This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

svchost.exe malware infection

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

There doesn't seem to be any options apart from 'scan' and 'report', i ran it a few times though and it seemed to find those 6 'threats' alternately i.e. 6 threats,0 threats,6 threats,0 threats…i presumed it unquarantined the files after each '0' scan :huh: There's a quarantine folder with folders within folders.. [attachment removed: tddf.gif] [attachment removed: quar.gif] [attachment removed: susp.gif] [attachment removed: obj.gif] [attachment removed: tda.gif] i tried to open a .dta file in notepad to post ,there's one for each 'threat' file, this is what i got.. MZ   ÿÿ ¸ @ à º ´ Í!¸LÍ!This program cannot be run in DOS mode. $ ««RnÅøRnÅøRnÅøRnÄøTnÅøRnÅøQnÅø MÖøHnÅø­NÁøQnÅøfÃøSnÅøMõøTnÅøRichRnÅø PE L a6> à   €K `% ^  K     t  öî       àh 5 €i P m P `q H  K T K x .text èG  H  h.rdata L K ` K @ H.data D €P ` €P @ È.edata 5 àh @ àh @ @PAGECONS` i ` i @ ÀINIT b €i € €i â.rsrc P m ` m @ B.reloc ‚ `q   `q @ B ‹D$‹T$SVWjYxr3Ûó§u)jx Yr 3Ûó§ujx0Yr03Ûó§u ‹ ;u3À@ë3À_^[ ÌU‹ìƒì‹Eƒeü SV‹HW‰Mð‹‹Y€Áà‹ˆÌd ‹€Ðd …ɉMô‰Eø†E ‹0VSèpÿÿÿ„ÀtT‹C@;F@uL‹CD;FDuD‹CH;FHu<‹CL;FLu4¿€ FPWPCPPÿ K ;Çu‹ƒ ;† u‹ƒ ;† tÿEü‹Eø‹MüƒÀ;Mô‰Eør‹éË ‹ŽÄ ‹“ü ‹†À ;Ñ|$ ‹“ø ;Ðv‰ƒø ‰‹ü ‹†È ‰ƒð ‹Eð‹“  ƒÂp‹H …Éu‹M¸ €‰A‰Q8ëp;Ês ‹M¸# À‰Aë_‹@jY‹ó‹øó¥‹M‰³Ð x@‰Q8‹‹  ƒÁ0‹ÑÁéó¥‹Êƒáó¤·H~¯Ht‹PxƒÁÁéáüÿÿ¯Ê…Ò}÷Ù‰H‰ˆ„ 3À_^[É ÌU‹ìQ‹E S‹]VƒøW …ÀŒ‡ ƒe €Áà‹ˆÌd ‹€Ðd …ɉMü‰E ~g‹jY{r3Àó§uBj{ Yr 3Àó§u3j{0Yr03Àó§u$‹Ct;‚ u‹Cx;‚ u‹ƒ„ ;‚ tÿE‹E ‹MƒÀ;Mü‰E |™3À_^[É 3À@ëôÌ ̋L$ SV‹t$ ÆW‹Fƒf ƒè tKƒètHt€! ënÇF ÀëN‹F ‹^ÿpSè ÿÿÿ…Àt4‹|$fƒV t0VWÿWl…Àt'‹Ct‰G$‹Cx‰G(ë‹F ÿpÿvèÕþÿÿ…ÀuÇFr À‹D$€8uVÿv jè¤D ƒÄ _^[ ̋D$Vj j ‹pj Pè˜D ‹N‰Hx‹N@…ɉH|u‹N ‰H|j h  h`e PèjD °^ SU3íVUUUÿt$èYD hWdm j$U‹ðÿ(K ‹Ø;Ýu¸š Àë2Wj Y3À‹ûSó«ÿvxè¡B 9kt j ~TY‹óó¥ëf‰nVSÿ$K 3À_^][ U‹ìƒì S‹]V‹s‰uôF(‰Eü‹C-  „è H„ ƒètlHtOHt/ƒètHtjj h”e Sè¶C é SèAÿÿÿëSèüÿÿ‰Cë Sèìþÿÿ„ÀuÏSÿsjè}C ƒÄ é⠍Ej Ph”e SèpC SPÿujëEj Ph”e SèVC SPÿuj è¶ ë´‹C Ç@ ª ‹C Ç@® ‹C ÿpVè(ýÿÿ…Àt!jj h”e SèC Æ@S‹Nt‰H$‹Nx‰H(ëdÇC ÀécÿÿÿW3ÿWWWSèëB ‹HL3Ò‰9xLv%ÇEøÀd ‹}ü‹uøƒEüPƒEøPjBYó¥;PLrç‹uô3ÿFPè!6 jWh”e S‰F è B _^[É Ìhò jh€ ÿt$ÿt$è…B  SV‹t$W3ÿ3Û‹F;Çt Pÿ$K ‰~9=h t:Wjhh ÿ4K WWWWWjhÌQ jÿ0K h°h ‹Øÿ,K èª1 ‰=h _‹Ã^[ U‹ìQV‹u …öWt"ŠF ¢Àh ŠF ¢Áh ŠF¢Âh ŠF ¢Ãh ë€%Ãh ÆÀh ÆÁh ÆÂh è2 €=Âh ‹} ÀƒÀ£Ìd E PEüPÿuÿuWÿuèS 3Ò‰E 9UtCf~ jXu ÇGL ë‰GL9Uv$9GLu f‹ U R ëf‹ UR ‹uf‰ VB;UrÜ‹E _^É U‹ìQSV‹uW‹} 3Û;ó‰]üÇINTEÇG u‹G;Ãt Pÿ$K ‰_3Àë[·hWdm PSÿ(K ‰G‹E‰‹EÇ  9_t+·¸ € ˆ^‰F0‰F‹ÁÇFD  ‹Áéó¥‹Èƒáó¤ëÇEüš À‹Eü_^[É 3À9D$ u ÿt$ÿt$è•  U‹ì3À9Euÿuÿuÿu ÿuè ë ‹MÇ , ] U‹ì‹U‹MS3Û‰‹AtV‹u =° ufÇF ë=  ufÇF ëfÇF ‹Ax‰] ¯At‹NŠR VƒÀ@ÿuˆYÇF, ‰èº6 ‹] ˆ^Pˆ^Q^[] Ì3À9D$ u ÿt$ÿt$è  ‹D$‹@Æ@3À 3À9D$ u ÿt$ÿt$è  é‹7 Ì Ì ÌU‹ìQQ‹M(3À‰Eø‰EüˆEüPEøPÿu$ÿu ÿuÿuÿuÿuÿu ÿuè ÉÂ$ ÌU‹ìQ‹E,SV‹u W‹}(‹U3Û‰‰‹F9Z‰]ü·H‹EŠ }2À„Ày‹E$Æ ë<¨tf9^VtKjVÿVpSVÿVpë>¨u:ŠVPÀè$2Ðt:Ãu8^Qt Ç ˆ^QˆFP‹E‹@;Ãt ;Áu‰Mü냉]ü‹E9X|‹E9X}ƒ‹Eü_^[ÉÂ( ÌU‹ìÿu(ÿu$ÿu ÿuÿuÿuÿuÿu ÿuè ]Â, ÌU‹ìƒì €Mþÿ€eÿ ƒMøÿ3Ò9USVWÇEô@ÿ„Ó ‹M ¸ , j@;ȉh ^‡£ „ éÀ% t{é@% tg+ÎtWé K …” Çh  ÇE @ »ð ‹Æ3ÿ3Éf;Æ…Ð ŠD=þ‹}:9…£ Aj‹Á_™÷ÿ‹ú3Ò;Î|ßéª jxÇE   [ë¿jxÇE   [ëSjxÇE   [ëZÇE @ »ð ë9é@, t…+Èt4éÀW t+Î…û ÇE € »à élÿÿÿÇE € »à 3Àé[ÿÿÿÇE € »à Çh  é>ÿÿÿ¯] ‹M([‰EôPRRÿÆ…ƒþÿÿ?Æ…„þÿÿ@Æ……þÿÿAÆ…†þÿÿBÆ…‡þÿÿCÆ…ˆþÿÿDÆ…‰þÿÿEÆ…ŠþÿÿFÆ…‹þÿÿGÆ…ŒþÿÿHÆ…þÿÿIÆ…ŽþÿÿJÆ… þÿÿKÆ…þÿÿLÆ…‘þÿÿMÆ…’þÿÿNÆ…“þÿÿOÆ…”þÿÿPÆ…•þÿÿQÆ…–þÿÿRÆ…—þÿÿSÆ…˜þÿÿTÆ…™þÿÿUÆ…šþÿÿV Æ…›þÿÿWÆ…œþÿÿXÆ…þÿÿYÆ…žþÿÿZÆ…Ÿþÿÿ[Æ… þÿÿ\Æ…¡þÿÿ]Æ…¢þÿÿ^Æ…£þÿÿ_Æ…¤þÿÿ`Æ…¥þÿÿaÆ…¦þÿÿbÆ…§þÿÿcÆ…¨þÿÿdÆ…©þÿÿeÆ…ªþÿÿfÆ…«þÿÿgÆ…¬þÿÿhÆ…­þÿÿiÆ…®þÿÿjÆ…¯þÿÿ kÆ…°þÿÿlÆ…±þÿÿmÆ…²þÿÿnÆ…³þÿÿoÆ…´þÿÿpÆ…µþÿÿqÆ…¶þÿÿrÆ…·þÿÿsÆ…¸þÿÿtÆ…¹þÿÿuÆ…ºþÿÿvÆ…» þÿÿwÆ…¼þÿÿxÆ…½þÿÿyÆ…¾þÿÿzÆ…¿þÿÿ{Æ…Àþÿÿ|Æ…Áþÿÿ}Æ…Âþÿÿ~Æ…ÃþÿÿÆ…Äþÿÿ€Æ…ÅþÿÿÆ…Æþÿÿ‚ Æ…ÇþÿÿƒÆ…Èþÿÿ„Æ…Éþÿÿ…Æ…Êþÿÿ†Æ…Ëþÿÿ‡Æ…ÌþÿÿˆÆ…Íþÿÿ‰Æ…ÎþÿÿŠÆ…Ïþÿÿ‹Æ…ÐþÿÿŒÆ…ÑþÿÿÆ…Òþ ÿÿŽÆ…ÓþÿÿÆ…ÔþÿÿÆ…Õþÿÿ‘Æ…Öþÿÿ’Æ…×þÿÿ“Æ…Øþÿÿ”Æ…Ùþÿÿ•Æ…Úþÿÿ–Æ…Ûþÿÿ—Æ…Üþÿÿ˜Æ…Ýþÿÿ™Æ …ÞþÿÿšÆ…ßþÿÿ›Æ…àþÿÿœÆ…áþÿÿÆ…âþÿÿžÆ…ãþÿÿŸÆ…äþÿÿ Æ…åþÿÿ¡Æ…æþÿÿ¢Æ…çþÿÿ£Æ…èþÿÿ¤Æ…éþÿ ÿ¥Æ…êþÿÿ¦Æ…ëþÿÿ§Æ…ìþÿÿ¨Æ…íþÿÿ©Æ…îþÿÿªÆ…ïþÿÿ«Æ…ðþÿÿ¬Æ…ñþÿÿ­Æ…òþÿÿ®Æ…óþÿÿ¯Æ…ôþÿÿ°Æ… õþÿÿ±Æ…öþÿÿ²Æ…÷þÿÿ³Æ…øþÿÿ´Æ…ùþÿÿµÆ…úþÿÿ¶Æ…ûþÿÿ·Æ…üþÿÿ¸Æ…ýþÿÿ¹Æ…þþÿÿºÆ…ÿþÿÿ»Æ… ÿÿÿ¼Æ…ÿÿÿ½Æ…ÿÿÿ¾Æ…ÿÿÿ¿Æ…ÿÿÿÀÆ…ÿÿÿÁÆ…ÿÿÿÂÆ…ÿÿÿÃÆ…ÿÿÿÄÆ… ÿÿÿÅÆ… ÿÿÿÆÆ… ÿÿÿÇÆ… ÿÿÿÈÆ… ÿÿÿÉÆ…ÿÿÿÊÆ…ÿÿÿËÆ…ÿÿÿÌÆ…ÿÿÿÍÆ…ÿÿÿÎÆ…ÿÿÿÏÆ…ÿÿÿÏÆ…ÿÿÿÐÆ…ÿÿÿÑÆ…ÿÿÿÒÆ…ÿÿÿ ÓÆ…ÿÿÿÔÆ…ÿÿÿÕÆ…ÿÿÿÖÆ…ÿÿÿÖÆ…ÿÿÿׯ…ÿÿÿØÆ…ÿÿÿØÆ… ÿÿÿÙÆ…!