What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Unable to remove the google redirect virus

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #2
Hi Terry Tibbs,

:welcome:

My name is NightWizard and I will be your helper. :)

While I go through your log, I would very much appreciate it if you read the following.

  • I aim provide you with the best instructions possible to resolve your issue. However, I ask that you understand that malware is complex and the process usually takes a few attempts before successfully cleaning everything out. In severe cases cleaning may not be possible and a reformat may be our only option.
  • If you are unresponsive to this thread within three days, the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.
  • Please do not make any new threads about this issue here or any other malware removal forum; it wastes other helpers' time and it can be dangerous for your PC.
  • If you don't understand a set of instructions or you are having trouble performing some of the fix, don't panic! Let me know and I will be happy to help in any way I can.
  • Please remember that the absence of symptoms does not mean you are clean. I request that you stick to this log until the very end - I will inform you when your system is clean.
  • Please do not use any tools other than the ones I instruct you to use. Some of the tools available can be dangerous if used incorrectly.

Please be advised that I am still in training at this forum. My posts will be checked by experts before I post in this thread. This is to ensure you get the best possible help available. This may cause delay however I will do my best to limit the time gaps between posts.


Thanks for choosing WhatTheTech and I will be back with a fix shortly! :)


-NightWizard
Post #3
I forgot to post the gooredfix and tdsskiller logs, i will do so now. GooredFix by jpshortstuff (03.07.10.1) Log created at 05:46 on 02/09/2010 (User) Firefox version 3.6.8 (en-GB) ========== GooredScan ========== Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{78E90AA8-AE08-4D40-A92F-4F552C48CD92} -> Success! Deleting C:\Documents and Settings\User\Local Settings\Application Data\{78E90AA8-AE08-4D40-A92F-4F552C48CD92} -> Success! ========== GooredLog ========== C:\Program Files\Mozilla Firefox\extensions\ {972ce4c6-7e08-4474-a285-3208198ce6fd} [13:22 10/06/2009] {AB2CE124-6272-4b12-94A9-7303C7397BD1} [10:18 09/04/2010] {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [20:09 26/08/2010] C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\extensions\ {20a82645-c095-46ed-80e3-08825760534b} [03:25 09/01/2010] {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} [17:25 15/12/2009] [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [16:26 06/01/2010] "[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [20:08 26/08/2010] -=E.O.F=- 2010/08/30 18:00:35.0765 TDSS rootkit removing tool 2.4.1.3 Aug 27 2010 08:53:42 2010/08/30 18:00:35.0765 ================================================================================ 2010/08/30 18:00:35.0765 SystemInfo: 2010/08/30 18:00:35.0765 2010/08/30 18:00:35.0765 OS Version: 5.1.2600 ServicePack: 2.0 2010/08/30 18:00:35.0765 Product type: Workstation 2010/08/30 18:00:35.0765 ComputerName: FATHOM 2010/08/30 18:00:35.0765 UserName: User 2010/08/30 18:00:35.0765 Windows directory: C:\WINDOWS 2010/08/30 18:00:35.0765 System windows directory: C:\WINDOWS 2010/08/30 18:00:35.0765 Processor architecture: Intel x86 2010/08/30 18:00:35.0765 Number of processors: 1 2010/08/30 18:00:35.0765 Page size: 0x1000 2010/08/30 18:00:35.0765 Boot type: Normal boot 2010/08/30 18:00:35.0765 ================================================================================ 2010/08/30 18:00:36.0187 Initialize success 2010/08/30 18:00:41.0296 ================================================================================ 2010/08/30 18:00:41.0296 Scan started 2010/08/30 18:00:41.0296 Mode: Manual; 2010/08/30 18:00:41.0296 ================================================================================ 2010/08/30 18:00:44.0046 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2010/08/30 18:00:44.0265 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 2010/08/30 18:00:44.0750 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys 2010/08/30 18:00:45.0000 AFD (6a0397376853e604de8e1e7a87fc08ac) C:\WINDOWS\System32\drivers\afd.sys 2010/08/30 18:00:47.0359 ALCXWDM (fcb505a7fa9dd4b8b98064792fd038a4) C:\WINDOWS\system32\drivers\ALCXWDM.SYS 2010/08/30 18:00:48.0937 AR5211 (d4e7ed3ae224c851b08f3a3a85c37e88) C:\WINDOWS\system32\DRIVERS\ar5211.sys 2010/08/30 18:00:50.0546 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2010/08/30 18:00:50.0718 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys 2010/08/30 18:00:50.0906 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2010/08/30 18:00:51.0140 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2010/08/30 18:00:51.0281 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2010/08/30 18:00:51.0468 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2010/08/30 18:00:51.0609 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 2010/08/30 18:00:51.0828 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2010/08/30 18:00:51.0968 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys 2010/08/30 18:00:52.0156 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2010/08/30 18:00:52.0421 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 2010/08/30 18:00:52.0671 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys 2010/08/30 18:00:53.0171 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys 2010/08/30 18:00:53.0359 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys 2010/08/30 18:00:53.0609 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys 2010/08/30 18:00:53.0750 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2010/08/30 18:00:53.0906 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys 2010/08/30 18:00:54.0187 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys 2010/08/30 18:00:54.0328 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys 2010/08/30 18:00:54.0484 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys 2010/08/30 18:00:54.0609 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys 2010/08/30 18:00:54.0703 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys 2010/08/30 18:00:54.0875 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys 2010/08/30 18:00:55.0015 FltMgr (6cc5181f718820861eeadae38f764b75) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 2010/08/30 18:00:55.0156 fssfltr (e0087225b137e57239ff40f8ae82059b) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 2010/08/30 18:00:55.0281 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2010/08/30 18:00:55.0453 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2010/08/30 18:00:55.0796 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 2010/08/30 18:00:55.0953 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2010/08/30 18:00:56.0203 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 2010/08/30 18:00:56.0328 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 2010/08/30 18:00:56.0453 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 2010/08/30 18:00:56.0593 HTTP (261bf53e1d1c21f04b4e748a6ed3d055) C:\WINDOWS\system32\Drivers\HTTP.sys 2010/08/30 18:00:57.0140 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2010/08/30 18:00:57.0375 Imapi (12c59b8929121ace2f55acc86682cf12) C:\WINDOWS\system32\DRIVERS\imapi.sys 2010/08/30 18:00:57.0656 intelppm (bf736db0517d2b5efaecf3a7d2c65228) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2010/08/30 18:00:57.0812 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 2010/08/30 18:00:57.0953 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2010/08/30 18:00:58.0156 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2010/08/30 18:00:58.0281 IpNat (472c75f85e631f8aa87d21c9fee6238d) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2010/08/30 18:00:58.0421 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2010/08/30 18:00:58.0531 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys 2010/08/30 18:00:58.0656 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2010/08/30 18:00:58.0796 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2010/08/30 18:00:58.0937 kmixer (8531438246ce9474e41ee1599904c0c7) C:\WINDOWS\system32\drivers\kmixer.sys 2010/08/30 18:00:59.0109 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys 2010/08/30 18:00:59.0375 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2010/08/30 18:00:59.0500 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys 2010/08/30 18:00:59.0640 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2010/08/30 18:00:59.0781 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys 2010/08/30 18:01:00.0093 MRxDAV (9921d9df98f266560ec28b3bdb580180) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2010/08/30 18:01:00.0265 MRxSmb (3500e756812e716351f2d341ae1d5623) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2010/08/30 18:01:00.0406 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys 2010/08/30 18:01:00.0531 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2010/08/30 18:01:00.0656 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2010/08/30 18:01:00.0796 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys 2010/08/30 18:01:00.0937 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2010/08/30 18:01:01.0062 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys 2010/08/30 18:01:01.0234 Mup (a1dd45cdcd2bf8c57a9a0493c09b00b3) C:\WINDOWS\system32\drivers\Mup.sys 2010/08/30 18:01:01.0453 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 2010/08/30 18:01:01.0578 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys 2010/08/30 18:01:01.0687 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 2010/08/30 18:01:01.0859 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2010/08/30 18:01:01.0968 Ndisuio (77d9bf86b912104c229d4f0d25be3c12) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2010/08/30 18:01:02.0140 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2010/08/30 18:01:02.0265 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys 2010/08/30 18:01:02.0421 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys 2010/08/30 18:01:02.0546 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys 2010/08/30 18:01:02.0718 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys 2010/08/30 18:01:02.0859 Ntfs (52723e766051ac8f0b70491ad91f0079) C:\WINDOWS\system32\drivers\Ntfs.sys 2010/08/30 18:01:03.0078 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2010/08/30 18:01:03.0203 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2010/08/30 18:01:03.0406 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2010/08/30 18:01:03.0515 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\drivers\Parport.sys 2010/08/30 18:01:03.0640 PartMgr (1628710c352bd79abeba234356e2b586) C:\WINDOWS\system32\drivers\PartMgr.sys 2010/08/30 18:01:03.0765 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2010/08/30 18:01:03.0875 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys 2010/08/30 18:01:04.0093 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2010/08/30 18:01:04.0203 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys 2010/08/30 18:01:05.0015 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2010/08/30 18:01:05.0234 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys 2010/08/30 18:01:05.0343 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2010/08/30 18:01:05.0812 RasAcd (f0f90dc4bcef21ba51ffd89371236fd2) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2010/08/30 18:01:05.0828 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\rasacd.sys. Real md5: f0f90dc4bcef21ba51ffd89371236fd2, Fake md5: fe0d99d6f31e4fad8159f690d68ded9c 2010/08/30 18:01:05.0828 RasAcd - detected Rootkit.Win32.TDSS.tdl3 (0) 2010/08/30 18:01:05.0937 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2010/08/30 18:01:06.0078 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2010/08/30 18:01:06.0187 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2010/08/30 18:01:06.0296 Rdbss (b48441a6dc703ee4c36db14ee51a189c) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2010/08/30 18:01:06.0765 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2010/08/30 18:01:07.0046 RDPWD (047bea21274c8a4a233674a76c958c2c) C:\WINDOWS\system32\drivers\RDPWD.sys 2010/08/30 18:01:07.0218 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys 2010/08/30 18:01:07.0359 rspndr (0e11b35e972796042044bc27ce13b065) C:\WINDOWS\system32\DRIVERS\rspndr.sys 2010/08/30 18:01:07.0546 SCDEmu (16b1abe7f3e35f21dac57592b6c5d464) C:\WINDOWS\system32\drivers\SCDEmu.sys 2010/08/30 18:01:07.0703 Secdrv (7570380037993520842c2868121a01f9) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2010/08/30 18:01:07.0859 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\drivers\Serial.sys 2010/08/30 18:01:08.0000 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys 2010/08/30 18:01:08.0203 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys 2010/08/30 18:01:08.0406 smserial (fc512d9288cd4985a3f59a1184559051) C:\WINDOWS\system32\DRIVERS\smserial.sys 2010/08/30 18:01:08.0687 splitter (9bb1dd670cb7505a90fc4e61d4aa8227) C:\WINDOWS\system32\drivers\splitter.sys 2010/08/30 18:01:08.0859 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys 2010/08/30 18:01:09.0015 Srv (d4af9861c3b6a2163d26dc6b9cf05e2a) C:\WINDOWS\system32\DRIVERS\srv.sys 2010/08/30 18:01:09.0187 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 2010/08/30 18:01:09.0343 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys 2010/08/30 18:01:09.0437 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys 2010/08/30 18:01:09.0781 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys 2010/08/30 18:01:10.0000 Tcpip (744e57c99232201ae98c49168b918f48) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2010/08/30 18:01:10.0125 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys 2010/08/30 18:01:10.0234 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys 2010/08/30 18:01:10.0343 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys 2010/08/30 18:01:10.0578 uagp35 (49c805d42d75eddc9b6a7130999c9054) C:\WINDOWS\system32\DRIVERS\uagp35.sys 2010/08/30 18:01:10.0671 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys 2010/08/30 18:01:10.0906 Update (1f03139b77b21c6d84c688798808bc28) C:\WINDOWS\system32\DRIVERS\update.sys 2010/08/30 18:01:11.0109 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys 2010/08/30 18:01:11.0203 usbaudio (2f005eb50645d537fff23b472691c269) C:\WINDOWS\system32\drivers\usbaudio.sys 2010/08/30 18:01:11.0296 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2010/08/30 18:01:11.0421 usbehci (35e69410d5a2f1de386b37f4fc17aeb7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2010/08/30 18:01:11.0546 usbhub (db53e336c44cb0975d7dcb35bac0ecda) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2010/08/30 18:01:11.0687 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2010/08/30 18:01:11.0812 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2010/08/30 18:01:11.0984 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2010/08/30 18:01:12.0375 usbuhci (b3671fbc569afe9390175561f1ab335c) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2010/08/30 18:01:12.0500 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys 2010/08/30 18:01:12.0687 viaagp1 (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys 2010/08/30 18:01:12.0812 viagfx (5dbffb9a41da40c8d77c5cdeb98a55b8) C:\WINDOWS\system32\DRIVERS\vtmini.sys 2010/08/30 18:01:12.0984 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys 2010/08/30 18:01:13.0109 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys 2010/08/30 18:01:13.0328 VX1000 (2fbf9e882fc28a315a86aa1f831c144e) C:\WINDOWS\system32\DRIVERS\VX1000.sys 2010/08/30 18:01:13.0625 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2010/08/30 18:01:13.0828 wdmaud (0bfa8203b8148fb4e54bc212c41ce497) C:\WINDOWS\system32\drivers\wdmaud.sys 2010/08/30 18:01:14.0078 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 2010/08/30 18:01:14.0234 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2010/08/30 18:01:14.0343 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2010/08/30 18:01:14.0500 ================================================================================ 2010/08/30 18:01:14.0500 Scan finished 2010/08/30 18:01:14.0500 ================================================================================ 2010/08/30 18:01:14.0531 Detected object count: 1 2010/08/30 18:01:22.0609 RasAcd (f0f90dc4bcef21ba51ffd89371236fd2) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2010/08/30 18:01:22.0609 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\rasacd.sys. Real md5: f0f90dc4bcef21ba51ffd89371236fd2, Fake md5: fe0d99d6f31e4fad8159f690d68ded9c 2010/08/30 18:01:27.0140 Backup copy found, using it.. 2010/08/30 18:01:27.0171 C:\WINDOWS\system32\DRIVERS\rasacd.sys - will be cured after reboot 2010/08/30 18:01:27.0171 Rootkit.Win32.TDSS.tdl3(RasAcd) - User select action: Cure 2010/08/30 18:07:03.0296 Deinitialize success
Post #5
Hi Terry Tibs,

Sorry for the delay, I am from Australia and to the best of my knowledge there are no teachers at WTT from Aus so that just causes a little more delay due to time zone issues that cannot be avoided.

Please work your way through the following steps:


Step One

Download OTL to your Desktop from one of the following links:

LINK 1
LINK 2
LINK 3

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Download the following file scan.txt to your Desktop from HERE.
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
  • Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in this thread.




Step Two

Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries



In your next reply please include:
  • The OTL log.
  • The GMER log.
Cheers :thumbup:
Post #8
OTL logfile created on: 05/09/2010 19:42:48 - Run 4
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\User\My Documents
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

958.00 Mb Total Physical Memory | 313.00 Mb Available Physical Memory | 33.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 12.48 Gb Free Space | 33.49% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FATHOM
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\My Documents\Downloads\ztmgx2dp.exe ()
PRC - C:\Documents and Settings\User\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\AIM\aim.exe (AOL Inc.)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe (Skype Technologies S.A.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\WINDOWS\vVX1000.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\OpenOffice.org 2.4\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 2.4\program\soffice.exe (OpenOffice.org)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\system32\VTTrayp.exe (S3 Graphics Co., Ltd.)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\WINDOWS\system32\VTTimer.exe (S3 Graphics, Inc.)
PRC - C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\User\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\WMVCore.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\portabledeviceapi.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wmasf.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\ntlanman.dll (Microsoft Corporation)
MOD - C:\WINDOWS\udehucopojehu.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\xpsp2res.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msgina.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\odbc32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\netui1.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\odbcint.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\netui0.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\shgina.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\sti.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\winsta.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\davclnt.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\drprov.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\netrap.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (GoogleDesktopManager-110309-193829) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (Via4in1) – C:\Documents and Settings\User\Via4in1.sys File not found
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (VX1000) – C:\WINDOWS\system32\drivers\VX1000.sys (Microsoft Corporation)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (smserial) – C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.)
DRV - (viaagp1) – C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 86 5A 72 28 6F 48 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.aol.com/?src=aim&ncid=snsusaimc00000001"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {9BAEC793-0998-4CCC-A253-877A27D39B6B}:1.9.1
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?invocationType=bu10aiminstabie7&sredir=2706&query="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Firefox\Extensions\\{9BAEC793-0998-4CCC-A253-877A27D39B6B}: C:\Documents and Settings\User\Local Settings\Application Data\{9BAEC793-0998-4CCC-A253-877A27D39B6B} [2010/09/02 05:50:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/26 20:58:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/27 19:42:14 | 000,000,000 | —D | M]

[2010/05/17 01:08:53 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/05/17 01:08:53 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Extensions\[removed]
[2009/03/09 16:08:37 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\extensions
[2009/03/09 16:08:38 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/09/05 00:06:46 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\extensions
[2010/01/09 04:25:34 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/15 18:25:29 | 000,000,000 | —D | M] (DVDVideoSoft Toolbar) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010/08/27 19:42:21 | 000,001,490 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\searchplugins\AOL Search.xml
[2010/05/10 07:56:41 | 000,001,819 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\searchplugins\bing.xml
[2010/08/26 20:53:51 | 000,000,873 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\jqfemulh.default\searchplugins\conduit.xml
[2010/09/05 04:09:58 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/09 11:18:17 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/08/26 21:09:40 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/08/26 21:08:59 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/07/23 01:29:54 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/08/27 19:42:21 | 000,001,490 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\AOL Search.xml
[2010/07/23 01:29:54 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/07/23 01:29:54 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/07/23 01:29:54 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2004/08/04 14:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files\DVDVideoSoft\tbDVD1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Dxobavakuleja] C:\WINDOWS\udehucopojehu.DLL ()
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKLM..\Run: [VX1000] C:\WINDOWS\vVX1000.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Aim] C:\Program Files\AIM\aim.exe (AOL Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 1
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: google.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/18 16:05:22 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 90 Days ==========

[2010/09/02 05:50:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\{9BAEC793-0998-4CCC-A253-877A27D39B6B}
[2010/09/02 05:47:27 | 001,210,704 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\User\My Documents\TDSSKiller.exe
[2010/09/02 05:46:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\GooredFix Backups
[2010/08/31 04:47:18 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\OTL.exe
[2010/08/31 03:00:43 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/08/30 19:45:26 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.minecraft
[2010/08/30 18:13:44 | 000,000,000 | -HSD | C] – C:\Documents and Settings\User\PrivacIE
[2010/08/30 17:16:50 | 000,000,000 | —D | C] – C:\Program Files\mIRC
[2010/08/30 17:16:50 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\mIRC
[2010/08/27 19:42:30 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\acccore
[2010/08/27 19:42:27 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\AOL
[2010/08/27 19:42:27 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\AIM
[2010/08/27 19:42:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/08/27 19:42:14 | 000,000,000 | —D | C] – C:\Program Files\AIM
[2010/08/27 19:42:13 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Software Update Utility
[2010/08/27 19:42:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AOL
[2010/08/26 21:10:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/08/26 17:05:53 | 000,000,000 | -HSD | C] – C:\Documents and Settings\User\IECompatCache
[2010/08/26 06:45:58 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/08/26 06:31:02 | 000,000,000 | -HSD | C] – C:\Documents and Settings\User\IETldCache
[2010/08/26 06:11:44 | 000,000,000 | —D | C] – C:\2884ae4f75ac9afd76
[2010/08/26 06:06:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Identities
[2010/08/26 02:05:51 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/08/26 02:05:30 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/08/26 02:05:28 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/08/26 02:05:28 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/26 02:05:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/08/26 01:55:14 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/08/26 01:55:14 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/08/26 01:54:49 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\My Received Files
[2010/08/26 01:43:20 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\erxtjbgil
[2010/08/26 01:42:57 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Windows Server
[2010/08/26 01:42:47 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\930F51FB706AE85FD9422690D7E383D4
[2010/08/25 17:51:40 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\TeamViewer
[2010/08/25 17:50:38 | 000,000,000 | —D | C] – C:\Program Files\TeamViewer
[2010/08/23 23:58:22 | 000,679,936 | —- | C] (Generated by JEDI) – C:\WINDOWS\System32\D3DX81ab.dll
[2010/08/23 23:58:21 | 000,000,000 | —D | C] – C:\Program Files\Cheat Engine
[2010/08/20 23:18:22 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Ventrilo
[2010/08/20 23:16:55 | 000,000,000 | —D | C] – C:\Program Files\Ventrilo
[2010/08/20 23:16:22 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/07/29 17:41:27 | 000,000,000 | —D | C] – C:\TEMP
[2010/06/30 19:48:05 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\PriceGong
[2010/06/10 03:49:35 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\PCHealth
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/05 18:50:09 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/05 17:41:26 | 000,000,120 | —- | M] () – C:\WINDOWS\Dmipuzeqi.dat
[2010/09/05 17:41:23 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/05 17:40:57 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/05 17:40:55 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/05 12:51:00 | 000,000,000 | —- | M] () – C:\WINDOWS\Rbosimonusijego.bin
[2010/09/05 12:50:42 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/05 01:34:09 | 000,000,046 | —- | M] () – C:\Documents and Settings\User\jagex_runescape_preferences.dat
[2010/09/05 00:23:36 | 000,000,099 | —- | M] () – C:\Documents and Settings\User\jagex_runescape_preferences2.dat
[2010/09/04 00:47:03 | 000,002,265 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/09/02 09:42:30 | 003,145,728 | —- | M] () – C:\Documents and Settings\User\ntuser.dat
[2010/09/02 09:42:30 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\User\ntuser.ini
[2010/09/01 05:19:21 | 000,040,375 | —- | M] () – C:\Documents and Settings\User\My Documents\1283314446076.png
[2010/08/31 16:56:24 | 001,210,704 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\User\My Documents\TDSSKiller.exe
[2010/08/31 04:47:21 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\OTL.exe
[2010/08/31 03:01:41 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/08/30 19:45:11 | 000,232,159 | —- | M] () – C:\Documents and Settings\User\My Documents\Minecraft.exe
[2010/08/30 19:17:17 | 000,000,682 | —- | M] () – C:\Documents and Settings\User\My Documents\SwiftKit.lnk
[2010/08/30 17:16:50 | 000,000,626 | —- | M] () – C:\Documents and Settings\User\My Documents\mIRC.lnk
[2010/08/30 10:54:05 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/27 19:42:26 | 000,000,454 | -H– | M] () – C:\IPH.PH
[2010/08/27 19:42:20 | 000,001,592 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/08/26 20:58:12 | 000,001,620 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/26 20:58:12 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/08/26 06:50:01 | 000,000,815 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/26 01:43:41 | 000,000,005 | —- | M] () – C:\zrpt.xml
[2010/08/25 17:50:52 | 000,000,879 | —- | M] () – C:\Documents and Settings\All Users\Desktop\TeamViewer 5.lnk
[2010/08/20 23:16:57 | 000,000,262 | —- | M] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/08/08 23:15:11 | 000,000,000 | —- | M] () – C:\Documents and Settings\User\jagex__preferences3.dat
[2010/07/01 11:37:24 | 000,508,956 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/01 11:37:24 | 000,434,212 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/07/01 11:37:24 | 000,068,826 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/18 11:39:32 | 000,060,928 | —- | M] () – C:\Documents and Settings\User\Desktop\Jan CV.doc
[2010/06/16 00:07:42 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/11 03:39:56 | 000,144,424 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/01 05:19:20 | 000,040,375 | —- | C] () – C:\Documents and Settings\User\My Documents\1283314446076.png
[2010/08/30 19:45:12 | 000,232,159 | —- | C] () – C:\Documents and Settings\User\My Documents\Minecraft.exe
[2010/08/30 19:17:17 | 000,000,682 | —- | C] () – C:\Documents and Settings\User\My Documents\SwiftKit.lnk
[2010/08/30 17:16:50 | 000,000,626 | —- | C] () – C:\Documents and Settings\User\My Documents\mIRC.lnk
[2010/08/27 19:42:20 | 000,001,592 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/08/27 19:42:03 | 000,000,454 | -H– | C] () – C:\IPH.PH
[2010/08/26 01:44:50 | 000,000,120 | —- | C] () – C:\WINDOWS\Dmipuzeqi.dat
[2010/08/26 01:44:50 | 000,000,000 | —- | C] () – C:\WINDOWS\Rbosimonusijego.bin
[2010/08/26 01:43:37 | 000,000,005 | —- | C] () – C:\zrpt.xml
[2010/08/25 17:50:52 | 000,000,879 | —- | C] () – C:\Documents and Settings\All Users\Desktop\TeamViewer 5.lnk
[2010/08/23 23:58:22 | 001,970,176 | —- | C] () – C:\WINDOWS\System32\d3dx9.dll
[2010/08/20 23:16:48 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/08/08 23:15:11 | 000,000,000 | —- | C] () – C:\Documents and Settings\User\jagex__preferences3.dat
[2010/06/18 11:39:32 | 000,060,928 | —- | C] () – C:\Documents and Settings\User\Desktop\Jan CV.doc
[2010/04/14 16:01:51 | 000,000,334 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/04/14 16:01:37 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2009/06/26 17:21:02 | 000,015,498 | —- | C] () – C:\WINDOWS\VX1000.ini
[2009/02/12 22:02:39 | 000,024,576 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/12 22:01:50 | 000,000,169 | —- | C] () – C:\WINDOWS\RtlRack.ini
[2008/12/18 16:27:15 | 000,000,164 | —- | C] () – C:\WINDOWS\avrack.ini
[2008/12/18 16:27:02 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/12/18 16:22:46 | 000,065,536 | —- | C] () – C:\WINDOWS\sm56spn.dll
[2008/12/18 16:22:45 | 000,065,536 | —- | C] () – C:\WINDOWS\sm56itl.dll
[2008/12/18 16:22:45 | 000,065,536 | —- | C] () – C:\WINDOWS\sm56ger.dll
[2008/12/18 16:22:45 | 000,065,536 | —- | C] () – C:\WINDOWS\sm56fra.dll
[2008/12/18 16:22:45 | 000,065,536 | —- | C] () – C:\WINDOWS\sm56eng.dll
[2008/12/18 16:22:45 | 000,049,152 | —- | C] () – C:\WINDOWS\sm56jpn.dll
[2008/12/18 16:22:45 | 000,045,056 | —- | C] () – C:\WINDOWS\sm56cht.dll
[2008/12/18 16:22:44 | 000,065,536 | —- | C] () – C:\WINDOWS\sm56brz.dll
[2008/12/18 16:22:44 | 000,045,056 | —- | C] () – C:\WINDOWS\sm56chs.dll
[2007/03/08 17:48:36 | 000,199,168 | —- | C] () – C:\WINDOWS\udehucopojehu.dll

========== LOP Check ==========

[2010/08/27 19:42:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/04/08 22:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Musicnotes
[2010/09/01 18:20:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SwiftKit
[2010/04/06 00:43:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/08/30 19:46:36 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\.minecraft
[2010/08/26 01:43:08 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\930F51FB706AE85FD9422690D7E383D4
[2010/08/27 19:42:41 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\acccore
[2010/05/08 14:40:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Facebook
[2010/09/05 19:08:54 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\LimeWire
[2010/09/03 23:54:14 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\PriceGong
[2009/03/09 16:59:37 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Serif
[2010/08/25 17:52:22 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\TeamViewer
[2010/09/05 19:41:33 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\uTorrent

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/12/18 16:05:22 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2008/12/18 15:57:47 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2008/12/18 16:05:22 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/06/07 03:11:22 | 000,115,224 | —- | M] () – C:\img2-001.raw
[2010/05/17 16:25:37 | 000,115,224 | —- | M] () – C:\img2-002.raw
[2008/12/18 16:05:22 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/08/27 19:42:26 | 000,000,454 | -H– | M] () – C:\IPH.PH
[2008/12/18 16:05:22 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 14:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 14:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/09/05 17:40:50 | 1509,949,440 | -HS- | M] () – C:\pagefile.sys
[2010/08/26 06:20:03 | 000,000,879 | —- | M] () – C:\rkill.log
[2010/09/02 05:48:03 | 000,034,882 | —- | M] () – C:\TDSSKiller.2.4.1.4_02.09.2010_05.47.29_log.txt
[2010/08/26 01:43:41 | 000,000,005 | —- | M] () – C:\zrpt.xml

< %systemroot%\Fonts\*.com >
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/12/18 16:04:37 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/10/14 22:41:46 | 000,072,192 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp43a.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 00:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/02/12 21:39:50 | 000,001,682 | -H– | M] () – C:\Documents and Settings\User\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/12/18 15:51:23 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/12/18 15:51:23 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/12/18 15:51:23 | 000,872,448 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/12/18 16:05:31 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2008/12/18 16:09:48 | 000,000,060 | -HS- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/12/18 16:09:48 | 000,000,079 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/04/14 16:00:55 | 066,154,208 | —- | M] () – C:\Documents and Settings\User\Desktop\CDA_DriverOnly_NonNetwork_enu_NB.exe
[2009/12/15 18:24:45 | 008,193,843 | —- | M] (DVDVideoSoft Limited. ) – C:\Documents and Settings\User\Desktop\FreeDiscBurner.exe
[2010/05/08 14:39:46 | 002,114,184 | —- | M] (Facebook, Inc.) – C:\Documents and Settings\User\Desktop\Install_Facebook_Plug-In_1.0.3.exe
[2009/06/10 14:30:32 | 001,878,888 | —- | M] (Adobe Systems Incorporated) – C:\Documents and Settings\User\Desktop\install_flash_player.exe
[2010/05/17 01:06:23 | 024,184,872 | —- | M] (Lime Wire LLC) – C:\Documents and Settings\User\Desktop\LimeWireWin.exe
[2010/04/08 22:01:57 | 018,726,304 | —- | M] (Musicnotes Inc. ) – C:\Documents and Settings\User\Desktop\Musicnotessuite.exe
[2010/04/09 00:40:54 | 001,683,240 | —- | M] (Skype Technologies S.A.) – C:\Documents and Settings\User\Desktop\SkypeSetup.exe
[2010/05/09 22:37:57 | 001,146,184 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\wlsetup-web(2).exe
[2010/04/16 20:06:42 | 001,146,184 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\wlsetup-web.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2009/06/26 17:21:02 | 000,013,023 | —- | M] () – C:\WINDOWS\VX1000.src
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2010/08/30 19:45:11 | 000,232,159 | —- | M] () – C:\Documents and Settings\User\My Documents\Minecraft.exe
[2010/08/31 04:47:21 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\My Documents\OTL.exe
[2010/08/31 16:56:24 | 001,210,704 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\User\My Documents\TDSSKiller.exe
[2009/12/15 17:51:45 | 000,289,584 | —- | M] (BitTorrent, Inc.) – C:\Documents and Settings\User\My Documents\utorrent.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/12/18 16:09:48 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\User\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/08/26 05:48:54 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\User\Cookies\desktop.ini
[2010/09/05 19:10:53 | 000,212,992 | -HS- | M] () – C:\Documents and Settings\User\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2008/02/25 23:14:41 | 000,317,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %USERPROFILE%\Templates\*.* >
[2004/08/04 14:00:00 | 000,004,570 | —- | M] () – C:\Documents and Settings\User\Templates\amipro.sam
[2004/08/04 14:00:00 | 000,005,632 | —- | M] () – C:\Documents and Settings\User\Templates\excel.xls
[2004/08/04 14:00:00 | 000,001,518 | —- | M] () – C:\Documents and Settings\User\Templates\excel4.xls
[2004/08/04 14:00:00 | 000,002,448 | —- | M] () – C:\Documents and Settings\User\Templates\lotus.wk4
[2004/08/04 14:00:00 | 000,012,288 | —- | M] () – C:\Documents and Settings\User\Templates\powerpnt.ppt
[2004/08/04 14:00:00 | 000,000,461 | —- | M] () – C:\Documents and Settings\User\Templates\presenta.shw
[2004/08/04 14:00:00 | 000,004,017 | —- | M] () – C:\Documents and Settings\User\Templates\quattro.wb2
[2004/08/04 14:00:00 | 000,000,058 | —- | M] () – C:\Documents and Settings\User\Templates\sndrec.wav
[2004/08/04 14:00:00 | 000,004,608 | —- | M] () – C:\Documents and Settings\User\Templates\winword.doc
[2004/08/04 14:00:00 | 000,001,769 | —- | M] () – C:\Documents and Settings\User\Templates\winword2.doc
[2004/08/04 14:00:00 | 000,000,030 | R— | M] () – C:\Documents and Settings\User\Templates\wordpfct.wpd
[2004/08/04 14:00:00 | 000,000,057 | R— | M] () – C:\Documents and Settings\User\Templates\wordpfct.wpg

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-02 08:43:28

========== Alternate Data Streams ==========

@Alternate Data Stream - 48 bytes -> C:\Documents and Settings\All Users\DRM:مايكروسوفت
< End of report >


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-05 19:41:54
Windows 5.1.2600 Service Pack 2
Running: ztmgx2dp.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\ugtdypow.sys


—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\Explorer.EXE[212] kernel32.dll!CreateProcessInternalW 7C819760 5 Bytes JMP 0038874A
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2368] USER32.dll!TrackPopupMenu 7E46526E 5 Bytes JMP 1044721D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3412] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3412] WS2_32.dll!send 71AB428A 5 Bytes JMP 0015634D
.text C:\Program Files\Mozilla Firefox\firefox.exe[3412] WS2_32.dll!WSARecv 71AB4318 5 Bytes JMP 00156511
.text C:\Program Files\Mozilla Firefox\firefox.exe[3412] WS2_32.dll!recv 71AB615A 5 Bytes JMP 001563C0
.text C:\Program Files\Mozilla Firefox\firefox.exe[3412] WS2_32.dll!WSASend 71AB6233 5 Bytes JMP 00156477
.text C:\Program Files\Mozilla Firefox\firefox.exe[3412] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 0015660B

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-
Post #9
Hi Terry Tibs,

Please download Combofix from one of the following locations:

LINK 1
LINK 2

**IMPORTANT! Save Combofix to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #12
I cannot do that method as this is a family computer and the internet connection going off would cause me hassle, if there possibly another way?
Post #13
Hi Terry Tibbs, ComboFix will disconnect your internet connection when it scans, and the connection will be restored once ComboFix is finished running. So everything should go back to normal after the scan has been completed. Please scan with Combofix unless you still feel cautious about it.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI