06-26 03:29 565248 —-a-w- c:\windows\system32\emdmgmt.dll
2010-07-07 22:23 . 2008-06-26 03:29 45056 —-a-w- c:\windows\system32\dataclen.dll
2010-07-07 22:23 . 2008-05-20 02:07 148480 —-a-w- c:\windows\system32\drivers\nwifi.sys
2010-07-07 22:23 . 2008-08-02 03:26 36864 —-a-w- c:\windows\system32\cdd.dll
2010-07-07 22:23 . 2009-07-14 13:00 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2010-07-07 22:19 . 2008-06-23 01:59 996352 —-a-w- c:\windows\system32\WMNetMgr.dll
2010-07-07 22:19 . 2008-06-23 01:58 94720 —-a-w- c:\windows\system32\logagent.exe
2010-07-07 22:19 . 2009-09-04 12:24 61440 —-a-w- c:\windows\system32\msasn1.dll
2010-07-07 22:19 . 2009-04-23 12:43 784896 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-07 22:19 . 2009-09-14 09:44 144896 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-07-07 22:18 . 2010-05-01 13:53 2036224 —-a-w- c:\windows\system32\win32k.sys
2010-07-07 12:12 . 2009-10-07 12:41 244224 —-a-w- c:\windows\system32\rastls.dll
2010-07-07 12:12 . 2009-10-07 12:41 281600 —-a-w- c:\windows\system32\raschap.dll
2010-07-07 12:12 . 2009-08-10 13:05 351232 —-a-w- c:\windows\system32\WSDApi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-19 22:03 . 2008-05-15 05:29 ——– d—–w- c:\programdata\McAfee
2010-07-19 22:03 . 2008-05-15 05:29 ——– d—–w- c:\program files\McAfee
2010-07-19 10:48 . 2008-05-15 05:26 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-14 21:37 . 2008-05-15 05:31 ——– d—–w- c:\programdata\SiteAdvisor
2010-07-14 20:21 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-07-07 07:47 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2010-07-07 07:45 . 2010-07-07 07:45 2560 —-a-w- c:\windows\AppPatch\AcRes.dll
2010-07-07 07:43 . 2008-01-21 02:32 21560 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-07-07 07:43 . 2006-11-02 08:51 28728 —-a-w- c:\windows\system32\drivers\msahci.sys
2010-07-07 07:06 . 2010-07-07 07:06 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-07-06 23:47 . 2008-05-15 05:50 ——– d—–w- c:\program files\Acer
2010-07-06 23:25 . 2010-07-06 23:25 319456 —-a-w- c:\windows\DIFxAPI.dll
2010-07-06 23:25 . 2010-07-06 23:25 ——– d—–w- c:\program files\Realtek
2010-07-06 23:25 . 2010-07-06 23:25 315392 —-a-w- c:\windows\HideWin.exe
2010-05-04 18:42 . 2010-07-07 22:29 833024 —-a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-07-21_21.11.27 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-07-06 23:12 . 2010-07-21 11:57 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-06 23:12 . 2010-07-23 21:10 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-06 23:12 . 2010-07-23 21:10 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-07-06 23:12 . 2010-07-21 11:57 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-07-10 00:50 . 2010-07-23 18:18 210274 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-07-07 01:28 . 2010-07-23 20:54 210582 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2010-07-06 23:12 . 2010-07-23 21:10 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-07-06 23:12 . 2010-07-21 11:57 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2010-07-06 23:19 157168 —-a-w- c:\programdata\Partner\partner.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 16:05 121392 —-a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-07-19 322352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-07 30192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-07-07 30192]
R3 Partner Service;Partner Service;c:\programdata\Partner\partner.exe [2010-07-06 110576]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-04-18 61424]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-17 81504]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-04-29 304464]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-07 50424]
S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-17 122368]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-04-29 20952]

— Other Services/Drivers In Memory —

*NewlyCreated* - KLMD23
*NewlyCreated* - KLMD24
*NewlyCreated* - NORMANDY
*NewlyCreated* - SCDEMU
*NewlyCreated* - UDFS
*Deregistered* - klmd23
*Deregistered* - klmd24
*Deregistered* - Normandy

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-08 21:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0710&m=aspire_5335
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-23 22:29
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

c:\users\Paul\AppData\Local\Temp\catchme.dll 53248 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(1944)
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
.
Completion time: 2010-07-23 22:33:06
ComboFix-quarantined-files.txt 2010-07-23 21:33
ComboFix2.txt 2010-07-22 11:30
ComboFix3.txt 2010-07-21 21:14

Pre-Run: 42,654,748,672 bytes free
Post-Run: 42,516,676,608 bytes free

- - End Of File - - C17594D81C7DC8917506653F9BC9AE1B

LDTate

Post #7July 23, 2010, 9:51 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\programdata\Google\Google Toolbar\Update\gtb1F9F.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb7B50.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb4E9C.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtbA9FB.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb4329.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb4107.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtbF5F4.tmp.exe

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

paulr13

Post #8July 23, 2010, 10:19 PM UTC

no change in computer. still being redirected

ComboFix 10-07-23.01 - Paul 23/07/2010 23:02:49.4.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.44.1033.18.952.306 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Paul\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\programdata\Google\Google Toolbar\Update\gtb1F9F.tmp.exe"
"c:\programdata\Google\Google Toolbar\Update\gtb4107.tmp.exe"
"c:\programdata\Google\Google Toolbar\Update\gtb4329.tmp.exe"
"c:\programdata\Google\Google Toolbar\Update\gtb4E9C.tmp.exe"
"c:\programdata\Google\Google Toolbar\Update\gtb7B50.tmp.exe"
"c:\programdata\Google\Google Toolbar\Update\gtbA9FB.tmp.exe"
"c:\programdata\Google\Google Toolbar\Update\gtbF5F4.tmp.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Google\Google Toolbar\Update\gtb1F9F.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb4107.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb4329.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb4E9C.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtb7B50.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtbA9FB.tmp.exe
c:\programdata\Google\Google Toolbar\Update\gtbF5F4.tmp.exe

.
((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 )))))))))))))))))))))))))))))))
.

2010-07-23 22:10 . 2010-07-23 22:10 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-07-23 22:10 . 2010-07-23 22:10 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-07-23 21:55 . 2010-07-23 21:55 ——– d—–w- c:\program files\Common Files\Java
2010-07-23 21:54 . 2010-07-23 21:54 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-23 21:53 . 2010-07-23 21:53 ——– d—–w- c:\program files\Java
2010-07-21 11:55 . 2010-07-21 12:01 ——– d—–w- c:\program files\Championship Manager 01-02
2010-07-21 11:55 . 1998-10-29 15:45 306688 —-a-w- c:\windows\IsUninst.exe
2010-07-21 11:39 . 2010-07-21 11:39 ——– d—–w- c:\program files\PowerISO
2010-07-20 16:38 . 2009-08-24 12:16 378368 —-a-w- c:\windows\system32\winhttp.dll
2010-07-20 16:38 . 2009-11-03 22:17 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-07-20 16:38 . 2009-11-03 22:15 31232 —-a-w- c:\windows\system32\httpapi.dll
2010-07-20 16:38 . 2009-11-03 19:53 411136 —-a-w- c:\windows\system32\drivers\http.sys
2010-07-19 20:27 . 2009-06-15 15:21 499712 —-a-w- c:\windows\system32\kerberos.dll
2010-07-19 20:27 . 2009-06-15 15:24 270848 —-a-w- c:\windows\system32\schannel.dll
2010-07-19 13:49 . 2010-07-19 13:49 ——– d—–w- c:\users\Paul\AppData\Roaming\Malwarebytes
2010-07-19 13:49 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-19 13:49 . 2010-07-19 13:49 ——– d—–w- c:\programdata\Malwarebytes
2010-07-19 13:49 . 2010-07-19 13:49 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-19 13:49 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-19 13:38 . 2010-07-19 13:38 ——– d—–w- c:\program files\uTorrent
2010-07-19 13:38 . 2010-07-23 21:36 ——– d—–w- c:\users\Paul\AppData\Roaming\uTorrent
2010-07-19 10:47 . 2010-07-19 10:47 ——– d—–w- c:\program files\Codemasters
2010-07-15 18:29 . 2010-05-21 13:14 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-07-10 02:02 . 2009-11-08 09:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-07-10 02:02 . 2009-11-08 09:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-07-10 02:02 . 2009-11-08 09:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-07-10 02:02 . 2009-11-08 09:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-07-10 02:02 . 2009-11-08 09:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-07-08 22:13 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2010-07-08 22:13 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-07-08 22:13 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2010-07-08 22:13 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2010-07-08 22:13 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-07-08 22:05 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2010-07-08 22:05 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2010-07-07 22:58 . 2010-02-12 10:48 293376 —-a-w- c:\windows\system32\browserchoice.exe
2010-07-07 22:54 . 2010-07-07 22:54 ——– d—–w- c:\program files\MSXML 4.0
2010-07-07 22:47 . 2010-04-16 16:05 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-07-07 22:47 . 2010-04-16 14:17 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-07-07 22:45 . 2009-10-19 14:27 156672 —-a-w- c:\windows\system32\t2embed.dll
2010-07-07 22:45 . 2010-03-04 18:54 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-07-07 22:45 . 2008-10-22 03:57 241152 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2010-07-07 22:45 . 2009-12-11 12:07 301568 —-a-w- c:\windows\system32\drivers\srv.sys
2010-07-07 22:45 . 2009-12-11 12:07 98304 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-07-07 22:44 . 2009-08-14 16:29 104960 —-a-w- c:\windows\system32\netiohlp.dll
2010-07-07 22:44 . 2009-08-14 14:16 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2010-07-07 22:44 . 2009-08-14 14:16 19968 —-a-w- c:\windows\system32\ARP.EXE
2010-07-07 22:44 . 2009-08-14 14:16 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2010-07-07 22:44 . 2009-08-14 14:16 10240 —-a-w- c:\windows\system32\finger.exe
2010-07-07 22:44 . 2009-08-14 14:16 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2010-07-07 22:44 . 2009-08-14 14:16 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2010-07-07 22:44 . 2009-08-14 14:16 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2010-07-07 22:44 . 2009-08-14 16:29 17920 —-a-w- c:\windows\system32\netevent.dll
2010-07-07 22:42 . 2010-01-25 08:35 523776 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-07-07 22:42 . 2010-01-25 08:34 511488 —-a-w- c:\windows\system32\RMActivate.exe
2010-07-07 22:42 . 2010-01-25 12:48 472576 —-a-w- c:\windows\system32\secproc_isv.dll
2010-07-07 22:42 . 2010-01-25 12:48 472064 —-a-w- c:\windows\system32\secproc.dll
2010-07-07 22:42 . 2010-01-25 08:35 346624 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-07-07 22:42 . 2010-01-25 08:34 347136 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-07-07 22:41 . 2010-01-25 12:48 151040 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-07-07 22:41 . 2010-01-25 12:48 151040 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-07-07 22:41 . 2010-01-25 12:45 329216 —-a-w- c:\windows\system32\msdrm.dll
2010-07-07 22:41 . 2008-10-21 05:25 1645568 —-a-w- c:\windows\system32\connect.dll
2010-07-07 22:41 . 2010-02-18 14:49 3598216 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-07-07 22:41 . 2010-02-18 14:49 3545992 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-07-07 22:39 . 2010-01-29 16:21 738304 —-a-w- c:\windows\system32\inetcomm.dll
2010-07-07 22:39 . 2010-02-23 11:32 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-07-07 22:39 . 2010-02-23 11:32 105984 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-07-07 22:39 . 2010-02-23 11:32 78848 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-07-07 22:39 . 2009-06-10 12:11 2868224 —-a-w- c:\windows\system32\mf.dll
2010-07-07 22:38 . 2009-07-17 14:35 71680 —-a-w- c:\windows\system32\atl.dll
2010-07-07 22:38 . 2008-10-21 05:25 296960 —-a-w- c:\windows\system32\gdi32.dll
2010-07-07 22:33 . 2010-04-23 13:55 2048 —-a-w- c:\windows\system32\tzres.dll
2010-07-07 22:32 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll
2010-07-07 22:32 . 2008-06-06 03:27 38912 —-a-w- c:\windows\system32\xolehlp.dll
2010-07-07 22:32 . 2008-06-06 03:27 562176 —-a-w- c:\windows\system32\msdtcprx.dll
2010-07-07 22:32 . 2009-06-04 12:34 2066432 —-a-w- c:\windows\system32\mstscax.dll
2010-07-07 22:32 . 2008-06-26 03:29 303616 —-a-w- c:\windows\system32\wmpeffects.dll
2010-07-07 22:32 . 2010-05-26 14:25 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-07-07 22:32 . 2010-05-26 16:16 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-07-07 22:32 . 2009-10-19 14:24 72704 —-a-w- c:\windows\system32\fontsub.dll
2010-07-07 22:32 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2010-07-07 22:31 . 2009-04-23 12:42 636928 —-a-w- c:\windows\system32\localspl.dll
2010-07-07 22:31 . 2008-10-29 06:29 2927104 —-a-w- c:\windows\explorer.exe
2010-07-07 22:30 . 2009-03-03 04:40 499200 —-a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2010-07-07 22:30 . 2009-03-03 04:39 551424 —-a-w- c:\windows\system32\rpcss.dll
2010-07-07 22:30 . 2009-03-03 04:36 615424 —-a-w- c:\windows\system32\wbem\fastprox.dll
2010-07-07 22:30 . 2009-03-03 02:16 247296 —-a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2010-07-07 22:30 . 2009-03-03 04:40 129024 —-a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2010-07-07 22:30 . 2009-03-03 03:04 666624 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2010-07-07 22:30 . 2009-03-03 04:39 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2010-07-07 22:30 . 2009-03-03 04:39 183296 —-a-w- c:\windows\system32\sdohlp.dll
2010-07-07 22:30 . 2009-03-03 04:37 98304 —-a-w- c:\windows\system32\iasrecst.dll
2010-07-07 22:30 . 2009-03-03 04:37 54784 —-a-w- c:\windows\system32\iasads.dll
2010-07-07 22:30 . 2009-03-03 04:37 44032 —-a-w- c:\windows\system32\iasdatastore.dll
2010-07-07 22:30 . 2009-03-03 02:38 17408 —-a-w- c:\windows\system32\iashost.exe
2010-07-07 22:28 . 2010-05-04 18:37 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-07-07 22:28 . 2010-05-04 16:53 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2010-07-07 22:28 . 2010-04-16 16:10 1314816 —-a-w- c:\windows\system32\quartz.dll
2010-07-07 22:27 . 2009-03-17 03:38 13824 —-a-w- c:\windows\system32\apilogen.dll
2010-07-07 22:27 . 2009-03-17 03:38 24064 —-a-w- c:\windows\system32\amxread.dll
2010-07-07 22:27 . 2008-08-28 03:40 712704 —-a-w- c:\windows\system32\WindowsCodecs.dll
2010-07-07 22:27 . 2008-08-28 03:40 347136 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2010-07-07 22:27 . 2008-08-28 03:40 425472 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2010-07-07 22:24 . 2008-09-18 04:56 125952 —-a-w- c:\windows\system32\wersvc.dll
2010-07-07 22:24 . 2008-09-18 04:56 147456 —-a-w- c:\windows\system32\Faultrep.dll
2010-07-07 22:23 . 2008-08-12 03:39 443392 —-a-w- c:\windows\system32\win32spl.dll
2010-07-07 22:23 . 2008-08-02 01:01 625152 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-07-07 22:23 . 2008-06-26 03:29 565248 —-a-w- c:\windows\system32\emdmgmt.dll
2010-07-07 22:23 . 2008-06-26 03:29 45056 —-a-w- c:\windows\system32\dataclen.dll
2010-07-07 22:23 . 2008-05-20 02:07 148480 —-a-w- c:\windows\system32\drivers\nwifi.sys
2010-07-07 22:23 . 2008-08-02 03:26 36864 —-a-w- c:\windows\system32\cdd.dll
2010-07-07 22:23 . 2009-07-14 13:00 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2010-07-07 22:19 . 2008-06-23 01:59 996352 —-a-w- c:\windows\system32\WMNetMgr.dll
2010-07-07 22:19 . 2008-06-23 01:58 94720 —-a-w- c:\windows\system32\logagent.exe
2010-07-07 22:19 . 2009-09-04 12:24 61440 —-a-w- c:\windows\system32\msasn1.dll
2010-07-07 22:19 . 2009-04-23 12:43 784896 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-07 22:19 . 2009-09-14 09:44 144896 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-07-07 22:18 . 2010-05-01 13:53 2036224 —-a-w- c:\windows\system32\win32k.sys
2010-07-07 12:12 . 2009-10-07 12:41 244224 —-a-w- c:\windows\system32\rastls.dll
2010-07-07 12:12 . 2009-10-07 12:41 281600 —-a-w- c:\windows\system32\raschap.dll
2010-07-07 12:12 . 2009-08-10 13:05 351232 —-a-w- c:\windows\system32\WSDApi.dll
2010-07-07 12:09 . 2009-12-28 12:32 31744 —-a-w- c:\windows\system32\msvidc32.dll
2010-07-07 12:09 . 2009-12-28 12:32 13312 —-a-w- c:\windows\system32\msrle32.dll
2010-07-07 12:09 . 2009-12-28 12:35 11776 —-a-w- c:\windows\system32\tsbyuv.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-19 22:03 . 2008-05-15 05:29 ——– d—–w- c:\programdata\McAfee
2010-07-19 22:03 . 2008-05-15 05:29 ——– d—–w- c:\program files\McAfee
2010-07-19 10:48 . 2008-05-15 05:26 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-14 21:37 . 2008-05-15 05:31 ——– d—–w- c:\programdata\SiteAdvisor
2010-07-14 20:21 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-07-07 07:47 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2010-07-07 07:45 . 2010-07-07 07:45 2560 —-a-w- c:\windows\AppPatch\AcRes.dll
2010-07-07 07:43 . 2008-01-21 02:32 21560 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-07-07 07:43 . 2006-11-02 08:51 28728 —-a-w- c:\windows\system32\drivers\msahci.sys
2010-07-07 07:06 . 2010-07-07 07:06 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-07-06 23:47 . 2008-05-15 05:50 ——– d—–w- c:\program files\Acer
2010-07-06 23:25 . 2010-07-06 23:25 319456 —-a-w- c:\windows\DIFxAPI.dll
2010-07-06 23:25 . 2010-07-06 23:25 ——– d—–w- c:\program files\Realtek
2010-07-06 23:25 . 2010-07-06 23:25 315392 —-a-w- c:\windows\HideWin.exe
2010-05-04 18:42 . 2010-07-07 22:29 833024 —-a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-07-21_21.11.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2010-07-23 21:37 43760 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:02 . 2010-07-23 21:37 78440 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2010-07-06 23:12 . 2010-07-21 11:57 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-07-06 23:12 . 2010-07-23 21:35 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-07-06 23:12 . 2010-07-21 11:57 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-07-06 23:12 . 2010-07-23 21:35 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-07-06 23:18 . 2010-07-23 21:37 5094 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4245182972-1807603102-1461088427-1000_UserData.bin
- 2010-07-21 11:42 . 2010-07-21 11:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-07-23 21:35 . 2010-07-23 21:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-07-23 21:35 . 2010-07-23 21:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-07-21 11:42 . 2010-07-21 11:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-07-10 00:50 . 2010-07-23 18:18 210274 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-07-07 01:28 . 2010-07-23 21:33 210742 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 10:33 . 2010-07-23 21:40 600378 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-07-21 11:46 600378 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2010-07-23 21:40 105852 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2010-07-21 11:46 105852 c:\windows\System32\perfc009.dat
+ 2010-07-23 21:54 . 2010-07-23 21:54 153376 c:\windows\System32\javaws.exe
+ 2010-07-23 21:54 . 2010-07-23 21:54 145184 c:\windows\System32\javaw.exe
+ 2010-07-23 21:54 . 2010-07-23 21:54 145184 c:\windows\System32\java.exe
- 2010-07-06 23:12 . 2010-07-21 11:57 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-07-06 23:12 . 2010-07-23 21:35 114688 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-07-23 21:55 . 2010-07-23 21:55 180224 c:\windows\Installer\1106cd.msi
+ 2010-07-23 21:53 . 2010-07-23 21:53 676352 c:\windows\Installer\1106c7.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2010-07-06 23:19 157168 —-a-w- c:\programdata\Partner\partner.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 16:05 121392 —-a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-07-19 322352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-07 30192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"Skytel"="Skytel.exe" [2007-11-21 1826816]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-07-07 30192]
R3 Partner Service;Partner Service;c:\programdata\Partner\partner.exe [2010-07-06 110576]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-04-18 61424]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-17 81504]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-04-29 304464]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-07 50424]
S2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-17 122368]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-04-29 20952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-08 21:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0710&m=aspire_5335
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-23 23:10
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-07-23 23:13:18
ComboFix-quarantined-files.txt 2010-07-23 22:13
ComboFix2.txt 2010-07-23 21:33
ComboFix3.txt 2010-07-22 11:30
ComboFix4.txt 2010-07-21 21:14

Pre-Run: 43,744,616,448 bytes free
Post-Run: 43,608,969,216 bytes free

- - End Of File - - 2CA26C63CFA60A8C981FE91C67A17FEB

LDTate

Post #9July 23, 2010, 10:21 PM UTC

Please download MBRCheck.exe to your desktop.

Double click MBRCheck.exe to run it
right click on the top title bar (where program name and path is written)
From the drop down menu chose Edit then Select All
Click the Enter key on the keyboard > this will copy the selected text to the clipboard
In your reply > right click in the reply window and paste the copied text

paulr13

Post #10July 23, 2010, 10:27 PM UTC

MBRCheck, version 1.1.1 © 2010, AD \\.\C: –> \\.\PhysicalDrive0 \\.\D: –> \\.\PhysicalDrive0 Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Unknown MBR code Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit:

LDTate

Post #11July 23, 2010, 10:32 PM UTC

Please do the following:

Run MBRCheck.exe
Wait until you see the following line: Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Please push the 'Y' key and then press Enter
When program ask you Enter your choice: enter (2) and press the Enter key
Now the program will ask you "Enter the physical disk number to fix (0-99, -1 to cancel):"
Enter 0 and press the Enter key.
The program will show Available MBR codes:, followed by a list of operating systems. Please enter 3 for Windows Vista, and then press Enter.
The program will prompt for confirmation. Type 'YES' and hit Enter.
Left click on the title bar (where program name and path is written).
From menu chose Edit -> Select All
Hit the Enter key on your keyboard to copy selected text.
Paste that text into Notepad, save it to your desktop as "MBRCheck results.txt"
Restart your PC.
Post the text in "MBRCheck results.txt" here, please.

paulr13

Post #12July 24, 2010, 9:11 AM UTC

i done that i now my computer won't start. it says i got to put a windows installation disk in but i didn't get one with the computer. file: \windows\system32\winload.exe

LDTate

Post #13July 24, 2010, 2:21 PM UTC

You will need to locate a Microsoft® Windows Vista™ Home Basic

Recovery Environment

http://support.microsoft.com/kb/927392

How to use the Bootrec.exe tool in the Windows Recovery Environment to troubleshoot and repair startup issues in Windows

http://www.bleepingcomputer.com/tutorials/tutorial148.html

How to automatically repair Windows Vista using Startup Repair

paulr13

Post #14July 25, 2010, 2:09 AM UTC

i haven't got a disk to repair it. apparently it's all on the computer but it won't let me go as far to start it up

LDTate

Post #15July 25, 2010, 11:39 AM UTC

I'd suggest contacting who you bought the pc from or the manufactor of the pc to see if they can send you your Windows OS CD.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

yahoo redirect

✨ Ask AI

Ask AI