ÿÿÿÚÆ…"ÿÿÿÚÆ…#ÿÿÿÛÆ…$ÿÿÿÜÆ…%ÿÿÿÝÆ…&ÿÿÿÝÆ…'ÿÿÿÞÆ…(ÿÿÿ߯…)ÿÿÿàÆ…*ÿÿÿàÆ…+ÿÿÿáÆ…,ÿÿÿâÆ…-ÿÿÿâÆ….ÿÿÿãÆ…/ÿÿÿãÆ…0ÿÿÿ䯅1ÿÿÿ寅2ÿÿÿ寅3ÿÿÿ急Dýÿÿ Æ…4ÿÿÿæÆ…5ÿÿÿçÆ…6ÿÿÿèÆ…7ÿÿÿèÆ…8ÿÿÿ鯅9ÿÿÿ鯅:ÿÿÿêÆ…;ÿÿÿêÆ…<ÿÿÿëÆ…=ÿÿÿìÆ…>ÿÿÿìÆ…?ÿÿÿíÆ…@ÿÿÿîÆ…AÿÿÿïÆ…BÿÿÿïÆ…CÿÿÿðÆ…EýÿÿÆ…FýÿÿÆ…GýÿÿÆ…HýÿÿÆ…IýÿÿÆ…JýÿÿÆ…Kýÿÿ Æ…LýÿÿÆ…Mýÿÿ Æ…Nýÿÿ Æ…Oýÿÿ Æ…Pýÿÿ Æ…Qýÿÿ Æ…RýÿÿÆ…SýÿÿÆ…TýÿÿÆ…UýÿÿÆ…VýÿÿÆ…WýÿÿÆ…XýÿÿÆ…YýÿÿÆ…ZýÿÿÆ…[ýÿÿÆ…\ýÿÿÆ…]ýÿÿÆ…^ýÿÿÆ…_ýÿÿÆ…`ýÿÿÆ…aýÿÿÆ…býÿÿÆ…cýÿÿÆ…dýÿÿ Æ…eýÿÿ!Æ…fýÿÿ"Æ…gýÿÿ#Æ…hýÿÿ$Æ…iýÿÿ%Æ…jýÿÿ&Æ…kýÿÿ'Æ…lýÿÿ(Æ…mýÿÿ)Æ…nýÿÿ*Æ…oýÿÿ+Æ…pýÿÿ,Æ…qýÿÿ-Æ…rýÿÿ.Æ…sýÿÿ/Æ…týÿÿ0Æ…uýÿÿ1Æ…výÿÿ2Æ…wýÿÿ4Æ…xýÿÿ5Æ…yýÿÿ6Æ…zýÿÿ7Æ…{ýÿÿ8Æ…|ýÿÿ9Æ…}ýÿÿ:Æ…~ýÿÿ;Æ… ýÿÿ<Æ…€ýÿÿ=Æ…ýÿÿ>Æ…‚ýÿÿ?Æ…ƒýÿÿ@Æ…„ýÿÿAÆ……ýÿÿBÆ…†ýÿÿCÆ…‡ýÿÿDÆ…ˆýÿÿEÆ…‰ýÿÿFÆ…ŠýÿÿGÆ…‹ýÿÿHÆ…ŒýÿÿIÆ…ýÿÿJÆ…Ž ýÿÿKÆ…ýÿÿLÆ…ýÿÿMÆ…‘ýÿÿNÆ…’ýÿÿOÆ…“ýÿÿPÆ…”ýÿÿQÆ…•ýÿÿRÆ…–ýÿÿSÆ…—ýÿÿTÆ…˜ýÿÿUÆ…™ýÿÿV Æ…šýÿÿWÆ…›ýÿÿXÆ…œýÿÿYÆ…ýÿÿZÆ…žýÿÿ[Æ…Ÿýÿÿ\Æ… ýÿÿ]Æ…¡ýÿÿ^Æ…¢ýÿÿ_Æ…£ýÿÿ`Æ…¤ýÿÿaÆ…¥ýÿÿbÆ…¦ýÿÿcÆ…§ýÿÿdÆ…¨ýÿÿeÆ…©ýÿÿgÆ…ªýÿÿhÆ…«ýÿÿiÆ…¬ýÿÿjÆ…­ýÿÿkÆ…®ýÿÿ lÆ…¯ýÿÿmÆ…°ýÿÿnÆ…±ýÿÿoÆ…²ýÿÿpÆ…³ýÿÿqÆ…´ýÿÿrÆ…µýÿÿsÆ…¶ýÿÿtÆ…·ýÿÿuÆ…¸ýÿÿvÆ…¹ýÿÿwÆ…º ýÿÿxÆ…»ýÿÿyÆ…¼ýÿÿzÆ…½ýÿÿ{Æ…¾ýÿÿ|Æ…¿ýÿÿ}Æ…Àýÿÿ~Æ…ÁýÿÿÆ…Âýÿÿ€Æ…ÃýÿÿÆ…Äýÿÿ‚Æ…Åýÿÿƒ Æ…Æýÿÿ„Æ…Çýÿÿ…Æ…Èýÿÿ†Æ…Éýÿÿ‡Æ…ÊýÿÿˆÆ…Ëýÿÿ‰Æ…ÌýÿÿŠÆ…Íýÿÿ‹Æ…ÎýÿÿŒÆ…ÏýÿÿÆ…ÐýÿÿŽÆ…Ñý ÿÿÆ…ÒýÿÿÆ…Óýÿÿ‘Æ…Ôýÿÿ’Æ…Õýÿÿ“Æ…Öýÿÿ”Æ…×ýÿÿ•Æ…Øýÿÿ–Æ…Ùýÿÿ—Æ…Úýÿÿ˜Æ…ÛýÿÿšÆ…Üýÿÿ›Æ …ÝýÿÿœÆ…ÞýÿÿÆ…ßýÿÿžÆ…àýÿÿŸÆ…áýÿÿ Æ…âýÿÿ¡Æ…ãýÿÿ¢Æ…äýÿÿ£Æ…åýÿÿ¤Æ…æýÿÿ¥Æ…çýÿÿ¦Æ…èýÿ ÿ§Æ…éýÿÿ¨Æ…êýÿÿ©Æ…ëýÿÿªÆ…ìýÿÿ«Æ…íýÿÿ¬Æ…îýÿÿ­Æ…ïýÿÿ®Æ…ðýÿÿ¯Æ…ñýÿÿ°Æ…òýÿÿ±Æ…óýÿÿ²Æ… ôýÿÿ³Æ…õýÿÿ´Æ…öýÿÿµÆ…÷ýÿÿ¶Æ…øýÿÿ·Æ…ùýÿÿ¸Æ…úýÿÿ¹Æ…ûýÿÿºÆ…üýÿÿ»Æ…ýýÿÿ¼Æ…þýÿÿ½Æ…ÿýÿÿ ¾Æ… þÿÿ¿Æ…þÿÿÀÆ…þÿÿÁÆ…þÿÿÂÆ…þÿÿÃÆ…þÿÿÄÆ…þÿÿÅÆ…þÿÿÆÆ…þÿÿÇÆ… þÿÿÈÆ… þÿÿÉÆ… þÿÿÊÆ… þÿÿËÆ… þÿÿÍÆ…þÿÿÎÆ…þÿÿÏÆ…þÿÿÐÆ…þÿÿÑÆ…þÿÿÒÆ…þÿÿÓÆ…þÿÿÔÆ…þÿÿÕÆ…þÿÿÖÆ…þÿÿׯ…þÿÿ ØÆ…þÿÿÙÆ…þÿÿÚÆ…þÿÿÛÆ…þÿÿÜÆ…þÿÿÝÆ…þÿÿÞÆ…þÿÿ߯… þÿÿàÆ…!þÿÿáÆ…"þÿÿâÆ…#þÿÿãÆ…$þÿÿ䯅%þÿÿ寅&þÿÿæ¡ h ‹¤h ‹5(K €?þÿÿÿ€@þÿÿÿ€Aþÿÿÿ€Bþÿÿÿ€Cþÿÿÿ‰E܋ÿWdm Æ…'þÿÿçÁàWPj Æ…(þÿÿèÆ…)þÿÿ鯅*þÿÿêÆ…+þÿÿëÆ…,þÿÿìÆ…-þÿÿíÆ….þÿÿîÆ…/þÿÿïÆ…0þÿÿðÆ…1þÿÿñÆ…2þÿÿòÆ…3þÿÿóÆ…4þÿÿôÆ…5þÿÿõÆ…6þÿÿöÆ…7þÿÿ÷Æ…8þÿÿøÆ…9þÿÿùÆ…:þÿÿ úÆ…;þÿÿûÆ…<þÿÿüÆ…=þÿÿýÆ…>þÿÿþÆE°ÆE±ÆE²ÆE³ÆE´ÆEµÆE¶ÆE·ÆE¸ÆE¹ÆEºÆE»ÆE¼ÆE½ÆE¾ÆE¿ÆEÀÆEÁÆ EÂÆEÃÆEÄÆEÅÆEÆÆElj]àÿÖ‰EÌ‹ÃÁàWPj ÿÖ‰EÔ‹ÃÁàWPj ÿÖ‰E¤W‹ÃÁàPj ÿÖ¯]ÜWSj ‰E¨ÿÖ‹M¤W‰‹ÃÁàPj ÿÖ‹M¨ƒ}à ‹]܉vf‹EÔ‹u¤‹UÌ+ð‰uè‹u¨3É+Ð+ð‰Mü‰uä‹uà‰uø‹5h ‹}üñ‰4‹5h þ‹u¤‰8‹}è‹6ñ‰4‹u¨‹}ä‹64Žˉ484[uüƒÀÿMøu½€=Áh …µ  Âh <u9‹uà…ö†¡ ‹EÌNÑîHF3ÿ…Ûv‹ÇGG¶;ûŠ”DýÿÿˆrêƒÁNuÞë6<u;‹uà…övh‹MÌNÑîF3ÿ…Ûv‹D8GG¶;ûŠ”DýÿÿˆrèƒÁNuÜ€=Áh u4€=Âh u+‹Mà…Év$‹}Ì3ö…Ûv‹ÆF;ó¶Š”DþÿÿˆrëƒÇIuß3À9Eà‰Eø‰Eü‰Eä‰Eô†G 3À…Ûv7‹Mô‹uÌ‹ÑÁâ‹ 2‹T2¶4uä¶t¶<÷Ñþuü¶tuø@@;ÃrÛƒEô‹Eô;Eàr·ƒ}ä „ô ‹uü…ö„é ƒ}ø „ß ¡Ph j2ƒÀÎYÁà™÷ù3ÒÁæ‹È¸ @  h ÷ñ3Ò‹ø‹Æ÷uø3Ò‰Eø‹Æ÷uä9}ø}‰}øë9Mø~‰Mø;Ç}‹Çë;Á~‹Á3Ò3ö3ÿ‹ÏÁéùÿ ~¹ÿ ˆŒDýÿÿ‹ÎÁéùÿ ~¹ÿ }øˆŒDþÿÿBðú  rÀ‹Eà‹}̍HÿÑéA3ö…Ûv)‹Æ¶Š”Dþÿÿˆ‹GDFF¶;óŠ”Dýÿÿˆr׃ÇIuË¡‹}ð;Æv‹…`ÿÿÿ‹µ\ÿÿÿë ‹…Xÿÿÿ‹µdÿÿÿƒEðÆ‹uøÑø‹6AA;MôˆD7†ßþÿÿ‹]܃EøƒÂÿMü…ºþÿÿÿEìƒ}ì‚cþÿÿÇEì ‹Eì‹È‹EàÁá¶t ³¶T ±+Æ;Ї¨ ¶t °¶L ²‰]ô‰uä)Mô‹MÔ+4‘‹MÌÑèL‘@‰u܉Mü‰Eø‹MäI‰Eðë[‹}ü‹Gü¶Bÿ¶R‹Wø‹?¶¶<9׋}ðÑøÑúƒ}ì‰UØu‹ˆD:‹ŠU؈ë‹6ˆT>‹uÜ‹}ð‹ˆAAƒÇ‰}ð;Môv ƒEüƒÆÿMø‰uÜu†ÿEìƒ}ì‚,ÿÿÿ‹}àÇEì ‹Eì‹È‹ÇÁá¶t ³¶T ±+Æ;Ї ¶t °¶L ²‰]ô+Â)Mô‹MÔÑè ‘@‰MÜ‹M̉uä‰Eüt‘‹Uä;UôR‰EðwH‹Fø‹<¶Hÿ¶@ȶGÿȶG‹}ðÈ‹EÜÁùƒ}ì‹ uˆ ëˆL8ƒEðBB;Uôv»‹}àƒE܃ÆÿMüužÿEìƒ}ì‚HÿÿÿGüj‰E¸X‰E¼‰EÀOÿCü3ÿ‰Eĉ}ø3À@;È ‰Eô† ‹uÔ‹M̉uìSÿ)MìF‰EäA3ÉjA^;ц= ‹|=¼‰UØ‹Pø‹8¶¶<9‰Uè+׉•xÿÿÿ‹Püщ}ü¶zÿ¶R‰UÜ‹×+U܉}ð‹}艕|ÿÿÿ‹Uüú‹UÜÑÿ‰½Hÿÿÿ‹}ðú‹•xÿÿÿÑÿ …Ò‰½Lÿÿÿ}÷Úƒ½|ÿÿÿ }÷|ÿÿÿ;•|ÿÿÿ‹Uä‹~‰E芅LÿÿÿˆD‹Eèë‰E芅HÿÿÿˆD‹Eè‹PøщUü‹<¶Wÿ¶׋}ü¶ÿ׋}ü¶׋}äÁú‹?ˆ>‹P¶|‹Pü‰}è¶T‰UÜ+׉•xÿÿÿ‹Ñ¶z¶‰Uü+׉}ð‹}艕|ÿÿÿ‹UÜú‹UüÑÿ‰½Hÿÿÿ‹}ð ú‹•xÿÿÿÑÿ…Ò‰½Lÿÿÿ}÷Úƒ½|ÿÿÿ }÷|ÿÿÿ;•|ÿÿÿ‹Uì‹~‰E芅LÿÿÿˆD2‹Eèë‰E芅HÿÿÿˆD2‹Eè‹P<‹Püщ}趉Uü¶R׋}è¶?׋}ü¶?׋}ìÁú‹<ˆT7‹Pø‹8¶T¶|9׋}äÑú‹?ˆT>‹Pü<¶W¶?׋}äÑú‹?ˆT>‹<¶Wÿ¶׋}ìÑú‹<ˆ>‹P‹xü¶¶<9׋}ìÑú‹<ˆT7‹}øu؍SÿL=¼;Ê‚Íýÿÿ‹L=¸MôÁáMäÁ‹MàI9Mô‚™ýÿÿƒÇƒÿ‰}ø‚dýÿÿ‹Eԍ[‹Ê ƒeô ‹p‹8‹ÁÁéó¥‹È‹Eàƒáó¤‹}Ô‹Ê‹t‡øÁà‹|8ü‹ÁÁéó¥‹Èƒáƒ}à ó¤†| ‹EÔ‹Mô|[úÿEôˆ‹0ŠNˆ‹0ŠNˆN‹0ŠNˆN‹0Š 7ˆL2ý‹4 ŠNûˆNþ‹ 4ŠFüˆFÿ‹Eô;Eàr²é) …Àtƒøtƒø tƒøtƒø t ƒø… ‹Mà…Évy‹uÌ‹UÔ‰uä‰uø)UäIÑéAB‰Mü3ö|[ý…ÛvI‹Mø‹Pü‹ Š ˆ ‹Mø‹Püƒï‹ ŠLˆL‹Mä‹‹ Š FˆL‹Mä‹F‹ ;óŠLÿˆLrº‹MüƒEøƒÀI‰Müu ƒeì ‹Eì‹È‹EàÁá¶T ³¶t ±+Â;ð‡ ¶T °¶L ²‰]ô+Æ)Mô‹MÔ‰Uä[ ±‰Uè‰Mø‹MÌÑè@T±‰Eü‹MäDI‹ð‹Eè+Æ;Mô‰Eð‡$ ‹Bð¶<‹BøÁ¶X‰Pÿÿÿ‹¶pþ¶‰Tÿÿÿ‹Zô‰µHÿÿÿ¶ ¶0‰Xÿÿÿ+þ¶Xÿ¶@‰…`ÿÿÿ‹Bü‰\ÿÿÿ‰}„¶‰…dÿÿÿ‹Ã+…`ÿÿÿ‰…tÿÿÿ‹…Hÿÿÿ+Ɖ…xÿÿÿ‹Æ+…Pÿÿÿ+µTÿÿÿ‰…|ÿÿÿ‹…Xÿÿÿ+…dÿÿÿ‰uˆ3Û‰E€¼tÿÿÿ‹7…ö} ÷Þ‰7‹E€Cƒû|æ‹uˆ‹}„÷‹½xÿÿÿD‹µ|ÿÿÿ÷‹½tÿÿÿt>‹}ð;Æv‹…`ÿÿÿ‹µ\ÿÿÿë ‹…Xÿÿÿ‹µdÿÿÿƒmðÆ‹uøÑø‹6AA;MôˆD7†ßþÿÿ‹]܃EøƒÂÿMü…²þÿÿÿEìƒ}ì‚UþÿÿÇEì ‹Eì‹È‹EàÁá¶T ³¶t ±+Â;ð‡T ¶T °¶L ²‰]ô+Æ)Mô‹MÔÑè ±@‰Mø‹M̉Uä‰EèT± ‹EäL@‹ñ [+ΉMðéú ‹Jôȶqÿ¶yý‰uü+÷¶y‰µtÿÿÿ¶q‹Î‰u¬‹rð+Ï‹z艍xÿÿÿ¶40¶<8‰uÈ+÷‹:‰µ|ÿÿÿ‹rø¶<8¶40‰uÐ+÷ƒeØ ‰u€‹}Ø‹¼½tÿÿÿ…ÿ}‹MØ÷߉¼tÿÿÿ‹u€‹xÿÿÿÿE؃}Ø|Ô9tÿÿÿ‹Mü|‹M¬9µ|ÿÿÿ‰Mü‹MÈ|‹MЃ} ì‰MØu"‹Mø‹uð‰EЊEü‹ ˆD‹MøŠEØ‹ ˆ‹EÐë‹uø‹}ð‰EЊEü‹6ˆL7‹Mø‹÷‹ ˆ‹EÐ@@ƒmð;Eô†ýþÿÿƒEøƒÂÿMè…×þÿÿÿEìjX9Eì‚~þÿÿ‰Eì‹Eì‹È‹EàÁá¶t ³¶T ±+Æ;Їÿ ¶t °¶L ²‰]ô+Â)Mô‹MÔÑè ‘@‰Mü‹M̉uä‰EèL‘ü‰Mø‹uäDv‹È[+Á‰Eðé¡ ‹Eø‹  0‹Eø‹@¶yÿ¶I‰}ЉM¬¶B¶Rÿ‰EÈ+ø‹Â‰½tÿÿÿ+ÁƒeØ ‰…xÿÿÿ‹MØ‹Œtÿÿÿ…É}‹EØ÷Ù‰Œ…tÿÿÿ‹…xÿÿÿ‹½tÿÿÿÿE؃}Ø|Ñ;ø} ‹EЋMÈÁë‹E¬‹Mü‹UðÑøƒ}ì‹ uˆ ëˆDFFƒmð;uô†VÿÿÿƒEøƒEüÿMè…/ÿÿÿÿEìƒ}ì‚Õþÿÿ‹MàjAüIƒeø ‰E¸X‰E¼‰EÀCü‰EÄ3À@;ȉEô†U ‹uÔ‹M̍D[ú‰uì)Mì~‰EЍSÿ‰}ðA‹uÐ3ÉA;ц ‹Uø‹T¼R‰UØ‹Pø‹¶ ¶ ‰UÈ+Ó‰•xÿÿÿ‹Püщ]ä¶Zÿ¶R‰Uü‹Ó+Uü‰]¬‹]ȉ•|ÿÿÿ‹UäÓ‹]¬Ñú‰•Hÿÿÿ‹UüÓÑú‰•Lÿÿÿ ‹•xÿÿÿ…Ò}÷Úƒ½|ÿÿÿ }÷|ÿÿÿ;•|ÿÿÿ‹ŠLÿÿÿŠHÿÿÿˆ\‹PøщUè‹Ñ¶Zÿ¶RÚ‹Uè¶RÿÚ‹Uè¶RÚ‹Áûˆ‹P¶\‹Pü¶|‹‰}ü+û‰½xÿÿÿ< ¶W¶?‰}ä‰UÈ+ú‹Uü‰½|ÿÿÿ‹}äÓ‹]ÈûÑÿ‰½Lÿÿÿ‹½xÿÿÿÑú…ÿ}÷߃½|ÿÿÿ }÷|ÿÿÿ;½|ÿÿÿ~‹U슝Lÿÿÿ‹ˆ\2þë ‹}ì‹<8ˆT7þ‹P<‹PüѶ_‰UȶR¶?Ó‹]ȶÓ׋}ìÁú‹<8ˆT7ÿ‹Pø‹8¶T ¶|׋}ðÑú‹ˆTý‹PüѶZ¶Ú‹Ñûˆ\ÿ‹Ñ¶Zÿ¶RÚ‹UìÑû‹ˆ‹P‹Xü¶¶Ó‹]ìÑú‹ˆT3‹Uø‹]Ü+uØL¼Sÿ;Ê‚ þÿÿ‹Mø‹L ¸MôÁáùÁ‹Mà‰}ðI9Mô‚ÊýÿÿƒEøƒ}ø‚ýÿÿ‹Eԍ[‹Êƒeô ‹p‹8‹ÁÁéó¥‹È‹Eàƒáó¤‹}Ô‹Ê‹t‡øÁà‹|8ü‹ÁÁéó¥‹Èƒáƒ}à ó¤vN‹EÔ‹Mô|[úÿEôˆ‹0ŠNˆ‹0ŠNˆN‹0ŠNˆN‹0Š 7ˆL2ý‹4 ŠNûˆNþ‹ 4ŠFüˆFÿ‹Eô;Eàr²‹Uà…ÒvR‹M¨‹uÔ+ñ[‰uЉUè3Ò;Âv0‰Uü‹EЋƒÂ¶p¶x¶ ÷‹}üƒEüð‹‰4[;ÐrÓƒÁÿMèu‹UàJþƒù†a ‹U¨jüCþÇEü r Z+U¨ƒÁþ‰M܉UÐjÇEð Y;Á‰Mä† ‹Eä‹VüÁà‹ ‰Mè‹Nø‹|ü‰½Dÿÿÿ‹<‹L‰½Hÿÿÿ‰Lÿÿÿ‹Lü‰Pÿÿÿ‹L‰Tÿÿÿ‹‹Tü‰•Xÿÿÿ‹‹D‰•\ÿÿÿ‹$h ‰…`ÿÿÿ3À3É‹}è+¼DÿÿÿA;ú~@ƒùrëƒøt3À3É‹¼Dÿÿÿ+}èA;ú~Hƒùrë…À}÷؃øu]‹MЋUÔ‹ }üÎ3ÀÊú‰Mȉ}¬ë‹MÈ‹Uð‹9‹IüÐ׋}ð‰Uè8¶ 8‹}¬‹?¶:‹}èʶWýʶWÊÁù@ˆƒø|¼ÿEäƒEðCþ9E䂿þÿÿƒEüƒÆÿMÜ…Áþÿÿ‹Uà…ÒvM‹E¤‹MÔ +ȉUè‰MÐ3ÿ;߉}ðv.‹MЋUðƒEð‹ 4 ŠNŠVÀéÐêÊŠÀêÊ‹ˆ G;ûrÒƒÀÿMèuÁ‹EàHƒø‰EІ— ‹U¤KÿrPÿ‰Uè3ÿG;Ïv7‹‹Vø‹Fü¶ 9¶ÇʶPÿʶPʶ ‘ÁùˆGKÿ;ùrÌ‹EЃÆÿMèuºƒø†9 ‹UԍKÿƒÂH‰Uü‹U¤‰U܉Eè3ÿÇEð G;ω}ä†û ‹B ¶¶qÿ¶I‰uȉMÐ+ñ‹ ‹RÀ¶ ¶:‰Mø+Ê…ö‰U¬‰MØ}÷Þ…É}÷Ù‰MØ‹ ,h ‹Ð+UÐ+E¬<‹5Hh +UÈ+Eøþ¯×‹}Øù‹ (h þ¯ÇЋEüÓú‹ ‹MðÁ¶x¶p¶úòÊy3Éë ùÿ ~¹ÿ …öˆ}3Éë ¹ÿ ;ñ‹Î‹uü‹Eð…ÿ‹ˆL}3Éë ¹ÿ ;ù‹Ï‹‹}äGˆL‹U܍KÿƒÀ;ù‰}ä‰Eð‚ÿÿÿƒEüƒÂÿMè‰UÜ…Ýþÿÿ¡0h ‹ @h Á¾  ƒø2t,ƒÀ΍½Dþÿÿ+ø‹Ö=ÿ ‹È~¹ÿ ë…À}3Ɉ @Juãë3Àˆ„Dþÿÿ@;Ærô¡4h ‹ Lh Áƒø2‰EÐt%3É3À‰Eèj23Ò_÷÷A‰„@ùÿÿ‹EèEÐ;ΉEèräë3À‰„…Dùÿÿ@;Ærô‹Eà…À†Î ‹uԍ [‰Eè3À…Ɇ¯ ‹<¶ŠŒ Dþÿÿˆ‹|¶ŠŒ Dþÿÿˆ‹|¶ŠŒ Dþÿÿˆ‹¶J‰MØ‹¼Dùÿÿ¶J‹ŒDùÿÿ+Ï‹}Øρùÿ ~¹ÿ ë…É}3ɈJ‹¶ ‹ŒDùÿÿ+Œ½Dùÿÿρùÿ ~¹ÿ ë…É}3Ɉ ƒÀ [;Á‚QÿÿÿƒÆÿMè…;ÿÿÿ¡Dh ‹ 8h Áƒø2tzƒÀÎ3ö‹Èÿ ÷Ù+Á‰uü‰EЋEü3Ò¿ÿ ÷÷Áy3Àë =ÿ ~¸ÿ ˆ„5Dþÿÿ‹EÐEüFþ  rÊ‹Uà…Òv'‹}ԍ4[3É…öv‹ÁA;Î¶ŠœDþÿÿˆrëƒÇJu߃}Ì ‹5$K tÿuÌÿÖƒ}Ô tÿuÔÿÖ‹}¤‹…ÀtPÿÖWÿÖ‹}¨‹…ÀtPÿÖWÿÖ_^[ÉÃU‹ìì„ ¡¤h S‹ h V‹5(K W¿Wdm Ç…|ÿÿÿpÿÿÿWSj ÇE€’ÿÿÿÇE„³ÿÿÿÇEˆËÿÿÿÇEŒÝÿÿÿÇEëÿÿÿÇE”õÿÿÿÇE˜ýÿÿÿÇEœ ÇE  ÇE¤ ÇE¨" ÇE¬4 ÇE°L ÇE´n ÇE¸ ‰EäÿÖWSj ‰EÜÿÖWSj ‰EèÿÖ‰EÔ‹Eä¯ÃWPj ‰EÌÿÖ‹}܋˺€€€€‹ñ‰EЋÂÁéó«‹Îƒáóª‹}è‹Ë‹ÂÁéó«‹Îƒáóª‹}ԋˋ‹ÑÁéó«‹Êƒáóª‹EÌ‹5 h ‹}Й+‹ÈÑù‹ÁÁéó¥‹È‹Eäƒáó¤3ÿHÿ;ω}àŒ ‹Ã¿ÿ ™+‹ӉEì‹Á¯Ã‰EčAÿÑ}ì¯Ã÷ÚƒÁÒÑé‰U¼‰Eä‰MÌ‹M܃eô ¶ ‰Mü‹MèAƒ}ì ¶ ŽÜ ‹EÄ‹U܉UðDÿ‰Eø‹Eè‰EÀP‰UÈ)EÈ‹EЋUඉEØ‹ð‹EðÁþ¶ Eüƒæ™+ÂÑø„µ|ÿÿÿ;ljEü~‰}üƒ}ü }ƒeü ‹UðŠEü‹uøÿEðˆ‹h ˆ‹Eì‹uÀH9Eôu¶ë‹Eȶ0Á‹MØ™ƒá+ÂÑø‹Œ|ÿÿÿÈ;Ï~‹Ï…É}3É‹UøÿEôƒmøˆ¡h FÿEà‰uÀˆLÿ‹Eô;EìŒIÿÿÿ‹U¼‹Eä‹uÔ‹Mèƒeð ƒ}ì ¶6¶ ‰uüŽ¿ Dÿ‰Eø‹Eè‰Eô‹EЋUà¶4‹Uô‹ÆÁøƒà‰EضÁ‹MØ™+ÂÑø„|ÿÿÿ‹È;Ï~‹Ï…É}3É‹Eô‹UøÿEô ƒæˆ¡h ˆ ‹Eð‹UÔ‰Eض Eü™+ÂÑø„µ|ÿÿÿ;ljEü~‰}üƒ}ü }ƒeü ‹UØŠEü‹uøÿEðÿEàƒmøˆ‹h ˆDÿ‹Eð;EìŒTÿÿÿ‹U¼‹EäUÄÂÿM̉Eä…þÿÿ3ÿ9}Ü‹5$K tÿuÜÿÖ9}ètÿuèÿÖ9}ÔtÿuÔÿÖ9}ÐtÿuÐÿÖ_^[ÉÃÌU‹ìQVW3ÿ¾ÿ WhŽ: WWWEüVPÿHK ;Ç|Whph WWVÿuüÿDK ÿuü‹ðÿ@K ‹Æ_^ÉË ph …Étÿ%LK ÃÌS‹,K VW‹=4K 3ö¡ h VVVVVjhÔQ j£¨h ÿ0K …Àt%h€h ÿÓ95h tèÕûÿÿèÕÿÿVjh`h ÿ×ë¹hh ÿÓè Vjh°h ÿ×VÿPK _^[ÃÌ¡h V‹5$K …Àt PÿÖƒ%h ¡h …Àt PÿÖƒ%h ^ÃÌ¡Àh V3ö< WurjY:áu" Âh „Àtb<u3öFëY<ujëP<uMj ëH€üu+f¡Âh €ü€s„Àujë0:Áu-jë(„Àujë :Áu‹ñë€üu Âh < ujë< uj^ÁæjÆˆP Y¿ h ó¥_^ÃÌU‹ìV‹u ‹F‹ ‹@ƒè t6Ht+HHtHtƒèt¸» Àë.Vÿuj ëVÿujëVÿujëVÿujëVÿujè ‰F^] ÌU‹ì‹E SVM ÿuÆ@QQPè‘ ÿu‹uŠØE PVè! €ûuƒf 3À븻 À‰F^[] U‹ìƒì SVW‹} 3ö‹G‰uü‹‹X‹Q+Ö„Ÿ J„³ J…­ ;Þu ÇG8 é¿ ƒû‚‰ ‹I 3ÒBù  u ‰U ÇE ëù@ ‰UÇE  tÇE  ‹p¸R 3Û‰EøÇ ‰Vë‹Eøÿpÿ03ÀPÿu è• 3ÉQÿuRPèØ ƒEø‰DÞ‰TÞ C;^rÎÇG8 éé ¸# Àé ‹p3ÒB9Qu ¸» À‰Gé÷ …ÛuÇG88 ¸ €éÙ j8X;Ø‚É ‹]8SS…½ ‰G8‹K$‹C,ù  u ‰U ÇE ëù@ ‰UÇE  tÇE  3ÉQ‰Møÿu Áàÿ°R ÿ° R èÉ ÿuøÿuRPè ‰F(‰V,€{0 t ‰F0‹Â‰F4ë%j 3Àh€ Pÿu è” ÿuøÿuRPè× ‰F0‰V4ƒg ë'ƒyu‹@Ç@ ‰wÇG8 ë ¸» À‰G‰Eü‹Eü_^[É ‹D$Ç  ¸àO  ‹D$ VW‹|$ jƒø‹O^t;Æ~ƒø~ƒøt ƒø t¸» Àë)‹Aj(Z‰W8‰Q‹L$‰p…ɉp t · ‰H3Àë¸ À_^ ÌU‹ì‹EHt1HHt%Htƒèt ƒèu+‹E‹@Dë‹E‹@<ë‹E‹@8ë‹E‹@@ë‹E‹@4‹M ‰°] ÌU‹ìƒì ÿuEøPÿXK ‹EÇEà ‰EäEø‰Eè3ÀPPP‰Eð‰EôPEàÇEì@ Pÿu ÿuÿTK É ÌU‹ìƒì SVW3öÿuEôF3ÿP‰uüÿXK f9uô‹]vW·uü‹EøöÆf‹f; h u/fƒ Sÿuøÿu ÿuèaÿÿÿf‹ h ‹ø‹Eø…ÿf‰ |*ÿ3ÿ@K ÿEüf‹Eüf;Eôr­…ÿ|Sÿuøÿu ÿuè%ÿÿÿ‹ø‹Ç_^[É U‹ìƒì SEôÿu ÇEüš ÀPÿXK ‹E‹MhWdm ‹ DPj‰E ÿ(K ‹Ø…ÛtJE PEôÿu SjPÿuÿ\K …À‰Eü|‹K V‹s‹ÁW‹}óÁéó¥‹Èƒáó¤_^‹M‹C S‰ÿ$K ‹Eü[É U‹ìQQÿu EøPÿXK EjPjEøj Pÿuÿ`K É ÌU‹ìQQEøV‹uPh  jÿv|ÇEü ÿdK …ÀŒ¯ EPhÈe h?  ÿuøèhþÿÿ…ÀŒˆ EüPF4PjhÜe ÿuèáþÿÿEüPF8Pjhôe ÿuèÊþÿÿEüPF   t a6>  € u a6>  9 x       0 0 pi  ôK i  L ÔΆ ’O¹ªÑQ!'42  2 2 2  ( (  ˆf    ( (  àf    ( (  8g    ( (  g    ( (  èg                                               8 8   ( pL `M @i  ˜L @ ð   x € à ÿÿÿÿÿÿÿÿÿÿÿÿ@œ ‹  † …E j Ù Pà ÿÿÿÿÀuË+²ÑºA  É + <    - -    1 -      -     <       -     -      -     -  €   1       1 -    °h `h h €h  ³GGÎbÏ¥Ö(ÛÁ  € @B    ( K vids  € ª 8›q}ë6äORΟS ¯ §p€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ   x   x   x       x   x   ¡ ¡ xi xi xi ¡ (   x   á ( , vids  € ª 8›q}ë6äORΟS ¯ §p€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ @ ð @ ð @ ð     @ ð @ ð   €„ €„ @ @ @ €„ ( @ ð   „ ( ° vids  € ª 8›q}ë6äORΟS ¯ §p€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ € à € à € à     € à € à   @KL @KL €2 €2 €2 @KL ( € à    ( €” vids  € ª 8›qIYUV  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ °  °  °      °  °    € kn Ø t t € ( °   IYUV€” ( €p vids  € ª 8›qIYUV  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ   x   x   x       x   x   à“ Ï  t `T š[ (   x  IYUV€p ( R vids  € ª 8›qIYUV  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ `  `  `      `  `    €O >KL % €” `o in ( `   IYUV R ( €” vids  € ª 8›qI420  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ °  °  °      °  °    € kn Ø t t € ( °   I420€” ( €p vids  € ª 8›qI420  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ   x   x   x       x   x   à“ Ï  t `T š[ (   x  I420€p ( R vids  € ª 8›qI420  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ `  `  `      `  `    €O >KL % €” `o in ( `   I420 R PS (R xT ( €p vids  € ª 8›qIYUV  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ   x   x   x       x   x   €–˜ €–˜ „ „ „ €–˜ (   x  IYUV€p ( €” vids  € ª 8›qIYUV  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ °  °  °      °  °    €–˜ €–˜ ¤ ¤ ¤ €–˜ ( °   IYUV€” ( R vids  € ª 8›qIYUV  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ `  `  `      `  `    €–˜ €–˜    €–˜ ( `   IYUV R ( €p vids  € ª 8›qI420  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ   x   x   x       x   x   €–˜ €–˜ „ „ „ €–˜ (   x  I420€p ( €” vids  € ª 8›qI420  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ °  °  °      °  °    €–˜ €–˜ ¤ ¤ ¤ €–˜ ( °   I420€” ( R vids  € ª 8›qI420  € ª 8›q€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ `  `  `      `  `    €–˜ €–˜    €–˜ ( `   I420 R ( , vids  € ª 8›q}ë6äORΟS ¯ §p€ŸXVÃο ª UYZ   €ŸXVÃο ª UYZ @ ð   x Ð à       x Ð à   @KL @KL €p €p €p @KL ( @ ð   „ c     \  DL `i `i àQ     ¸d  DL Pi Pi àQ ò z ˆ  H  6  H  &  à ò ò `  þ  ò z L  D  ^  ò >  ®  ò ò Š    S e t t i n g s B r i g h t n e s s C o n t r a s t S a t u r a t i o n S h a r p n e s s W h i t e B a l a n c e d    Pf     €L  ›é—ê½Ï¥Ö(ÛÁ   `f d    ¨f     „L  ›é—ê½Ï¥Ö(ÛÁ   ¸f d    g     ˆL  ›é—ê½Ï¥Ö(ÛÁ   g d    Xg     ŒL  ›é—ê½Ï¥Ö(ÛÁ   hg d    °g     L  ›é—ê½Ï¥Ö(ÛÁ   Àg \ `6> i  i i i sqcaptur.dll D3áÆ¬0СŒ  É‰Vp.jä(СŒ  É‰V`3áÆ¬0СŒ  É‰VŠBlûSѐ_ À̺BlûSѐ_ À̺ ÉX›¬Ï¥Ö(ÛÁ Ði l K >>>%>.>5>:>@>V>\>n>|>”>¯>Ã>Ë>Ñ>à>ø>?&?/?8?A?I?T?r??Ä?   :=@=F=??H?T?Í?Ö?  ˆ0¦0g1 0 € ¦1£3´3Ê3n4t4¿4Å4à5æ5q6´6»6Â6¶7¢8ð8„9Ó9:C:Q:[:g:r:~:ˆ:‘:™: :¬:³:¹:Â:Ê:Þ:ç:ö:ÿ: ;;;#;0;9;M;u;¤;¾;Ä;ô<Ø=Þ=q>1?g?Š?¨?Ä?Ù? @ l 0<0Y0Œ0¦0½0æ0÷0121I1`1w1ˆ11Ð1ç2ú23%353E3U3f3{39•9·9Ô9é9æ:ì:ò:ø:þ:;D   D   H   L ;  Ј ­  Ó6 '  Ð^   Ób    Óò   ò   ò   ò   ø ²& ° Óª6 ‰ " Ó4: H  Ò|:  Ž: y ; / 8; • Î; ]   Ñ,< F   Òr< ô   Óf>   x> ]  Ö> K   Ð"? M  Ðp? ˜   Ó@    Ó˜@ -   ÐÆ@ â   ѨA & #  ÓÎB ¹   ÒˆC l   ÑôC    ЂD 5  ¸D Ÿ   ÓXG    ÓnI Ž   ÑNB10 a6> E:\usbintel\sys\objfre\i386\sqcaptur.pdb

i ran it a few times though and it seemed to find those 6 'threats' alternately i.e. 6 threats,0 threats,6 threats,0 threats…i presumed it unquarantined the files after each '0' scan

That does seem strange,ok run it again until it comes up with no threats then do the following

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
    *nchssvad*
    *SQcaptur*
    *netr73*
    *nv4_mini*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Hi,thanks for your time on this,here's the result SystemLook 04.09.10 by jpshortstuff Log created at 13:50 on 29/10/2010 by Derek Administrator - Elevation successful ========== filefind ========== Searching for "*nchssvad*" C:\WINDOWS\system32\drivers\nchssvad.sys –a—- 27136 bytes [10:10 30/09/2009] [10:10 30/09/2009] 0DF9CC7B5CC173F545723F23E68FAC93 Searching for "*SQcaptur*" C:\WINDOWS\system32\drivers\sqcaptur.sys –a—- 30921 bytes [07:39 20/08/2009] [09:56 10/01/2003] 100FF3D9E16AFB3163BD6F9AAAAB7C55 C:\WINDOWS\twain_32\MyDSC\sqcaptur.sys –a–c- 30921 bytes [07:39 20/08/2009] [09:56 10/01/2003] 100FF3D9E16AFB3163BD6F9AAAAB7C55 Searching for "*netr73*" C:\WINDOWS\system32\drivers\netr73.sys -ra—- 256000 bytes [12:43 19/09/2009] [08:01 31/01/2007] 757F999AA72B55780EE810D4CD1BDD47 Searching for "*nv4_mini*" C:\Program Files\Driver Checker\download\NVIDIA GeForce 8M_9M_100M_200M 190_62 WinXP32\nv4_mini.sys –a—- 7729568 bytes [09:51 27/05/2010] [10:22 27/05/2010] 9A4ABD7AE82A5BF1AA332E06801A313D C:\Program Files\Driver Checker\download\NVIDIA_nForce_MCP_Audio_Processing_Unit_For_WinXP_Vista_Vista64\display\nv4_mini.sys –a—- 2459968 bytes [09:54 27/05/2010] [09:54 27/05/2010] C43D9D777D53D668D1FE683947C9FFE1 C:\Program Files\Driver Checker\download\NVIDIA_nForce_MCP_Audio_Processing_Unit_For_WinXP_Vista_Vista64\display\nv4_mini.sy_ –a—- 1328043 bytes [09:54 27/05/2010] [09:54 27/05/2010] E228A1E0638D853CEE6544D6F432C14F C:\Program Files\Driver Checker\download\NVIDIA_Tesla_C870_Display For WinXP\Display\nv4_mini.sy_ –a—- 3832769 bytes [09:54 27/05/2010] [10:22 27/05/2010] 5D6ACEB0D159A369F83B5F3CED3A506E C:\WINDOWS\system32\dllcache\nv4_mini.sys –a–c- 2459968 bytes [09:54 27/05/2010] [09:54 27/05/2010] C43D9D777D53D668D1FE683947C9FFE1 C:\WINDOWS\system32\drivers\nv4_mini.sys –a—- 2459968 bytes [09:54 27/05/2010] [09:54 27/05/2010] C43D9D777D53D668D1FE683947C9FFE1 C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\nv4_mini.sys –a—- 1893728 bytes [10:00 27/05/2010] [00:14 12/03/2004] A088DF087615267B4788BC97F1B79E8C -= EOF =-
Good,those files are where they should be,we will try to run combofix again.Delete the copy you have and download a fresh one to your desktop from one of the links below.Do not rename it.

Link 1
Link 2


Run ComboFix using these instructions:

Click the Windows 'Start' button > Select 'Run' - then copy/paste the following bolded text into the run box & click OK.

"%userprofile%\desktop\combofix.exe" /killall

When finished, it shall hopefully produce a log for you. Post that log in your next reply.
Success this time :thumbup: ,it ran fully,though on reboot avast popped up a block warning for a combofix process,quickly disabled it again and combofix seemed to complete, here's the log….

ComboFix 10-10-29.03 - Derek 10/30/2010 11:51:58.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.991.677 [GMT 1:00]
Running from: c:\documents and settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Derek\Local Settings\Application Data\{68115FA3-3B8E-477F-B6D7-B5AB807E38A9}
c:\documents and settings\Derek\Local Settings\Application Data\{68115FA3-3B8E-477F-B6D7-B5AB807E38A9}\chrome\content\_cfg.js
c:\documents and settings\Derek\Local Settings\Application Data\{68115FA3-3B8E-477F-B6D7-B5AB807E38A9}\chrome\content\overlay.xul
c:\documents and settings\Derek\Local Settings\Application Data\{68115FA3-3B8E-477F-B6D7-B5AB807E38A9}\install.rdf
c:\windows\jestertb.dll

Infected copy of c:\windows\system32\drivers\termdd.sys was found and disinfected
Restored copy from - Kitty had a snack :P
.
((((((((((((((((((((((((( Files Created from 2010-09-28 to 2010-10-30 )))))))))))))))))))))))))))))))
.

2010-10-29 10:57 . 2010-10-29 10:57 ——– d—–w- c:\windows\system32\Adobe
2010-10-28 12:05 . 2010-10-28 12:07 ——– d—–w- c:\windows\system32\NtmsData
2010-10-28 11:10 . 2010-10-28 12:16 ——– d—–w- C:\TDSSKiller_Quarantine
2010-10-27 17:57 . 2010-10-27 17:57 ——– d—–w- c:\windows\system32\LogFiles
2010-10-26 22:19 . 2010-10-26 22:19 ——– d—–w- c:\documents and settings\Administrator
2010-10-25 15:16 . 2010-10-26 12:43 ——– d—–w- c:\program files\Registry Easy
2010-10-24 16:03 . 2010-10-24 16:04 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\IM
2010-10-24 12:58 . 2010-04-19 11:01 2767872 —-a-w- c:\windows\system32\Redemption.dll
2010-10-24 11:12 . 2010-10-24 11:12 74752 —-a-w- c:\windows\system32\drivers\pxrts.sys
2010-10-24 11:11 . 2010-10-24 11:12 ——– d—–w- c:\documents and settings\All Users\Application Data\PrevxCSI
2010-10-24 10:06 . 2010-10-24 10:06 ——– d—–w- c:\program files\NOS
2010-10-24 10:06 . 2010-10-24 10:06 ——– d—–w- c:\documents and settings\All Users\Application Data\TomTom
2010-10-24 10:06 . 2010-10-24 10:06 ——– d—–w- c:\program files\TomTom International B.V
2010-10-24 10:06 . 2010-10-24 10:06 ——– d—–w- c:\documents and settings\Derek\Local Settings\Application Data\TomTom
2010-10-24 10:06 . 2010-10-24 10:06 ——– d—–w- c:\program files\TomTom DesktopSuite
2010-10-04 18:43 . 2010-10-24 10:01 ——– d—–w- c:\program files\Sony
2010-10-04 18:41 . 2010-10-24 10:01 ——– d—–w- c:\windows\system32\drivers\UMDF
2010-10-04 18:39 . 2010-10-24 10:01 ——– d—–w- c:\program files\Sony Media Go Install
2010-10-04 18:39 . 2010-10-04 18:44 ——– d—–w- c:\documents and settings\Derek\Application Data\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-07 15:12 . 2010-09-08 12:55 38848 —-a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2009-08-10 08:05 167592 —-a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2009-08-10 08:05 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2009-08-21 07:37 165584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2009-08-10 08:05 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2009-08-10 08:05 100176 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2009-08-10 08:05 94544 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2009-08-21 07:37 17744 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2009-08-10 08:05 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2006-05-03 10:06 163328 –sh–r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 –sh–r- c:\windows\system32\msfDX.dll
2007-12-17 13:43 27648 –sh–w- c:\windows\system32\Smab0.dll
2008-02-04 19:26 151040 –sh–w- c:\windows\system32\VistaUltm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"EPSON Stylus Photo RX420 Series"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-26 202256]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-27 4112384]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-05-27 81920]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-09-30 2183680]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-08-05 251264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)
"link"= 00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\aMSN\\bin\\wish.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [5/27/2010 10:44 AM 16640]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8/21/2009 8:37 AM 165584]
R1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [10/24/2010 12:12 PM 74752]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [8/13/2009 10:25 AM 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/21/2009 8:37 AM 17744]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [8/24/2010 10:38 AM 92008]
S3 netr73;D-Link DWA-111 Wireless G USB Adapter Driver;c:\windows\system32\drivers\netr73.sys [9/19/2009 1:43 PM 256000]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3/12/2004 2:19 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-10-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-1409082233-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 22:09]

2010-10-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1659004503-1409082233-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 22:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.virginmedia.com/
DPF: {FD0EBBED-0C42-4D0F-82DA-44399B5C420A} - hxxp://downloads.virginmedia.com/CST/ver1/xp_mail.cab
FF - ProfilePath - c:\documents and settings\Derek\Application Data\Mozilla\Firefox\Profiles\qys11roc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.virginmedia.com/
FF - component: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\Derek\Application Data\Mozilla\Firefox\Profiles\qys11roc.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-30 11:59
Windows 5.1.2600 Service Pack 2, v.2096 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\ODBC32.dll

- - - - - - - > 'lsass.exe'(760)
c:\windows\system32\dssenh.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\SOUNDMAN.EXE
c:\windows\System32\SCardSvr.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-10-30 12:02:38 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-30 11:02

Pre-Run: 44,829,798,400 bytes free
Post-Run: 44,872,851,456 bytes free

- - End Of File - - B9B6334199AC59E7DA8EC28C7FC47D68
TDSS did produce a log, dont know how i didn't see it ,a bit late but here it is… 2010/10/28 12:07:16.0921 TDSS rootkit removing tool 2.4.5.1 Oct 26 2010 11:28:49 2010/10/28 12:07:16.0921 ================================================================================ 2010/10/28 12:07:16.0921 SystemInfo: 2010/10/28 12:07:16.0921 2010/10/28 12:07:16.0921 OS Version: 5.1.2600 ServicePack: 2.0 2010/10/28 12:07:16.0921 Product type: Workstation 2010/10/28 12:07:16.0921 ComputerName: HOME-8D9F46EACB 2010/10/28 12:07:16.0921 UserName: Derek 2010/10/28 12:07:16.0921 Windows directory: C:\WINDOWS 2010/10/28 12:07:16.0921 System windows directory: C:\WINDOWS 2010/10/28 12:07:16.0921 Processor architecture: Intel x86 2010/10/28 12:07:16.0921 Number of processors: 1 2010/10/28 12:07:16.0921 Page size: 0x1000 2010/10/28 12:07:16.0921 Boot type: Normal boot 2010/10/28 12:07:16.0921 ================================================================================ 2010/10/28 12:07:18.0046 Initialize success 2010/10/28 12:07:27.0421 ================================================================================ 2010/10/28 12:07:27.0421 Scan started 2010/10/28 12:07:27.0421 Mode: Manual; 2010/10/28 12:07:27.0421 ================================================================================ 2010/10/28 12:07:27.0687 Aavmker4 (8d488938e2f7048906f1fbd3af394887) C:\WINDOWS\system32\drivers\Aavmker4.sys 2010/10/28 12:07:28.0296 ACPI (68904a52ccc90552eeaf3e1bc1e17ace) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2010/10/28 12:07:30.0046 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 2010/10/28 12:07:30.0421 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys 2010/10/28 12:07:30.0718 AFD (c54d2a3a407be0b02eb996454286b18e) C:\WINDOWS\System32\drivers\afd.sys 2010/10/28 12:07:31.0265 ALCXWDM (8a8909fdd548d84a3e02e04f699ee705) C:\WINDOWS\system32\drivers\ALCXWDM.SYS 2010/10/28 12:07:31.0859 AmdK7 (32add2446381357a2c6b00d463a81036) C:\WINDOWS\system32\DRIVERS\amdk7.sys 2010/10/28 12:07:32.0343 aswFsBlk (a0d86b8ac93ef95620420c7a24ac5344) C:\WINDOWS\system32\drivers\aswFsBlk.sys 2010/10/28 12:07:32.0484 aswMon2 (7d880c76a285a41284d862e2d798ec0d) C:\WINDOWS\system32\drivers\aswMon2.sys 2010/10/28 12:07:32.0609 aswRdr (69823954bbd461a73d69774928c9737e) C:\WINDOWS\system32\drivers\aswRdr.sys 2010/10/28 12:07:32.0750 aswSP (7ecc2776638b04553f9a85bd684c3abf) C:\WINDOWS\system32\drivers\aswSP.sys 2010/10/28 12:07:32.0906 aswTdi (095ed820a926aa8189180b305e1bcfc9) C:\WINDOWS\system32\drivers\aswTdi.sys 2010/10/28 12:07:33.0015 AsyncMac (6be963ded6d4fb0903f4d43b30f55201) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2010/10/28 12:07:33.0312 atapi (030cb0bc20bf0cbbbea8cec1803d6e6d) C:\WINDOWS\system32\DRIVERS\atapi.sys 2010/10/28 12:07:33.0625 Atmarpc (411ee1364d9d9e200c1c17c44b6aaec6) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2010/10/28 12:07:33.0953 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2010/10/28 12:07:34.0265 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2010/10/28 12:07:34.0718 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2010/10/28 12:07:35.0031 CCDECODE (c343eca0bcb999a2c237b08da1c4ed6b) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 2010/10/28 12:07:35.0375 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2010/10/28 12:07:35.0703 Cdfs (41e9cf315bb37895396a1c24eeb6f651) C:\WINDOWS\system32\drivers\Cdfs.sys 2010/10/28 12:07:36.0046 Cdrom (f00752cbcfc70d33f046ebba00ef2d4b) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2010/10/28 12:07:36.0609 DCamUSBSQTECH (100ff3d9e16afb3163bd6f9aaaab7c55) C:\WINDOWS\system32\Drivers\SQcaptur.sys 2010/10/28 12:07:36.0656 DCamUSBSQTECH - detected Unsigned file (1) 2010/10/28 12:07:36.0750 Disk (330f4c2fbef822f40a200408045731d4) C:\WINDOWS\system32\DRIVERS\disk.sys 2010/10/28 12:07:37.0109 dmboot (64bcc5ea1add088742efe4471cfb9637) C:\WINDOWS\system32\drivers\dmboot.sys 2010/10/28 12:07:37.0453 dmio (8296e4831a0cb0b92d3e4c4b4b6f76dc) C:\WINDOWS\system32\drivers\dmio.sys 2010/10/28 12:07:37.0812 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2010/10/28 12:07:38.0156 DMusic (70d91b349a90d02b83ff4b36dc97efae) C:\WINDOWS\system32\drivers\DMusic.sys 2010/10/28 12:07:38.0546 drmkaud (8b3e949a9cf63a4089542a9065532240) C:\WINDOWS\system32\drivers\drmkaud.sys 2010/10/28 12:07:38.0906 Fastfat (4391f4902d8181f5e8e863f07867a4d9) C:\WINDOWS\system32\drivers\Fastfat.sys 2010/10/28 12:07:39.0218 Fdc (b061a735a4c6231a72990629a8ed7538) C:\WINDOWS\system32\DRIVERS\fdc.sys 2010/10/28 12:07:39.0531 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys 2010/10/28 12:07:39.0875 Flpydisk (74e2d1eb0225c93b375a05578df8ff3b) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 2010/10/28 12:07:40.0156 FltMgr (c1c4a97b27ebacd9c6b3ca9026b6593b) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 2010/10/28 12:07:40.0500 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2010/10/28 12:07:40.0796 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2010/10/28 12:07:41.0109 gameenum (8469234cef5c74418cdd8848ac9db1b6) C:\WINDOWS\system32\DRIVERS\gameenum.sys 2010/10/28 12:07:41.0437 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys 2010/10/28 12:07:41.0562 Gpc (3ffa140800b67f821c69b274537cd7fc) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2010/10/28 12:07:41.0937 HTTP (257bbac658ea5aae6ae6f4b7a75888d2) C:\WINDOWS\system32\Drivers\HTTP.sys 2010/10/28 12:07:42.0343 i8042prt (5e36b08146f763f971a2019d87a4389e) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2010/10/28 12:07:42.0671 Imapi (89f660c75a4e50716262a83cec08e290) C:\WINDOWS\system32\DRIVERS\imapi.sys 2010/10/28 12:07:43.0046 Ip6Fw (b390ca36ea188d82c73a76970523482b) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 2010/10/28 12:07:43.0390 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2010/10/28 12:07:43.0656 IpInIp (f56dd863ba732a4e8ee58d486c31250f) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2010/10/28 12:07:43.0984 IpNat (e8c398fdf78bed12b525e46216a02351) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2010/10/28 12:07:44.0296 IPSec (9fb02788a4cd0c9f934f53204878782b) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2010/10/28 12:07:44.0578 IRENUM (775cbd5fa1c66f717c8754d8c658f835) C:\WINDOWS\system32\DRIVERS\irenum.sys 2010/10/28 12:07:44.0921 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2010/10/28 12:07:45.0281 Kbdclass (96db9b301b27709f156c094e7ca1a2e8) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2010/10/28 12:07:45.0593 kmixer (c37f1175844ce4b865bde5cc20681123) C:\WINDOWS\system32\drivers\kmixer.sys 2010/10/28 12:07:45.0921 KSecDD (d54f25d53a5921a78e1bee6947b7dd36) C:\WINDOWS\system32\drivers\KSecDD.sys 2010/10/28 12:07:46.0296 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2010/10/28 12:07:46.0625 Modem (63f9a81029196290abe1841f1d186229) C:\WINDOWS\system32\drivers\Modem.sys 2010/10/28 12:07:46.0953 Mouclass (6b6eb53816a286dd4fe8d44f191d8457) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2010/10/28 12:07:47.0218 MountMgr (3381fe107e3855d9877c37b95f40ce0d) C:\WINDOWS\system32\drivers\MountMgr.sys 2010/10/28 12:07:47.0562 MRxDAV (ec56f61732d90c362f1e787925b68a7a) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2010/10/28 12:07:47.0906 MRxSmb (17f33fd6d76e2184df7b396a078a3e43) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2010/10/28 12:07:48.0328 Msfs (bc2862d0afbbbc0a31c71ac2a6d556e7) C:\WINDOWS\system32\drivers\Msfs.sys 2010/10/28 12:07:48.0625 MSKSSRV (92d55003d3e701e67b309df2c7e6028a) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2010/10/28 12:07:48.0937 MSPCLOCK (671fbb5e78a1a02b9d56d3f2484bfe26) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2010/10/28 12:07:49.0187 MSPQM (498cd4c3efc6783c0545221cb66e7c3e) C:\WINDOWS\system32\drivers\MSPQM.sys 2010/10/28 12:07:49.0515 mssmbios (f0f5c06ce05eedca80d3e8c98f1e2935) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2010/10/28 12:07:49.0859 MSTEE (144fde677766101da3bbda57c14f5f83) C:\WINDOWS\system32\drivers\MSTEE.sys 2010/10/28 12:07:50.0171 ms_mpu401 (ca3e22598f411199adc2dfee76cd0ae0) C:\WINDOWS\system32\drivers\msmpu401.sys 2010/10/28 12:07:50.0468 Mup (199c73daf5b26380271db4752847b10a) C:\WINDOWS\system32\drivers\Mup.sys 2010/10/28 12:07:50.0765 NABTSFEC (a08ef9b9d365450d530c3df5d541f959) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 2010/10/28 12:07:51.0078 NCHSSVAD (0df9cc7b5cc173f545723f23e68fac93) C:\WINDOWS\system32\drivers\nchssvad.sys 2010/10/28 12:07:51.0109 NCHSSVAD - detected Unsigned file (1) 2010/10/28 12:07:51.0234 NDIS (db8ea964c507dfc0445e63c9a6ce6b42) C:\WINDOWS\system32\drivers\NDIS.sys 2010/10/28 12:07:51.0546 ndiscm (33c0ba2979df266e67f5e632f41591bb) C:\WINDOWS\system32\DRIVERS\NetMotCM.sys 2010/10/28 12:07:51.0703 NdisIP (dcb617b784d7cc80d8355a22aabc7019) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 2010/10/28 12:07:52.0015 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2010/10/28 12:07:52.0296 Ndisuio (7f1781c46663f7f8eb78915e188a8f60) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2010/10/28 12:07:52.0593 NdisWan (024029f33a57933b194ed156ba969cd5) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2010/10/28 12:07:52.0921 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys 2010/10/28 12:07:53.0234 NetBIOS (9df94c862bd1be22d4d2cbe23bc942a0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2010/10/28 12:07:53.0562 NetBT (c017ec90a95997c1c9a0bab5773c7cd8) C:\WINDOWS\system32\DRIVERS\netbt.sys 2010/10/28 12:07:53.0937 netr73 (757f999aa72b55780ee810d4cd1bdd47) C:\WINDOWS\system32\DRIVERS\netr73.sys 2010/10/28 12:07:53.0984 netr73 - detected Unsigned file (1) 2010/10/28 12:07:54.0109 nmwcd (357ddb51e03cae598c096d95497373d0) C:\WINDOWS\system32\drivers\ccdcmb.sys 2010/10/28 12:07:54.0437 nmwcdc (7cd443f9d36c80e152fadb274089577a) C:\WINDOWS\system32\drivers\ccdcmbo.sys 2010/10/28 12:07:54.0625 Npfs (a7efbd4a2e62e7cb6c130f2de13e80ab) C:\WINDOWS\system32\drivers\Npfs.sys 2010/10/28 12:07:54.0984 Ntfs (7e6185d867456ddd817bb34bb0bc429b) C:\WINDOWS\system32\drivers\Ntfs.sys 2010/10/28 12:07:55.0343 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2010/10/28 12:07:55.0718 nv (c43d9d777d53d668d1fe683947c9ffe1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 2010/10/28 12:07:57.0734 nv - detected Unsigned file (1) 2010/10/28 12:07:57.0906 nvatabus (83f0275a21d9772b51cef57e35afae61) C:\WINDOWS\system32\DRIVERS\nvatabus.sys 2010/10/28 12:07:58.0093 nvax (47b3852808dd579a463fce7085b77413) C:\WINDOWS\system32\drivers\nvax.sys 2010/10/28 12:07:58.0265 nvcchflt (fb7213bc5279c1af5e4e9ca05d944f2c) C:\WINDOWS\system32\DRIVERS\nvcchflt.sys 2010/10/28 12:07:58.0453 NVENET (1cf77b30dee5c75dea1eee697281802c) C:\WINDOWS\system32\DRIVERS\NVENET.sys 2010/10/28 12:07:58.0734 nvnforce (adbcba116496229a163193bbe0bb28ce) C:\WINDOWS\system32\drivers\nvapu.sys 2010/10/28 12:07:59.0031 nv_agp (3194e2f6c9000c39dcf9d0580754f714) C:\WINDOWS\system32\DRIVERS\nv_agp.sys 2010/10/28 12:07:59.0218 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2010/10/28 12:07:59.0500 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2010/10/28 12:07:59.0843 Parport (4c3753808cd9210069a26b20307b1049) C:\WINDOWS\system32\DRIVERS\parport.sys 2010/10/28 12:08:00.0156 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys 2010/10/28 12:08:00.0468 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2010/10/28 12:08:00.0765 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys 2010/10/28 12:08:00.0937 PCI (b30748e5a0b1ec27e2e8ad82439e0743) C:\WINDOWS\system32\DRIVERS\pci.sys 2010/10/28 12:08:01.0281 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2010/10/28 12:08:01.0500 Pcmcia (f27ba406f434d447205409341bcd3543) C:\WINDOWS\system32\drivers\Pcmcia.sys 2010/10/28 12:08:02.0125 PptpMiniport (34d3c4eafa2857a1b8748f963c1715c6) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2010/10/28 12:08:02.0437 Ps2 (390c204ced3785609ab24e9c52054a84) C:\WINDOWS\system32\DRIVERS\PS2.sys 2010/10/28 12:08:02.0468 Ps2 - detected Unsigned file (1) 2010/10/28 12:08:02.0578 PSched (c37be259f8524b6de485b9c8f5c30228) C:\WINDOWS\system32\DRIVERS\psched.sys 2010/10/28 12:08:02.0890 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2010/10/28 12:08:03.0187 pxrts (8158dca4ac06c95110178524ac07cca4) C:\WINDOWS\system32\drivers\pxrts.sys 2010/10/28 12:08:03.0515 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2010/10/28 12:08:03.0812 Rasl2tp (87e1a55d92a4f3c9c554253757e6b172) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2010/10/28 12:08:04.0125 RasPppoe (888335b3be346119cf7b4eff3a3fca7c) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2010/10/28 12:08:04.0437 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2010/10/28 12:08:04.0734 Rdbss (bd3cae2438b36a2c1a22374ee5225de0) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2010/10/28 12:08:05.0031 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2010/10/28 12:08:05.0328 rdpdr (5768fb41bf8f15a46465cb7884a32c89) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2010/10/28 12:08:05.0656 RDPWD (5f1ca52a7834958cba53f61dd0acfe8c) C:\WINDOWS\system32\drivers\RDPWD.sys 2010/10/28 12:08:05.0953 redbook (17c2531f9d21f3b9daaa0a87184e97cb) C:\WINDOWS\system32\DRIVERS\redbook.sys 2010/10/28 12:08:06.0296 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2010/10/28 12:08:06.0593 serenum (4b455594589a4fc1b791126a7b3044cd) C:\WINDOWS\system32\DRIVERS\serenum.sys 2010/10/28 12:08:06.0843 Serial (dc1b3b8ad7fceea19a9d65f6a5dd49f1) C:\WINDOWS\system32\DRIVERS\serial.sys 2010/10/28 12:08:07.0140 Sfloppy (4f0e5df584405f296e1ab69e61870cad) C:\WINDOWS\system32\drivers\Sfloppy.sys 2010/10/28 12:08:07.0453 SLIP (d68195a39a4b00e32bc1f28967856e69) C:\WINDOWS\system32\DRIVERS\SLIP.sys 2010/10/28 12:08:07.0890 splitter (0571ee7476963e244d0302c7fe438e1f) C:\WINDOWS\system32\drivers\splitter.sys 2010/10/28 12:08:08.0218 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2010/10/28 12:08:08.0265 sp_rsdrv2 - detected Unsigned file (1) 2010/10/28 12:08:08.0375 sr (3738b2570ff1e195b8cdc7b79cc8af30) C:\WINDOWS\system32\DRIVERS\sr.sys 2010/10/28 12:08:08.0703 Srv (fd974de6b9f6f23a8ccbc1776aa00c1d) C:\WINDOWS\system32\DRIVERS\srv.sys 2010/10/28 12:08:09.0062 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys 2010/10/28 12:08:09.0375 streamip (c1501d3969f73561d5e55fdfa7dec750) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 2010/10/28 12:08:09.0625 swenum (ab4ea57db7f2762603a3574e25f2dd56) C:\WINDOWS\system32\DRIVERS\swenum.sys 2010/10/28 12:08:09.0921 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys 2010/10/28 12:08:10.0406 sysaudio (1b428657c58b8e97c55fe6054853230c) C:\WINDOWS\system32\drivers\sysaudio.sys 2010/10/28 12:08:10.0734 Tcpip (7347c92a9e8a92c67d57695f9bf4e824) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2010/10/28 12:08:11.0093 TDPIPE (1a96630babbd59e8b885eae0dfbe6a3e) C:\WINDOWS\system32\drivers\TDPIPE.sys 2010/10/28 12:08:11.0343 TDTCP (d1c578c6b37713694c5edd7c2d7f7451) C:\WINDOWS\system32\drivers\TDTCP.sys 2010/10/28 12:08:11.0609 TermDD (931ba49a7fb38158be89740e69213f08) C:\WINDOWS\system32\DRIVERS\termdd.sys 2010/10/28 12:08:11.0984 Udfs (657e040de0da0bfe2dd48923c7e744cc) C:\WINDOWS\system32\drivers\Udfs.sys 2010/10/28 12:08:12.0343 Update (c2e69ecbd09975594ab9437cdaf3962a) C:\WINDOWS\system32\DRIVERS\update.sys 2010/10/28 12:08:12.0656 upperdev (15629e4d65f97ab5432d6d9597cf6a33) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys 2010/10/28 12:08:12.0921 usbccgp (0dcef2abbccb48e4c2b296f0adeeb334) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2010/10/28 12:08:13.0234 usbehci (5df553eb2c3de25b3277dbbe4c029731) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2010/10/28 12:08:13.0515 usbhub (966d908ab5b9e4b8f3efc5eef66ab272) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2010/10/28 12:08:13.0859 usbohci (2cc5b03e8f0c0c52dcd8d5def812072c) C:\WINDOWS\system32\DRIVERS\usbohci.sys 2010/10/28 12:08:14.0140 usbprint (281e44b560c83b55389d229bc99c5c54) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2010/10/28 12:08:14.0437 usbscan (e7ca35510364a041daf2f4e0d3025251) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2010/10/28 12:08:14.0671 usbser (3c3ab7c978c7a0fbe67f379f04c1f340) C:\WINDOWS\system32\drivers\usbser.sys 2010/10/28 12:08:14.0968 UsbserFilt (5c17e6a11aa8be53f79fd364ba19f0ce) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys 2010/10/28 12:08:15.0140 USBSTOR (439c51b07325e672aac277fc18f81854) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2010/10/28 12:08:15.0453 VgaSave (5bdf4e55a2cdff60fd30998d6b988af1) C:\WINDOWS\System32\drivers\vga.sys 2010/10/28 12:08:15.0734 viamraid (f199939205dccc7836ae5ab8b5dd5e83) C:\WINDOWS\system32\DRIVERS\viamraid.sys 2010/10/28 12:08:15.0984 VolSnap (512e76ce164e031f3e5bc8ab54f32366) C:\WINDOWS\system32\drivers\VolSnap.sys 2010/10/28 12:08:16.0343 Wanarp (5dc459c80fe66a44b2ddbeafd5afab70) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2010/10/28 12:08:16.0671 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys 2010/10/28 12:08:16.0953 wdmaud (08874bec364ea93be283fc0932d06742) C:\WINDOWS\system32\drivers\wdmaud.sys 2010/10/28 12:08:17.0343 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys 2010/10/28 12:08:17.0515 WSTCODEC (ce1c31b8347e08bbcccde0556bd96e8a) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 2010/10/28 12:08:17.0906 ================================================================================ 2010/10/28 12:08:17.0906 Scan finished 2010/10/28 12:08:17.0906 ================================================================================ 2010/10/28 12:08:18.0031 Detected object count: 6 2010/10/28 12:10:21.0703 DCamUSBSQTECH (100ff3d9e16afb3163bd6f9aaaab7c55) C:\WINDOWS\system32\Drivers\SQcaptur.sys 2010/10/28 12:10:21.0734 C:\WINDOWS\system32\Drivers\SQcaptur.sys - quarantined 2010/10/28 12:10:21.0734 Unsigned file(DCamUSBSQTECH) - User select action: Quarantine 2010/10/28 12:10:21.0843 NCHSSVAD (0df9cc7b5cc173f545723f23e68fac93) C:\WINDOWS\system32\drivers\nchssvad.sys 2010/10/28 12:10:21.0875 C:\WINDOWS\system32\drivers\nchssvad.sys - quarantined 2010/10/28 12:10:21.0875 Unsigned file(NCHSSVAD) - User select action: Quarantine 2010/10/28 12:10:22.0000 netr73 (757f999aa72b55780ee810d4cd1bdd47) C:\WINDOWS\system32\DRIVERS\netr73.sys 2010/10/28 12:10:22.0031 C:\WINDOWS\system32\DRIVERS\netr73.sys - quarantined 2010/10/28 12:10:22.0046 Unsigned file(netr73) - User select action: Quarantine 2010/10/28 12:10:22.0312 nv (c43d9d777d53d668d1fe683947c9ffe1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 2010/10/28 12:10:22.0390 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys - quarantined 2010/10/28 12:10:22.0406 Unsigned file(nv) - User select action: Quarantine 2010/10/28 12:10:22.0562 Ps2 (390c204ced3785609ab24e9c52054a84) C:\WINDOWS\system32\DRIVERS\PS2.sys 2010/10/28 12:10:22.0578 C:\WINDOWS\system32\DRIVERS\PS2.sys - quarantined 2010/10/28 12:10:22.0593 Unsigned file(Ps2) - User select action: Quarantine 2010/10/28 12:10:22.0734 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2010/10/28 12:10:22.0750 C:\WINDOWS\system32\drivers\sp_rsdrv2.sys - quarantined 2010/10/28 12:10:22.0765 Unsigned file(sp_rsdrv2) - User select action: Quarantine 2010/10/28 12:10:53.0265 Deinitialize success
Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please






Next

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Hi,thanks Here is the first one… Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 5005 Windows 5.1.2600 Service Pack 2, v.2096 Internet Explorer 6.0.2900.2096 10/31/2010 12:18:26 PM mbam-log-2010-10-31 (12-18-26).txt Scan type: Quick scan Objects scanned: 143558 Time elapsed: 7 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
and heres the eset log,had a bit of trouble running it,had to download it with firefox,then it didn't scan,so eventually it ran in explorer. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK esets_scanner_update returned -1 esets_gle=53251 # version=7 # iexplore.exe=6.00.2900.2096 (xpsp_sp2_rc1.040311-2315) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=b1923b0db104e341b261d3576e7f8196 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-10-31 01:53:31 # local_time=2010-10-31 01:53:31 (+0000, GMT Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 2, v.2096 # compatibility_mode=512 16777215 100 0 38542253 38542253 0 0 # compatibility_mode=768 16777215 100 0 12358656 12358656 0 0 # compatibility_mode=7937 16777213 100 100 309625 38374474 0 0 # compatibility_mode=8192 67108863 100 0 2128 2128 0 0 # compatibility_mode=9217 16777214 0 13 38631256 38634856 0 0 # scanned=73650 # found=6 # cleaned=0 # scan_time=3230 C:\Documents and Settings\Derek\My Documents\Derek Docs\Set Up + Driver Files\install_bsplayer254.1038_clip.exe VBS/StartPage.NCM.Gen trojan 00000000000000000000000000000000 I C:\Documents and Settings\Derek\My Documents\Derek Docs\Set Up + Driver Files\Nero-7.10.1.0_eng_update.incl.keygen\Nero-7.10.1.0_eng_update.exe Win32/Toolbar.AskSBar application 00000000000000000000000000000000 I C:\Documents and Settings\Derek\My Documents\Downloads\RegistryEasy.exe a variant of Win32/Adware.RegistryEasy application 00000000000000000000000000000000 I C:\Program Files\Registry Easy\RE.exe a variant of Win32/Adware.RegistryEasy application 00000000000000000000000000000000 I C:\Program Files\Registry Easy\Recoveryer.dll Win32/Adware.RegistryEasy application 00000000000000000000000000000000 I C:\System Volume Information\_restore{EBB19351-C59C-4401-8779-1731F63F9EC2}\RP432\A0154301.sys Win32/Olmarik.ZC trojan 00000000000000000000000000000000 I
Download CKScanner
Important - Save it to your desktop.
Doubleclick CKScanner.exe and click Search For Files.
After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved.
Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.
thanks, CK result… CKScanner - Additional Security Risks - These are not necessarily bad c:\documents and settings\derek\my documents\derek docs\set up + driver files\nero-7.10.1.0_eng_update.incl.keygen\keygen.exe c:\documents and settings\derek\my documents\derek docs\set up + driver files\nero-7.10.1.0_eng_update.incl.keygen\nero-7.10.1.0_eng_update.exe scanner sequence 3.AA.11 —– EOF —–
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services
    
    :Files
    C:\Documents and Settings\Derek\My Documents\Derek Docs\Set Up + Driver Files\install_bsplayer254.1038_clip.exe
    C:\Documents and Settings\Derek\My Documents\Derek Docs\Set Up + Driver Files\Nero-7.10.1.0_eng_update.incl.keygen\Nero-7.10.1.0_eng_update.exe
    C:\Documents and Settings\Derek\My Documents\Downloads\RegistryEasy.exe
    C:\Program Files\Registry Easy\RE.exe 
    C:\Program Files\Registry Easy\Recoveryer.dll 
    c:\documents and settings\derek\my documents\derek docs\set up + driver files\nero-7.10.1.0_eng_update.incl.keygen\keygen.exe
    
    :Commands
    [emptytemp]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )



Also tell me how the computer is running now.
OTL log… All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\Documents and Settings\Derek\My Documents\Derek Docs\Set Up + Driver Files\install_bsplayer254.1038_clip.exe moved successfully. C:\Documents and Settings\Derek\My Documents\Derek Docs\Set Up + Driver Files\Nero-7.10.1.0_eng_update.incl.keygen\Nero-7.10.1.0_eng_update.exe moved successfully. C:\Documents and Settings\Derek\My Documents\Downloads\RegistryEasy.exe moved successfully. C:\Program Files\Registry Easy\RE.exe moved successfully. C:\Program Files\Registry Easy\Recoveryer.dll moved successfully. c:\documents and settings\derek\my documents\derek docs\set up + driver files\nero-7.10.1.0_eng_update.incl.keygen\Keygen.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes User: Derek ->Temp folder emptied: 917504 bytes ->Temporary Internet Files folder emptied: 359645 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 110134412 bytes ->Flash cache emptied: 8268 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 409734 bytes ->Java cache emptied: 14 bytes ->Flash cache emptied: 9998 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 2162822 bytes ->Java cache emptied: 12 bytes ->Flash cache emptied: 12892 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1099811 bytes %systemroot%\System32 .tmp files removed: 5670913 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 115.00 mb OTL by OldTimer - Version 3.2.17.1 log created on 11022010_083209 Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot… Many many thanks Mowman , iv been calling you.. 'Ma' Man' :lol: Computer has been running as smooth and stable as i can ever remember,it seemed to recover somewhat after running the unhooker prog, all the scans and fixes since have certainly helped too….i doubted a recovery was possible, its now shutting down and booting up fine,virus warnings and system hangs are all gone, running slick and fast.. :thumbup: not sure if we're all done , but i'll certainly recommend this forum,you guys know your stuff. :notworthy:
You now appear clean of infections,your computer is badly in need of updates so make sure you follow the instructions below,especially visit the Microsoft updates to get service pack 3 and update Internet explorer.



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)









Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.






[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 22 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 22 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u22 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u22-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.






Your Adobe reader is out of date,it can be updated here






Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing
Thanks again fella,PC and system was neglected as teen kids took it over will follow the guidelines and get updated , will install zonealarm firewall also

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI