What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HTTP Nukesploit Request

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Severity High Activity an intrusion attempt by DAVID-PC was blocked Status: blocked Recommended action: no action required Risk name: HTTP Nukesploit Request Attacking computer: DAVID-PC then my ip Address, well that computer is me Attacker URL: [removed]:8042/exemple.com/ Destination Address: [removed]:8042/exemple.com/ Source Destination: looks to be my ip Address Traffic Destination: TCP , port 55872 Network traffic from David pc matches the signature of a know attack. The attack was resulted from \DEVICE\HARDDISKVOLUME2\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE. To stop being notfied for this type of traffic, in the actions panel click stop notifying me. Network traffic from 96.30.16.218:8042/exemple.com/ matches the signature of a know attack. The attack was resulted from \DEVICE\HARDDISKVOLUME2\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE. To stop being notfied for this type of traffic, in the actions panel click stop notifying me. I have done liveupdates and done about 2 to 3 full comprehensive scans in norton 360, my os is Windows 7 with all updates on it, and have not picked anything up in the comprehensive scans I have done. Do you think I will be ok?
Post #2
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
  • Please make sure to carefully read any instruction that I give you.
    Reading too lightly will cause you to miss important steps, which could have destructive effects.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days     failure to reply will result in the topic being closed!
  • Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message to me on here. ;)
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
____________________________________________________


  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in


    netsvcs
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.


NEXT:




Scanning with GMER

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

Notes:
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

– If you encounter any problems, try running GMER in safe mode.
– If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.
Post #3
Hi SweetTech thanks for helping.

OTL logfile created on: 17/08/2010 22:31:52 - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Users\David\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 72.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.66 Gb Total Space | 357.19 Gb Free Space | 76.71% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVID-PC
Current User Name: David
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)


========== Modules (SafeList) ==========

MOD - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (N360) – C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (DAUpdaterSvc) – C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100816.016\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100816.016\NAVENG.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100719.001\BHDrvx86.sys (Symantec Corporation)
DRV - (AsIO) – C:\Windows\System32\drivers\AsIO.sys ()
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100813.004\IDSvix86.sys (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ccHP) – C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (xusb21) – C:\Windows\System32\drivers\xusb21.sys (Microsoft Corporation)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (xnacc) – C:\Windows\System32\drivers\xnacc.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\System32\drivers\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (MTsensor) – C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (NVNET) – C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (BVRPMPR5) – C:\Windows\System32\drivers\BVRPMPR5.SYS (Avanquest Software)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 BE 34 60 79 3B CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/08/05 16:12:29 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/08/04 15:40:23 | 000,000,000 | —D | M]


O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (no name) - {93935F7F-9C88-42F8-8445-95251D27FABC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (Reg Error: Key error.)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2010/08/17 22:25:18 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\David\Desktop\OTL.exe
[2010/08/17 22:24:21 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\WinZip
[2010/08/14 16:39:54 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/08/14 15:36:48 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2010/08/12 23:56:02 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/08/12 23:56:02 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/08/12 23:56:02 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/08/12 23:56:02 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/08/12 23:56:02 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/08/12 23:56:02 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/08/12 23:56:02 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/08/12 23:56:02 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/08/12 23:52:16 | 003,955,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/08/12 23:52:16 | 003,899,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/08/12 23:20:00 | 000,197,632 | —- | C] (Intel® Corporation) – C:\Windows\System32\ir32_32.dll
[2010/08/12 23:20:00 | 000,082,944 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2010/08/12 23:18:34 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rtutils.dll
[2010/08/12 23:01:11 | 002,326,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/08/11 11:27:00 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\WinRAR
[2010/08/11 11:26:10 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/08/08 10:44:44 | 000,000,000 | —D | C] – C:\Program Files\Bethesda Softworks
[2010/08/07 13:07:54 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\CrashDumps
[2010/08/04 16:26:31 | 000,339,504 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\symtdiv.sys
[2010/08/04 16:26:31 | 000,173,104 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\symefa.sys
[2010/08/04 16:26:30 | 000,501,888 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\cchpx86.sys
[2010/08/04 16:26:30 | 000,328,752 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\symds.sys
[2010/08/04 16:26:30 | 000,325,680 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\srtsp.sys
[2010/08/04 16:26:30 | 000,116,784 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\ironx86.sys
[2010/08/04 16:26:30 | 000,043,696 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\N360\0402000.00C\srtspx.sys
[2010/08/04 16:26:24 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\N360\0402000.00C
[2010/08/04 15:44:08 | 000,000,000 | —D | C] – C:\Users\David\Documents\Symantec
[2010/08/04 15:40:17 | 000,107,368 | R— | C] (GEAR Software Inc.) – C:\Windows\System32\GEARAspi.dll
[2010/08/04 15:40:16 | 000,124,976 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/08/04 15:40:10 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2010/08/04 15:40:10 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/08/04 15:39:35 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\N360
[2010/08/04 15:39:33 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2010/08/04 15:20:04 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/07/31 14:49:59 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard
[2010/07/26 21:54:39 | 000,000,000 | —D | C] – C:\Users\David\Documents\StarCraft II
[2010/07/26 21:54:39 | 000,000,000 | —D | C] – C:\Program Files\StarCraft II
[2010/07/26 21:54:39 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard Entertainment
[2010/07/26 21:54:39 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Blizzard Entertainment
[2010/07/22 10:25:47 | 000,000,000 | —D | C] – C:\Program Files\BitLord
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/17 22:32:06 | 003,145,728 | -HS- | M] () – C:\Users\David\ntuser.dat
[2010/08/17 22:25:22 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\David\Desktop\OTL.exe
[2010/08/17 22:24:05 | 000,002,205 | —- | M] () – C:\Users\Public\Desktop\WinZip.lnk
[2010/08/17 22:23:40 | 000,981,008 | —- | M] () – C:\Windows\System32\drivers\N360\0402000.00C\Cat.DB
[2010/08/17 22:12:27 | 000,020,304 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/17 22:12:27 | 000,020,304 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/17 22:09:36 | 000,726,316 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/08/17 22:09:36 | 000,628,024 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/08/17 22:09:36 | 000,110,208 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/08/17 22:05:23 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/08/17 22:05:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/08/17 22:05:20 | 2415,357,952 | -HS- | M] () – C:\hiberfil.sys
[2010/08/17 17:46:20 | 001,853,038 | -H– | M] () – C:\Users\David\AppData\Local\IconCache.db
[2010/08/16 23:36:53 | 000,001,578 | —- | M] () – C:\Users\David\Documents\u.rtf
[2010/08/14 23:34:12 | 000,000,268 | —- | M] () – C:\Users\David\Documents\in u.rtf
[2010/08/14 22:09:03 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_xusb21_01009.Wdf
[2010/08/14 16:40:25 | 000,001,984 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/08/12 23:49:59 | 000,266,808 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/08/10 12:49:16 | 000,006,656 | —- | M] () – C:\Users\David\Documents\t.rtf
[2010/08/04 22:10:40 | 000,002,322 | —- | M] () – C:\Users\Public\Desktop\Norton 360.lnk
[2010/08/04 15:40:10 | 000,124,976 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/08/04 15:40:10 | 000,007,443 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/08/04 15:40:10 | 000,000,805 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2010/07/31 14:29:31 | 000,000,020 | —- | M] () – C:\Users\David\Documents\aionmemo_6ebddd28.dat
[2010/07/29 07:30:49 | 000,197,632 | —- | M] (Intel® Corporation) – C:\Windows\System32\ir32_32.dll
[2010/07/29 07:30:34 | 000,082,944 | —- | M] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2010/07/26 22:14:24 | 000,001,051 | —- | M] () – C:\Users\Public\Desktop\StarCraft II.lnk
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/17 22:24:05 | 000,002,205 | —- | C] () – C:\Users\Public\Desktop\WinZip.lnk
[2010/08/16 17:45:39 | 000,001,578 | —- | C] () – C:\Users\David\Documents\u.rtf
[2010/08/14 23:34:12 | 000,000,268 | —- | C] () – C:\Users\David\Documents\in u.rtf
[2010/08/14 22:09:03 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_xusb21_01009.Wdf
[2010/08/14 16:39:58 | 000,001,984 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/08/04 22:10:11 | 000,981,008 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\Cat.DB
[2010/08/04 16:26:31 | 000,007,873 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symefa.cat
[2010/08/04 16:26:31 | 000,007,787 | R— | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symnetv.cat
[2010/08/04 16:26:31 | 000,007,368 | R— | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symnet.cat
[2010/08/04 16:26:31 | 000,003,373 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symefa.inf
[2010/08/04 16:26:31 | 000,001,473 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symnetv.inf
[2010/08/04 16:26:31 | 000,001,445 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symnet.inf
[2010/08/04 16:26:30 | 000,007,442 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\srtspx.cat
[2010/08/04 16:26:30 | 000,007,438 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\srtsp.cat
[2010/08/04 16:26:30 | 000,007,438 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\iron.cat
[2010/08/04 16:26:30 | 000,007,425 | R— | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symds.cat
[2010/08/04 16:26:30 | 000,007,396 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\cchpx86.cat
[2010/08/04 16:26:30 | 000,002,793 | R— | C] () – C:\Windows\System32\drivers\N360\0402000.00C\symds.inf
[2010/08/04 16:26:30 | 000,001,754 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\cchpx86.inf
[2010/08/04 16:26:30 | 000,001,388 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\srtspx.inf
[2010/08/04 16:26:30 | 000,001,382 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\srtsp.inf
[2010/08/04 16:26:30 | 000,000,741 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\iron.inf
[2010/08/04 16:26:24 | 000,000,172 | —- | C] () – C:\Windows\System32\drivers\N360\0402000.00C\isolate.ini
[2010/08/04 15:40:16 | 000,007,443 | —- | C] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/08/04 15:40:16 | 000,000,805 | —- | C] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2010/08/04 15:40:06 | 000,002,322 | —- | C] () – C:\Users\Public\Desktop\Norton 360.lnk
[2010/07/26 21:54:39 | 000,001,051 | —- | C] () – C:\Users\Public\Desktop\StarCraft II.lnk
[2010/07/08 09:47:24 | 000,024,576 | —- | C] () – C:\Windows\System32\AsIO.dll
[2010/07/08 09:47:24 | 000,012,400 | —- | C] () – C:\Windows\System32\drivers\AsIO.sys
[2010/07/08 09:47:14 | 000,011,832 | —- | C] () – C:\Windows\System32\drivers\AsInsHelp64.sys
[2010/07/08 09:47:14 | 000,010,216 | —- | C] () – C:\Windows\System32\drivers\AsInsHelp32.sys
[2010/04/02 17:17:34 | 000,179,091 | —- | C] () – C:\Windows\System32\xlive.dll.cat
[2009/11/12 10:15:00 | 000,704,512 | R— | C] () – C:\Windows\System32\cohelper.dll
[2009/11/12 10:14:05 | 000,014,678 | —- | C] () – C:\Windows\Ascd_log.ini
[2009/11/12 10:13:46 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2009/11/12 10:13:40 | 000,012,266 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2009/07/14 00:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/05/13 12:11:34 | 000,006,504 | —- | C] () – C:\Windows\System32\drivers\ASACPI.sys
[2009/04/02 21:30:14 | 000,010,296 | —- | C] () – C:\Windows\System32\drivers\ASUSHWIO.SYS
[2008/10/07 10:13:30 | 000,197,912 | —- | C] () – C:\Windows\System32\physxcudart_20.dll
[2008/10/07 10:13:22 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll

========== LOP Check ==========

[2009/11/30 12:39:31 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\com.gog.downloader.87F90EC6C28C7E479115BE2E026DB87A08BC420D.1
[2010/06/24 09:53:06 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\ImgBurn
[2010/07/07 22:58:12 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\LucasArts
[2010/07/12 10:09:49 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\ScummVM
[2010/07/20 22:30:40 | 000,032,608 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/05/30 01:25:48 | 000,667,721 | R— | M] () – C:\Act Raiser (U).rar
[2009/06/10 22:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/06/10 22:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2010/05/30 03:29:22 | 000,726,850 | R— | M] () – C:\Contra III - The Alien Wars (U).rar
[2010/06/15 21:44:02 | 000,232,457 | R— | M] () – C:\Earthbound (U) (Prototype).zip
[2010/05/30 02:53:36 | 001,904,746 | R— | M] () – C:\Earthbound (U).rar
[2010/05/30 02:39:03 | 002,147,597 | R— | M] () – C:\Final Fantasy 3 (V1.1) (U) [!].rar
[2010/08/17 22:05:20 | 2415,357,952 | -HS- | M] () – C:\hiberfil.sys
[2009/12/01 11:02:54 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/12/01 11:02:54 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/08/17 22:05:19 | 3220,480,000 | -HS- | M] () – C:\pagefile.sys
[2009/11/12 10:14:45 | 000,001,855 | —- | M] () – C:\RHDSetup.log
[2010/06/15 21:40:54 | 001,105,920 | R— | M] (by Alexandre da Veiga) – C:\RockNESX.exe
[2010/05/30 00:51:08 | 000,671,809 | R— | M] () – C:\Shadowrun (U)(63540).rar
[2010/05/30 02:42:40 | 000,575,053 | R— | M] () – C:\Star Fox (V1.2) (U) [!].rar

< %systemroot%\Fonts\*.com >
[2009/07/14 05:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 05:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 05:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 05:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 22:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 02:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/14 02:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 05:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/14 11:57:14 | 000,000,221 | -HS- | M] () – C:\Users\David\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/08/17 22:25:22 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\David\Desktop\OTL.exe

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-14 21:09:04

< End of report >









OTL Extras logfile created on: 17/08/2010 22:31:52 - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Users\David\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 72.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.66 Gb Total Space | 357.19 Gb Free Space | 76.71% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVID-PC
Current User Name: David
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{30349EFD-29C6-471B-B720-10D805B2D9F3}" = NCsoft Launcher
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C6B103A-1CDD-B3F2-5E8C-A2E5AAA6B555}" = GOG.com Downloader
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{772753FC-98FF-4BB3-A93F-C006663633AD}" = StillLife
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"com.gog.downloader.87F90EC6C28C7E479115BE2E026DB87A08BC420D.1" = GOG.com Downloader
"DivX Setup.divx.com" = DivX Setup
"FLV Player" = FLV Player 2.0 (build 25)
"Freespace 2_is1" = Freespace 2
"Gabriel Knight - Sins of the Fathers_is1" = Gabriel Knight - Sins of the Fathers
"Gabriel Knight 2 - The Beast Within_is1" = Gabriel Knight 2 - The Beast Within
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"N360" = Norton 360
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"StarCraft II" = StarCraft II
"Steam App 15620" = Warhammer 40,000: Dawn of War II
"Steam App 220" = Half-Life 2
"Steam App 2600" = Vampire: The Masquerade - Bloodlines
"Steam App 29670" = Aion - Collector's Edition
"Steam App 31170" = Tales of Monkey Island: Chapter 1 - Launch of the Screaming Narwhal
"Steam App 31180" = Tales of Monkey Island: Chapter 2 - The Siege of Spinner Cay
"Steam App 31190" = Tales of Monkey Island: Chapter 3 - Lair of the Leviathan
"Steam App 31200" = Tales of Monkey Island: Chapter 4 - The Trial and Execution of Guybrush Threepwood
"Steam App 31210" = Tales of Monkey Island: Chapter 5 - Rise of the Pirate God
"Steam App 31220" = Sam & Max 301: The Penal Zone
"Steam App 31230" = Sam & Max 302: The Tomb of Sammun-Mak
"Steam App 380" = Half-Life 2: Episode One
"Steam App 3830" = Psychonauts
"Steam App 41300" = Altitude
"Steam App 440" = Team Fortress 2
"The Pandora Directive_is1" = The Pandora Directive
"WinLiveSuite_Wave3" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 07/08/2010 08:15:27 | Computer Name = David-PC | Source = Application Error | ID = 1000
Description = Faulting application name: JadeEmpireConfig.exe, version: 1.0.0.11,
time stamp: 0x45b94575 Faulting module name: ntdll.dll, version: 6.1.7600.16559,
time stamp: 0x4ba9b21e Exception code: 0xc0000005 Fault offset: 0x000561e9 Faulting
process id: 0x15f0 Faulting application start time: 0x01cb362a381ebd00 Faulting application
path: C:\Program Files\Jade Empire\JadeEmpireConfig.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 763d89e0-a21d-11df-804d-002618de1e95

Error - 07/08/2010 08:15:44 | Computer Name = David-PC | Source = Application Error | ID = 1000
Description = Faulting application name: JadeEmpireConfig.exe, version: 1.0.0.11,
time stamp: 0x45b94575 Faulting module name: ntdll.dll, version: 6.1.7600.16559,
time stamp: 0x4ba9b21e Exception code: 0xc0000005 Fault offset: 0x000561e9 Faulting
process id: 0x149c Faulting application start time: 0x01cb362a4257be20 Faulting application
path: C:\Program Files\Jade Empire\JadeEmpireConfig.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 804e13a0-a21d-11df-804d-002618de1e95

Error - 08/08/2010 05:44:08 | Computer Name = David-PC | Source = VSS | ID = 8194
Description =

Error - 08/08/2010 15:11:15 | Computer Name = David-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 08/08/2010 18:13:23 | Computer Name = David-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 11/08/2010 06:35:29 | Computer Name = David-PC | Source = Application Error | ID = 1000
Description = Faulting application name: AdriILE.exe, version: 0.0.0.0, time stamp:
0x2a425e19 Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp:
0x4a5bdaae Exception code: 0x0eedfade Fault offset: 0x00009617 Faulting process id:
0xb08 Faulting application start time: 0x01cb3940eaa61450 Faulting application path:
C:\Users\David\Downloads\AdriPSX_ILE_Edition_1-0-5\adripsx\AdriILE.exe Faulting
module path: C:\Windows\system32\KERNELBASE.dll Report Id: 28bdbd10-a534-11df-82be-002618de1e95

Error - 14/08/2010 02:29:20 | Computer Name = David-PC | Source = VSS | ID = 8194
Description =

Error - 14/08/2010 09:13:15 | Computer Name = David-PC | Source = Application Hang | ID = 1002
Description = The program Psychonauts.exe version 1.0.4.0 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 15d0 Start
Time: 01cb3bb2599c8b00 Termination Time: 69 Application Path: c:\program files\steam\steamapps\common\psychonauts\Psychonauts.exe

Report
Id:

Error - 15/08/2010 07:41:00 | Computer Name = David-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Psychonauts.exe, version: 1.0.4.0, time
stamp: 0x433891f6 Faulting module name: isactwin.dll, version: 1.5.0.0, time stamp:
0x4241d96c Exception code: 0xc0000005 Fault offset: 0x00016c00 Faulting process id:
0x5a4 Faulting application start time: 0x01cb3c6ea05b0d70 Faulting application path:
c:\program files\steam\steamapps\common\psychonauts\Psychonauts.exe Faulting module
path: c:\program files\steam\steamapps\common\psychonauts\isactwin.dll Report Id:
f92e3f80-a861-11df-be89-002618de1e95

Error - 15/08/2010 13:56:21 | Computer Name = David-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 03/08/2010 04:07:38 | Computer Name = David-PC | Source = DCOM | ID = 10010
Description =

Error - 05/08/2010 07:56:16 | Computer Name = David-PC | Source = DCOM | ID = 10010
Description =

Error - 06/08/2010 04:10:53 | Computer Name = David-PC | Source = DCOM | ID = 10010
Description =

Error - 06/08/2010 09:39:23 | Computer Name = David-PC | Source = bowser | ID = 8003
Description =

Error - 06/08/2010 10:03:43 | Computer Name = David-PC | Source = bowser | ID = 8003
Description =

Error - 06/08/2010 10:50:13 | Computer Name = David-PC | Source = bowser | ID = 8003
Description =

Error - 06/08/2010 18:32:23 | Computer Name = David-PC | Source = Microsoft-Windows-WHEA-Logger | ID = 20
Description = A fatal hardware error has occurred. Component: AMD Northbridge Error
Source: 3 Error Type: 2 Processor ID: 0 The details view of this entry contains further
information.

Error - 14/08/2010 02:18:35 | Computer Name = David-PC | Source = Service Control Manager | ID = 7023
Description = The Windows Update service terminated with the following error: %%-2147467243

Error - 16/08/2010 17:29:32 | Computer Name = David-PC | Source = BROWSER | ID = 8032
Description =

Error - 16/08/2010 17:29:39 | Computer Name = David-PC | Source = bowser | ID = 8003
Description =


< End of report >
Post #7
So I save it as "Gmer.txt" is that with the quotes or without them like Gmer.txt or "Gmer.txt" I am just making sure I get this right.
Post #9 last edited
Log


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-17 23:11:14
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\David\AppData\Local\Temp\pglcapod.sys


—- System - GMER 1.0.15 —-

SSDT 870C3DC0 ZwAlertResumeThread
SSDT 870C1470 ZwAlertThread
SSDT 870EBA90 ZwAllocateVirtualMemory
SSDT 86796E60 ZwAlpcConnectPort
SSDT 870D2048 ZwAssignProcessToJobObject
SSDT 87100150 ZwCreateMutant
SSDT 87102008 ZwCreateSymbolicLinkObject
SSDT 870E87D8 ZwCreateThread
SSDT 87124518 ZwCreateThreadEx
SSDT 870D0CD8 ZwDebugActiveProcess
SSDT 870EBCA8 ZwDuplicateObject
SSDT 870EB5F0 ZwFreeVirtualMemory
SSDT 870C8B30 ZwImpersonateAnonymousToken
SSDT 870C5048 ZwImpersonateThread
SSDT 8677A088 ZwLoadDriver
SSDT 870EB4D0 ZwMapViewOfSection
SSDT 870CA6F0 ZwOpenEvent
SSDT 870EBE38 ZwOpenProcess
SSDT 86A7F108 ZwOpenProcessToken
SSDT 870CE0A0 ZwOpenSection
SSDT 870E9FC0 ZwOpenThread
SSDT 87124B78 ZwProtectVirtualMemory
SSDT 870C16B8 ZwResumeThread
SSDT 86A80908 ZwSetContextThread
SSDT 870EB278 ZwSetInformationProcess
SSDT 870D0048 ZwSetSystemInformation
SSDT 870CDC58 ZwSuspendProcess
SSDT 8706C048 ZwSuspendThread
SSDT 869B1570 ZwTerminateProcess
SSDT 8705A3E0 ZwTerminateThread
SSDT 86A7F1C0 ZwUnmapViewOfSection
SSDT 870EB840 ZwWriteVirtualMemory

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C25AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C25104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C253F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C0E2D8
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C0D898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C251DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C25958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C256F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C25F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C261A8

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C85599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CA9F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 224 82CB1734 8 Bytes [C0, 3D, 0C, 87, 70, 14, 0C, …]
.text ntkrnlpa.exe!RtlSidHashLookup + 23C 82CB174C 4 Bytes [90, BA, 0E, 87]
.text ntkrnlpa.exe!RtlSidHashLookup + 248 82CB1758 4 Bytes [60, 6E, 79, 86] {PUSHA ; OUTSB ; JNS 0xffffffffffffff8a}
.text ntkrnlpa.exe!RtlSidHashLookup + 29C 82CB17AC 4 Bytes [48, 20, 0D, 87]
.text ntkrnlpa.exe!RtlSidHashLookup + 318 82CB1828 4 Bytes [50, 01, 10, 87]
.text …
.text peauth.sys 82167C9D 28 Bytes [15, 6C, DE, B5, 2A, 56, 42, …]
.text peauth.sys 82167CC1 28 Bytes [15, 6C, DE, B5, 2A, 56, 42, …]
PAGE peauth.sys 8216DB9B 63 Bytes [8E, B6, BB, DB, 43, B2, 95, …]
PAGE peauth.sys 8216DBEC 111 Bytes [E7, 67, 0A, 4D, 9B, 11, 27, …]
PAGE peauth.sys 8216E02C 102 Bytes [96, 0E, 48, C9, 93, 7C, 93, …]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004f halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

—- EOF - GMER 1.0.15 —-

Attachments:

Post #10
Hello,

I've gone ahead and expanded the log that you attached.

Please do not attach the logs for me, post them instead, it makes it easier for me to read them.

Work your way through the following:


OTL Fix

We need to run an OTL Fix
  • Please reopen [external image: Posted Image] on your desktop.
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    :Services
:OTL
O2 - BHO: (no name) - {93935F7F-9C88-42F8-8445-95251D27FABC} - No CLSID value found.
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
:Reg

:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]
  • Push [external image: Posted Image]
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click [external image: Posted Image].
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now
Post #11
ComboFix log

ComboFix 10-08-17.02 - David 17/08/2010 23:38:44.1.4 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3071.2282 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-07-17 to 2010-08-17 )))))))))))))))))))))))))))))))
.

2010-08-17 22:43 . 2010-08-17 22:43 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-08-17 22:25 . 2010-08-17 22:25 ——– d—–w- C:\_OTL
2010-08-17 21:24 . 2010-08-17 21:24 ——– d—–w- c:\users\David\AppData\Local\WinZip
2010-08-14 15:39 . 2010-08-14 15:40 ——– d—–w- c:\program files\Common Files\Adobe
2010-08-12 22:56 . 2010-06-30 06:25 978432 —-a-w- c:\windows\system32\wininet.dll
2010-08-12 22:52 . 2010-06-19 06:33 3955080 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-12 22:52 . 2010-06-19 06:33 3899784 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-08-12 22:27 . 2010-06-14 06:12 1286016 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-12 22:20 . 2010-07-29 06:30 197632 —-a-w- c:\windows\system32\ir32_32.dll
2010-08-12 22:20 . 2010-07-29 06:30 82944 —-a-w- c:\windows\system32\iccvid.dll
2010-08-12 22:18 . 2010-06-19 06:23 37376 —-a-w- c:\windows\system32\rtutils.dll
2010-08-12 22:17 . 2010-06-08 06:02 1233920 —-a-w- c:\windows\system32\msxml3.dll
2010-08-12 22:16 . 2010-06-22 02:47 310784 —-a-w- c:\windows\system32\drivers\srv.sys
2010-08-12 22:16 . 2010-06-22 02:47 307200 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-08-12 22:16 . 2010-06-22 02:47 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-08-12 22:02 . 2010-06-16 05:48 224256 —-a-w- c:\windows\system32\schannel.dll
2010-08-12 22:01 . 2010-06-19 04:07 2326016 —-a-w- c:\windows\system32\win32k.sys
2010-08-08 19:23 . 2010-08-08 19:23 47364 —-a-w- c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-08-08 09:44 . 2010-08-08 09:44 ——– d—–w- c:\program files\Bethesda Softworks
2010-08-07 12:07 . 2010-08-15 11:41 ——– d—–w- c:\users\David\AppData\Local\CrashDumps
2010-08-04 14:40 . 2009-05-18 22:17 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-08-04 14:40 . 2008-04-17 21:12 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2010-08-04 14:40 . 2010-08-04 14:40 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-08-04 14:40 . 2010-08-04 14:47 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-08-04 14:40 . 2010-08-04 14:40 ——– d—–w- c:\program files\Symantec
2010-08-04 14:39 . 2010-08-04 21:10 ——– d—–w- c:\windows\system32\drivers\N360
2010-08-04 14:39 . 2010-08-04 14:39 ——– d—–w- c:\program files\Norton 360
2010-08-04 14:20 . 2010-08-04 21:10 ——– d—–w- c:\program files\NortonInstaller
2010-07-31 13:49 . 2010-07-31 13:49 ——– d—–w- c:\programdata\Blizzard
2010-07-26 20:54 . 2010-08-08 19:23 ——– d—–w- c:\program files\StarCraft II
2010-07-26 20:54 . 2010-08-05 20:57 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2010-07-26 20:54 . 2010-07-26 21:23 ——– d—–w- c:\programdata\Blizzard Entertainment
2010-07-22 09:25 . 2010-07-22 10:56 ——– d—–w- c:\program files\BitLord

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 11:46 . 2009-12-19 13:40 ——– d—–w- c:\program files\Steam
2010-08-14 21:09 . 2010-08-14 21:09 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_xusb21_01009.Wdf
2010-08-14 08:00 . 2009-11-12 09:14 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-04 14:40 . 2010-08-04 14:40 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-08-04 14:40 . 2010-08-04 14:40 7443 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-08-04 14:39 . 2009-11-14 11:19 ——– d—–w- c:\programdata\Norton
2010-08-04 14:20 . 2009-11-14 11:18 ——– d—–w- c:\programdata\NortonInstaller
2010-08-01 09:22 . 2009-12-19 13:40 ——– d—–w- c:\program files\Common Files\Steam
2010-07-16 21:43 . 2010-07-16 21:43 ——– d—–w- c:\users\David\AppData\Roaming\NVIDIA
2010-07-16 21:40 . 2009-11-14 11:34 ——– d—–w- c:\program files\Dragon Age
2010-07-14 10:59 . 2010-07-14 10:59 ——– d—–w- c:\program files\FLV Player
2010-07-12 09:09 . 2010-07-12 09:09 ——– d—–w- c:\users\David\AppData\Roaming\ScummVM
2010-07-09 12:00 . 2010-05-10 11:38 ——– d—–w- c:\programdata\DivX
2010-07-09 12:00 . 2010-05-10 11:40 57344 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-09 11:59 . 2010-07-09 11:59 57715 —-a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-07-09 11:59 . 2010-07-09 11:59 56765 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-07-09 11:59 . 2009-11-17 14:33 ——– d—–w- c:\program files\DivX
2010-07-09 11:59 . 2010-07-09 11:59 84054 —-a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-07-09 11:59 . 2010-06-06 07:43 ——– d—–w- c:\program files\Common Files\PX Storage Engine
2010-07-09 11:59 . 2010-07-09 11:59 54153 —-a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-07-09 11:57 . 2010-05-10 11:40 895256 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-07-09 11:57 . 2010-05-10 11:40 1090856 —-a-w- c:\programdata\DivX\Setup\Resource.dll
2010-07-08 08:47 . 2010-07-08 08:47 ——– d—–w- c:\program files\ASUS
2010-07-08 08:45 . 2010-07-08 08:47 24576 —-a-w- c:\windows\system32\AsIO.dll
2010-07-08 08:45 . 2010-07-08 08:47 12400 —-a-w- c:\windows\system32\drivers\AsIO.sys
2010-07-07 21:58 . 2010-07-07 21:58 ——– d—–w- c:\users\David\AppData\Roaming\LucasArts
2010-07-07 15:14 . 2009-12-23 12:50 ——– d—–w- c:\program files\Adventure Game Studio 3.1.2 SP1
2010-07-04 16:55 . 2010-06-20 08:26 ——– d—–w- c:\program files\QuickTime
2010-07-04 16:55 . 2010-03-15 09:32 ——– d—–w- c:\program files\Apple Software Update
2010-07-04 16:55 . 2009-11-30 11:39 ——– d—–w- c:\program files\GOG.com Downloader
2010-07-04 08:20 . 2009-11-12 09:16 ——– d—–w- c:\programdata\NVIDIA
2010-07-04 08:20 . 2009-11-12 09:17 ——– d—–w- c:\program files\NVIDIA Corporation
2010-07-03 08:59 . 2010-05-18 15:30 ——– d—–w- c:\programdata\WinZip
2010-06-25 22:49 . 2010-06-25 22:49 ——– d—–w- c:\program files\Microsoft.NET
2010-06-24 08:53 . 2010-06-24 08:53 ——– d—–w- c:\users\David\AppData\Roaming\ImgBurn
2010-06-20 08:26 . 2010-06-20 08:26 ——– d—–w- c:\programdata\Apple Computer
2010-06-15 20:44 . 2010-06-26 22:49 232457 —-a-r- C:\Earthbound (U) (Prototype).zip
2010-06-15 20:40 . 2010-06-26 22:48 1105920 —-a-r- C:\RockNESX.exe
2010-06-06 07:43 . 2010-06-06 07:43 56997 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 57609 —-a-w- c:\programdata\DivX\MFComponents\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 57054 —-a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 54166 —-a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 57532 —-a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 56458 —-a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 54174 —-a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 54128 —-a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 54644 —-a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 56969 —-a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-06-06 07:43 . 2010-06-06 07:43 54101 —-a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-05-27 07:24 . 2010-06-11 08:07 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-05-27 03:49 . 2010-06-11 08:07 293888 —-a-w- c:\windows\system32\atmfd.dll
2010-05-21 13:14 . 2009-11-14 11:46 221568 ——w- c:\windows\system32\MpSigStub.exe
2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-24 7514656]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-24 1833504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-22 1343400]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\SYMDS.SYS [2009-10-15 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100719.001\BHDrvx86.sys [2010-07-19 692272]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100813.004\IDSvix86.sys [2010-06-17 344112]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS [2010-05-06 339504]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe [2010-02-26 126392]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-08-04 102448]

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\4.2.0.12\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-913025970-3390380857-757556330-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:59,17,f1,7b,89,9a,fc,cb,f3,f3,f2,4e,bb,92,31,b5,78,5c,51,6f,bf,17,68,
2f,30,d9,a0,a9,1f,20,6e,7e,31,02,de,14,08,67,41,c5,d0,11,8e,73,f1,cb,73,24,\
"??"=hex:69,6f,5c,46,6a,89,f9,ee,2d,48,e0,10,87,42,1e,12

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(552)
c:\windows\system32\cryptnet.dll

- - - - - - - > 'Explorer.exe'(3364)
c:\windows\system32\ntshrui.dll
.
Completion time: 2010-08-17 23:45:17
ComboFix-quarantined-files.txt 2010-08-17 22:45

Pre-Run: 383,515,213,824 bytes free
Post-Run: 383,714,078,720 bytes free

- - End Of File - - 065BC2C7EDE65723B5F1EB01E3F78971





OTL log

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93935F7F-9C88-42F8-8445-95251D27FABC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93935F7F-9C88-42F8-8445-95251D27FABC}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\PlayNC Launcher deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\David\Desktop\cmd.bat deleted successfully.
C:\Users\David\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


[EMPTYTEMP]

User: All Users

User: David
->Temp folder emptied: 18440166 bytes
->Temporary Internet Files folder emptied: 48725338 bytes
->Flash cache emptied: 173508 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41044 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 401408 bytes
%systemroot%\System32 .tmp files removed: 3128320 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 787955 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 68.00 mb


[EMPTYFLASH]

User: All Users

User: David
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.10.0 log created on 08172010_232507
Post #13
Hello,

Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Post #14
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4442

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

18/08/2010 00:02:59
mbam-log-2010-08-18 (00-02-59).txt

Scan type: Quick scan
Objects scanned: 128148
Time elapsed: 3 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)






Results of screen317's Security Check version 0.99.5
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
ESET Online Scanner v3
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Adobe Flash Player
Adobe Reader 9.3.3
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
ESET ESET Online Scanner OnlineCmdLineScanner.exe
````````````````````````````````
DNS Vulnerability Check:
Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

``````````End of Log````````````



In ESETScan it did not find anythink, and there no way to bring up a log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI