Spyware / Malware / Virus Removal

catchme.exe TROJ Generic.AD

21 min read

Looking for the outcome? Ask AI

wd4ngi-2 Topic Starter

Post #1October 27, 2010, 2:34 AM UTC

Hello, I ran Housecall online scaner last night to see what I had that was causing my AVG 9.0 program to be disabled. All aspects of this program have stopped working. I also noticed that I can not do a system recovery on any dates. Here is what Housecall told me it found and fixed: catchme.exe TROJ Generic.ADV Trojan NirCmd.exe HKTL NIRCMD Spyware ASR_72~1.EXE WORM KOLABC.GB Trojan When I try to disconnect from my dialup internet it will not allow me to. I have to shut down the computer. Can someone please help guide me thru some troubleshooting with your neat tools. Last time I had problems was back in 2007 when I was registered under my old username: wd4ngi. I could not find my password nor do I have the former associated e-mail account with that username. Your help greatly appreciated! Respectfully, Tom

CatByte

Post #2October 28, 2010, 12:28 AM UTC

Hi

Please do the following:

Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

NEXT

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

Scan With RootKitUnHooker

Please Download Rootkit Unhooker and save it to your desktop.
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

wd4ngi-2

Post #3October 28, 2010, 8:33 PM UTC

Hello CatByte,

Thanks for your quick responce. I had no problems downloading and running the applications you recommended and I have saved the logs and will post them to the end of this paragraph. I wanted to give you a little more input at this time. I keep my computer off unless I need it. I downloaded the files on another computer and brought them over to the infected computer with a thumb drive. I notice when my computer started up and settled down that a new program appeared and opened without my permission. This program was called "Narrator" It actually spoke to me. I simply closed it. What do you suppose this is?

Okay, here are those log files. I await your next instruction. It might be tomorrow or Saturday before my next posting. I have a lot of other things going on here. Hope to hear from you soon.

God Bless,

Thomas

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x000003fd

Kernel Drivers (total 138):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FD000 \WINDOWS\system32\hal.dll
0xF8A36000 \WINDOWS\system32\KDCOM.DLL
0xF8946000 \WINDOWS\system32\BOOTVID.dll
0xF84E7000 ACPI.sys
0xF8A38000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF84D6000 pci.sys
0xF8536000 isapnp.sys
0xF8546000 ohci1394.sys
0xF8556000 \WINDOWS\System32\DRIVERS\1394BUS.SYS
0xF8AFE000 pciide.sys
0xF87B6000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8A3A000 intelide.sys
0xF8566000 MountMgr.sys
0xF84B7000 ftdisk.sys
0xF87BE000 PartMgr.sys
0xF8576000 VolSnap.sys
0xF849F000 atapi.sys
0xF8586000 disk.sys
0xF8596000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF847F000 fltmgr.sys
0xF846D000 sr.sys
0xF87C6000 PxHelp20.sys
0xF894A000 bsstor.sys
0xF8456000 KSecDD.sys
0xF8443000 WudfPf.sys
0xF83B6000 Ntfs.sys
0xF8389000 NDIS.sys
0xF836E000 Mup.sys
0xF85A6000 avgrkx86.sys
0xF85B6000 AVGIDSxx.sys
0xF85C6000 agp440.sys
0xF8756000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF7CA9000 \SystemRoot\System32\DRIVERS\ati2mtag.sys
0xF7C95000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF888E000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF7C72000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF8896000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF7BB8000 \SystemRoot\System32\DRIVERS\smrt.sys
0xF8776000 \SystemRoot\System32\DRIVERS\STREAM.SYS
0xF7B95000 \SystemRoot\System32\DRIVERS\ks.sys
0xF8786000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF889E000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF8796000 \SystemRoot\System32\Drivers\PGPsdk.sys
0xF8906000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF890E000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF7B81000 \SystemRoot\System32\DRIVERS\parport.sys
0xF8626000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF7B6B000 \SystemRoot\System32\Drivers\AnyDVD.sys
0xF8A2A000 \SystemRoot\system32\drivers\pfc.sys
0xF8636000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS
0xF8646000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF8656000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF8916000 \SystemRoot\system32\drivers\GEARAspiWDM.sys
0xF7ADD000 \SystemRoot\system32\drivers\smwdm.sys
0xF7AB9000 \SystemRoot\system32\drivers\portcls.sys
0xF7E00000 \SystemRoot\system32\drivers\drmk.sys
0xF8AA4000 \SystemRoot\system32\drivers\aeaudio.sys
0xF7983000 \SystemRoot\System32\DRIVERS\AGRSM.sys
0xF891E000 \SystemRoot\System32\Drivers\Modem.SYS
0xF8926000 \SystemRoot\system32\DRIVERS\avgfwdx.sys
0xF8C18000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF7DA0000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF833E000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF796C000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF7D90000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF7D80000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF892E000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF7933000 \SystemRoot\System32\DRIVERS\psched.sys
0xF7D70000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF8936000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF893E000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF87D6000 \SystemRoot\System32\Drivers\Pcouffin.sys
0xF8676000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF8ABA000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF78DA000 \SystemRoot\System32\DRIVERS\update.sys
0xF8336000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF86A6000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF86E6000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF8AC8000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF8806000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF8816000 \SystemRoot\System32\Drivers\Cdralw2k.SYS
0xF8AE0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8C75000 \SystemRoot\System32\Drivers\Null.SYS
0xF8AE2000 \SystemRoot\System32\Drivers\Beep.SYS
0xF881E000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF8826000 \SystemRoot\System32\drivers\vga.sys
0xF8AE4000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8AE6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF882E000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8836000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8A12000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xB6FA5000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xB6F4D000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xB6F13000 \SystemRoot\System32\Drivers\avgtdix.sys
0xF8706000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xB6EF2000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xB6ECA000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF7960000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xB6EA8000 \SystemRoot\System32\drivers\afd.sys
0xF8716000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF8746000 \SystemRoot\System32\drivers\sdcplh.sys
0xB6E7D000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xB6E0E000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF8B16000 \SystemRoot\System32\Drivers\hwinterface.sys
0xF8766000 \SystemRoot\System32\Drivers\Fips.SYS
0xF8846000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0xF8B18000 \SystemRoot\System32\DRIVERS\DMICall.sys
0xF884E000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB6DB2000 \SystemRoot\System32\Drivers\avgldx86.sys
0xF7954000 \SystemRoot\System32\DRIVERS\hidusb.sys
0xF87A6000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
0xF885E000 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
0xF7948000 \SystemRoot\System32\DRIVERS\kbdhid.sys
0xF8616000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB6D9A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8A52000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF8A06000 \SystemRoot\System32\drivers\Dxapi.sys
0xF88A6000 \SystemRoot\System32\watchdog.sys
0xBF9C3000 \SystemRoot\System32\drivers\dxg.sys
0xF8C35000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D5000 \SystemRoot\System32\ati2dvag.dll
0xBFA0B000 \SystemRoot\System32\ati2cqag.dll
0xBFA43000 \SystemRoot\System32\ati3duag.dll
0xBFC11000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB6C72000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB6A26000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF8A7E000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB69D4000 \SystemRoot\System32\Drivers\PGPdisk.SYS
0xB686A000 \SystemRoot\System32\DRIVERS\srv.sys
0xB62DD000 \SystemRoot\system32\drivers\wdmaud.sys
0xB636A000 \SystemRoot\system32\drivers\sysaudio.sys
0xB628F000 \SystemRoot\system32\drivers\kmixer.sys
0xB563A000 \SystemRoot\System32\Drivers\HTTP.sys
0xB5269000 \SystemRoot\System32\Drivers\Fastfat.SYS
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 44):
0 System Idle Process
4 System
500 C:\WINDOWS\system32\smss.exe
556 csrss.exe
580 C:\WINDOWS\system32\winlogon.exe
624 C:\WINDOWS\system32\services.exe
636 C:\WINDOWS\system32\lsass.exe
792 C:\WINDOWS\system32\svchost.exe
904 svchost.exe
944 C:\WINDOWS\system32\svchost.exe
984 C:\WINDOWS\system32\svchost.exe
1040 svchost.exe
1152 C:\WINDOWS\system32\spoolsv.exe
1192 D:\Program Files\AVG\AVG9\avgchsvx.exe
1260 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1276 C:\Program Files\Bonjour\mDNSResponder.exe
1288 C:\WINDOWS\system32\CTSVCCDA.EXE
1332 D:\Program Files\AVG\AVG9\avgrsx.exe
1364 C:\Program Files\Sony\giga pocket\shwserv.exe
1468 C:\WINDOWS\system32\PGPsdkServ.exe
1492 D:\Program Files\AVG\AVG9\avgcsrvx.exe
1604 C:\WINDOWS\system32\svchost.exe
1628 C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
552 C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
756 C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
848 C:\Program Files\Sony\giga pocket\RM_SV.exe
864 alg.exe
2668 C:\WINDOWS\explorer.exe
2864 C:\WINDOWS\system32\LVCOMSX.EXE
2876 C:\Program Files\Logitech\Video\LogiTray.exe
2924 C:\WINDOWS\system32\ezSP_Px.exe
2940 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
2968 C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
2972 C:\WINDOWS\AGRSMMSG.exe
2984 D:\PROGRA~1\AVG\AVG9\avgtray.exe
3004 D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
3024 C:\Program Files\iTunes\iTunesHelper.exe
3036 C:\WINDOWS\system32\ctfmon.exe
3060 C:\Program Files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe
3296 C:\Program Files\Logitech\Video\FxSvr2.exe
3612 D:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
3716 C:\Program Files\iPod\bin\iPodService.exe
3984 wmiprvse.exe
1836 C:\Documents and Settings\Thomas\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000001`40a21c00 (NTFS)
\\.\D: –> \\.\PhysicalDrive0 at offset 0x00000004`bee0da00 (NTFS)

PhysicalDrive0 Model Number: ST3120022A, Rev: 3.04

Size Device Name MBR Status
——————————————–
111 GB \\.\PhysicalDrive0 Windows 98 MBR code detected
SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E

Done!

DDS (Ver_10-10-21.02) - NTFSx86
Run by [removed] at 16:00:48.28 on Thu 10/28/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_03
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.79 [GMT -4:00]

AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
D:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\sony\giga pocket\shwserv.exe
C:\WINDOWS\System32\PGPsdkServ.exe
D:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\giga pocket\RM_SV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\WINDOWS\AGRSMMSG.exe
D:\PROGRA~1\AVG\AVG9\avgtray.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
D:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Thomas\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSearch Page =
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant =
mSearchAssistant =
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - d:\program files\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - d:\program files\avg\avg9\toolbar\IEToolbar.dll
mWinlogon: SFCDisable=-99 (0xffffff9d)
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - d:\progra~1\arcsoft\mediac~1\intern~1\ARCURL~1.DLL
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - d:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - d:\progra~1\micros~1\office12\GRA8E1~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - d:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - d:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: &Google;: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: &Yahoo;! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes0521.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [SetDefPrt] c:\program files\brother\brmfl06a\BrStDvPt.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [AVG9_TRAY] d:\progra~1\avg\avg9\avgtray.exe
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [GrooveMonitor] "d:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRunServices: [RegisterDropHandler] d:\progra~1\textbr~1.0\bin\REGIST~1.EXE
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mbcame~1.lnk - c:\program files\pixela\everio mediabrowser\MBCameraMonitor.exe
IE: &AOL; Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
IE: &Search; - http://bar.mywebsearch.com/menusearch.html…4YYUS_undefined
IE: &Yahoo;! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport; to Microsoft Excel - d:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary; - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps; - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: {6224f700-cba3-4071-b251-47cb894244cd} - c:\program files\icq\ICQ.exe
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - d:\program files\netscape\communicator\program\aim\aim.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {2499216C-4BA5-11D5-BD9C-000103C116D5} - {2499216C-4BA5-11D5-BD9C-000103C116D5} - c:\program files\yahoo!\common\ylogin.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - d:\progra~1\micros~1\office12\ONBttnIE.dll
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922}
IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD} - c:\program files\yahoo!\messenger\yhexbmes0521.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: ameritrade.com
Trusted Zone: ameritrade.com\wwws
Trusted Zone: tdameritrade.com
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} - hxxp://housecall60.trendmicro.com/housecall/xscan60.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188838937140
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1190320069281
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - d:\progra~1\micros~1\office12\GR99D3~1.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - d:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - d:\progra~1\micros~1\office12\GRA8E1~1.DLL
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\thomas\applic~1\mozilla\firefox\profiles\5n36y971.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: d:\program files\arcsoft\media converter for philips\internet video downloader\plugin_firefox\components\nsURLRecordEx.dll
FF - plugin: c:\documents and settings\thomas\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npaudio.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npavi32.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npbeatnk.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npdrmv2.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npdsplay.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npnul32.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\NPOFF12.DLL
FF - plugin: d:\program files\netscape\communicator\program\plugins\NPOFF12.DLL
FF - plugin: d:\program files\netscape\communicator\program\plugins\nppdf32.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npqtplugin.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npqtplugin2.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npqtplugin3.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npqtplugin4.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\NPSVG3.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\NPSWF32.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\nptgeqplugin.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npwmsdrm.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npwthost.dll
FF - plugin: d:\program files\netscape\communicator\program\plugins\npwtplug.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

============= SERVICES / DRIVERS ===============

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-3-18 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-3-18 52872]
R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2004-1-8 9344]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-3-18 216400]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-3-18 29584]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-3-18 243024]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2006-2-23 3026]
R2 PGPsdkServ;PGPsdkService;c:\windows\system32\PGPsdkServ.exe [2004-2-15 65536]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-3-18 30104]
S2 Ca533av;V3345 Video Device;c:\windows\system32\drivers\ca533av.sys –> c:\windows\system32\drivers\Ca533av.sys [?]
S2 GEARSecurity_BackUp;GEARSecurity_BackUp;system32\gearsec.exe –> system32\gearsec.exe [?]
S2 mrtRate;mrtRate; [x]
S3 11d62222-a0f8-4f2a-bfae-dc1d753e7764;11d62222-a0f8-4f2a-bfae-dc1d753e7764;\??\f:\cds300\cds300.dll –> f:\cds300\cds300.dll [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-3-18 30104]
S3 AVGIDSDriverxpx;AVG9IDSDriver;d:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-3-18 122448]
S3 AVGIDSFilterxpx;AVG9IDSFilter;d:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-3-18 30288]
S3 AVGIDSShimxpx;AVG9IDSShim;d:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-3-18 26192]
S3 GearAspiWDM_BackUp;GEARAspiWDM;c:\windows\system32\drivers\GEARAspiWDM.sys [2005-2-2 26600]
S4 aawservice;Ad-Aware 2007 Service;d:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-9-25 587096]
S4 AloPar;AloPar;c:\windows\system32\drivers\AloPar.sys [2003-12-19 5056]
S4 avg9wd;AVG WatchDog;d:\program files\avg\avg9\avgwdsvc.exe [2010-9-9 308136]
S4 avgfws9;AVG Firewall;d:\program files\avg\avg9\avgfws9.exe [2010-9-9 2331032]
S4 AVGIDSAgent;AVG9IDSAgent;d:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-9-9 5897808]
S4 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2004-1-8 364800]

=============== Created Last 30 ================

2010-10-25 22:52:08 ——– d—–w- c:\program files\iPod
2010-10-25 22:51:34 ——– d—–w- c:\program files\iTunes
2010-10-25 22:51:34 ——– d—–w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-10-25 22:49:57 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll
2010-10-25 22:49:57 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll
2010-10-25 22:49:57 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin7.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin6.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin5.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin4.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin3.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin2.dll
2010-10-25 22:49:56 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin.dll
2010-10-25 22:47:48 1409 —-a-w- c:\windows\QTFont.for
2010-10-25 22:46:53 ——– d—–w- c:\docume~1\thomas\locals~1\applic~1\Apple
2010-10-25 22:45:56 ——– d—–w- c:\program files\Bonjour
2010-10-23 01:41:50 56068 —-a-w- c:\windows\system32\asr_24365.exe

==================== Find3M ====================

2010-09-10 01:54:29 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-09-08 15:17:46 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 15:17:46 69632 —-a-w- c:\windows\system32\QuickTime.qts

============= FINISH: 16:02:12.78 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-21.02)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 12/13/2003 11:30:04 AM
System Uptime: 10/28/2010 3:50:30 PM (1 hours ago)

Motherboard: ASUSTek Computer Inc. | | P4SD-VX
Processor: Intel® Pentium® 4 CPU 2.80GHz | CPU 1 | 2793/200mhz
Processor: Intel® Pentium® 4 CPU 2.80GHz | CPU 1 | 2793/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 14 GiB total, 0.724 GiB free.
D: is FIXED (NTFS) - 93 GiB total, 12.131 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel® PRO/100 VE Network Connection
Device ID: PCI\VEN_8086&DEV;_1050&SUBSYS;_815C104D&REV;_02\4&2E98101C&0&40F0
Manufacturer: Intel
Name: Intel® PRO/100 VE Network Connection
PNP Device ID: PCI\VEN_8086&DEV;_1050&SUBSYS;_815C104D&REV;_02\4&2E98101C&0&40F0
Service: E100B

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\17D1CB48004603
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\17D1CB48004603
Service: NIC1394

==== System Restore Points ===================

RP508: 10/8/2010 11:42:38 AM - System Checkpoint
RP509: 10/9/2010 2:47:37 PM - System Checkpoint
RP510: 10/10/2010 4:31:55 PM - System Checkpoint
RP511: 10/11/2010 4:40:40 PM - System Checkpoint
RP512: 10/12/2010 9:49:18 PM - System Checkpoint
RP513: 10/13/2010 9:52:59 PM - System Checkpoint
RP514: 10/14/2010 9:54:24 PM - System Checkpoint
RP515: 10/16/2010 10:19:06 AM - System Checkpoint
RP516: 10/18/2010 9:51:40 AM - System Checkpoint
RP517: 10/21/2010 4:09:20 PM - System Checkpoint
RP518: 10/22/2010 5:48:22 PM - System Checkpoint
RP519: 10/23/2010 6:09:14 PM - System Checkpoint
RP520: 10/25/2010 6:13:43 AM - System Checkpoint
RP521: 10/25/2010 6:51:07 PM - Installed iTunes
RP522: 10/26/2010 7:07:39 PM - Restore Operation
RP523: 10/26/2010 7:14:19 PM - Restore Operation
RP524: 10/26/2010 7:35:23 PM - Restore Operation

==== Installed Programs ======================

3D Flash Animator 3.72
Absolute Fretboard Trainer PRO
Ad-Aware 2007
Ad-aware Plus 5.83
Adobe Acrobat 5.0
Adobe Dimensions 3.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.1.0
Adobe SVG Viewer 3.0
Age of Empires II
Agere Systems AC'97 Modem
Ahead ImageDrive
AnyDVD
AOL Instant Messenger
AOL Setup
AOL Toolbar 2.0
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AT&T; Worldnet Setup
ATI Control Panel
ATI Display Driver
AVG 9.0
Bonjour
Brother MFL-Pro Suite
Caere Scan Manager 4.0
Cakewalk Audio Finder Tool
Cakewalk Guitar Tracks 2.0
Canasis Games (Jul 12 2006)
Chickenfoot
CHMOD 2.0
Click to DVD 1.3
Cool Edit Pro v1.2
Creative Jukebox Driver
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen Micro
DigiPan
Digital Camera Driver
Digital Photo Navigator 1.5
Drag'n Drop CD+DVD
Drag and Drop Drummer Lite
DrawPlus 3.0
DVD-CLONER V7.10 Build 992
DVD Copy Plus
DVD Decrypter (Remove Only)
DVD Shrink 3.1.7
DVDx 2.0
DVDXCopy 1.2.2 b628 (remove only)
DVDXCopy Xpress 2.0.1
DVgate Plus
EarthLink Setup
Eudora Light 3.0.2
Everio MediaBrowser
EZ-Split
FaxTools
Fontographer 4.1
GenEdit
Giga Pocket 5.5
Giga Pocket Demo Movie
Giga Pocket Hardware Library 5.5
GoGear ARIA Device Manager
Google Chrome
Google SketchUp 8
Google Toolbar for Internet Explorer
Guitar Pro 3.0
Guitar Pro 4.0
Guitar Studio
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hoyle Card Games 2007
ICQ
iISystem Wiper 2.4.1
Image Transfer
ImageMixer for Sony
InCD (Ahead Software)
InCD EasyWrite Reader (Ahead Software)
Intel® Extreme Graphics Driver
Intel® PRO Network Adapters and Drivers
iTunes
J2SE Runtime Environment 5.0 Update 6
Java™ 6 Update 3
Joy of Cooking
Kaspersky Online Scanner
KaZaA Lite 1.7.2
List Magic v1.0
Logger32 Ver 2.6
Logitech Desktop Messenger
Logitech Print Service
Logitech QuickCam Software
Logitech® Camera Driver
Macromedia Director MX
Macromedia Dreamweaver MX
Macromedia Extension Manager
Macromedia Fireworks MX
Macromedia Flash MX
Macromedia FreeHand 10
MailWasher Pro
MasterCook 5: The Best of MasterCook
MathType 5
Media Converter for Philips
Memory Stick Formatter
Mexican Train
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Learning and Research Plus Support Files
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Picture It! Express 7.0
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.52
Microsoft Works 7.0
mIRC
MixW 2.16b7
MoodLogic
Mozilla Firefox (3.6)
MP3 CD Maker
MPAction Rip'n'Coder
MSN Internet Software
MSN Messenger 5.0
MSXML 6.0 Parser (KB933579)
Music Visualizer Library 1.4.00
MyITLab ActiveX Installer 2, 9, 8, 65535
MySpaceIM
Nero 6 Ultra Edition
Nero Mega Plugin Pack
NeroMIX
NeroVision Express 2
Netscape (7.02)
Netscape Communicator 4.79
NexENCODE Studio v3.0
NVIDIA Windows 2000/XP Display Drivers
OLYMPUS CAMEDIA Master 4.1
OmniPage Pro 9.0
OpenMG Limited Patch 3.2-03-02-21-08
OpenMG Limited Patch 3.2-03-03-18-01
OpenMG Limited Patch 3.2-03-04-14-02
OpenMG Secure Module 3.2
PaperPort
PGP 5.0
PGP 8.0.3
PictureGear Studio 2.0
PowerCDR Express
PowerDVD
PureVoice 1.0
Quicken 2003 New User Edition
QuickTime
Radioshack USB-to-Serial cable
RealOne Player
Scrolling LED Bitmap Generator
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Shockwave
Small Business Expert
SmartForce Player
SmartSound Quicktracks Plugin
SonicStage 1.6.00
Sony Certificate PCH
Sony on Yahoo! Essentials
Sony USB Driver
Sony Video Shared Library
SpamSource.3
Spybot - Search & Destroy
SpywareBlaster 4.2
TextBridge Pro 8.0
The Print Shop
The Print Shop Multimedia Organizer
The Print Shop Photo Pro
Turbo Tax Offer
Ulead COOL 3D 3.5 Trial
Ulead VideoStudio 9.0 SE
UnzipThemAll 1.3
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
VAIO BrightColor Wallpaper
VAIO Help and Support
VAIO Media 2.6
VAIO Media Integrated Server 2.6
VAIO Media Redistribution 2.6
VAIO Registration
VAIO Remote Commander Utility 6.1
VAIO Survey Standalone
VAIO System Information
VideoLAN VLC media player 0.8.6f
Virtuosa
W1SQLPSK
WebFldrs XP
Welcome to VAIO life
Windows Communication Foundation
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 9 Hotfix [See KB885492 for more information]
Windows Presentation Foundation
Windows Workflow Foundation
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
WinXP Manager
WinZip
XML Paper Specification Shared Components Pack 1.0
XviD MPEG-4 Codec
Yahoo! extras
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Login
Yahoo! Messenger
Yahoo! Messenger Explorer Bar
Yahoo! Software Update
Yahoo! Toolbar
Zipeg

==== Event Viewer Messages From Past Week ========

10/28/2010 3:58:10 PM, error: Service Control Manager [7016] - The GEARSecurity_BackUp service has reported an invalid current state 0.
10/23/2010 2:45:03 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service YahooAUService with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}
10/23/2010 2:41:18 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service YahooAUService with arguments "" in order to run the server: {3D369E3A-9EDF-46C4-B4BC-47BF3304BF7C}
10/23/2010 2:35:45 PM, error: Service Control Manager [7000] - The V3345 Video Device service failed to start due to the following error: The system cannot find the file specified.
10/23/2010 2:35:45 PM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
10/22/2010 6:37:18 PM, error: Service Control Manager [7034] - The ArcSoft Connect Daemon service terminated unexpectedly. It has done this 1 time(s).

==== End Of File ===========================

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 2)
Number of processors #2
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2252800 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2252800 bytes
0x804D7000 RAW 2252800 bytes
0x804D7000 WMIxWDM 2252800 bytes
0xBFA43000 C:\WINDOWS\System32\ati3duag.dll 1892352 bytes (ATI Technologies Inc. , ati3duag.dll)
0xBF800000 Win32k 1847296 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1847296 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF7983000 C:\WINDOWS\System32\DRIVERS\AGRSM.sys 1269760 bytes (Agere Systems, SoftModem Device Driver)
0xF7CA9000 C:\WINDOWS\System32\DRIVERS\ati2mtag.sys 815104 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)
0xF7BB8000 C:\WINDOWS\System32\DRIVERS\smrt.sys 761856 bytes (Sony Corporation, Sony MPEG RealTime encoder board)
0xF7ADD000 C:\WINDOWS\system32\drivers\smwdm.sys 581632 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
0xF83B6000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xBFC11000 C:\WINDOWS\System32\ativvaxx.dll 520192 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)
0xB6E0E000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 454656 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF78DA000 C:\WINDOWS\System32\DRIVERS\update.sys 364544 bytes (Microsoft Corporation, Update Driver)
0xB6F4D000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 360448 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xB686A000 C:\WINDOWS\System32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xB563A000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xB6F13000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0xBFA0B000 C:\WINDOWS\System32\ati2cqag.dll 229376 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)
0xBF9D5000 C:\WINDOWS\System32\ati2dvag.dll 221184 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)
0xB6DB2000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0xF84E7000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xF8389000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB6A26000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 180224 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB523E000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xB6E7D000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB69D4000 C:\WINDOWS\System32\Drivers\PGPdisk.SYS 172032 bytes (PGP Corporation, PGPdisk NT/Win2k driver)
0xB6ECA000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF7AB9000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB5269000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 143360 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xF7B95000 C:\WINDOWS\System32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF7C72000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 143360 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB6EA8000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xB6EF2000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 135168 bytes (Microsoft Corporation, IP Network Address Translator)
0x806FD000 ACPI_HAL 134400 bytes
0x806FD000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF847F000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF84B7000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF836E000 Mup.sys 110592 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF849F000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xB6D9A000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF8456000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF796C000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xF7B6B000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 90112 bytes (SlySoft, Inc., AnyDVD Filter Driver)
0xB62DD000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF7B81000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF7C95000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xB6FA5000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xF8443000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBF9C3000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF846D000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF84D6000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF7933000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF8616000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF8636000 C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS 61440 bytes (Roxio, CDR4_XP CDR Helper)
0xF7E00000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF8546000 ohci1394.sys 61440 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xF8656000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xB636A000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF86E6000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF8556000 C:\WINDOWS\System32\DRIVERS\1394BUS.SYS 53248 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xF8646000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 53248 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF8596000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF8786000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF7DA0000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF8576000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF85A6000 avgrkx86.sys 49152 bytes (AVG Technologies CZ, s.r.o., AVG Anti-Rootkit Driver)
0xF7D80000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF8776000 C:\WINDOWS\System32\DRIVERS\STREAM.SYS 49152 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0)
0xF85C6000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xF8626000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF8566000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF8796000 C:\WINDOWS\System32\Drivers\PGPsdk.sys 45056 bytes (PGP Corporation, PGP Software Development Kit NT Driver)
0xF7D90000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF86A6000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF8746000 C:\WINDOWS\System32\drivers\sdcplh.sys 40960 bytes (-, SDCPLH)
0xF8676000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF85B6000 AVGIDSxx.sys 36864 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Helper Driver.)
0xF8586000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF8766000 C:\WINDOWS\System32\Drivers\Fips.SYS 36864 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF87A6000 C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF8756000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF8536000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF7D70000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF8716000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xB5F24000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF8706000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF891E000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xF8836000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF87D6000 C:\WINDOWS\System32\Drivers\Pcouffin.sys 32768 bytes (VSO Software, Patin-Couffin low level access layer for CD devices)
0xF8926000 C:\WINDOWS\system32\DRIVERS\avgfwdx.sys 28672 bytes (AVG Technologies CZ, s.r.o., AVG Firewall intermediate miniport driver)
0xF890E000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xF881E000 C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF87B6000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF8896000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 28672 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF885E000 C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xF884E000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0xF8816000 C:\WINDOWS\System32\Drivers\Cdralw2k.SYS 24576 bytes (Roxio, CDRAL for Windows 2000 Kernel Driver)
0xF8916000 C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xF889E000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF8906000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF8826000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF8846000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 20480 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)
0xF8806000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xF882E000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF87BE000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF8936000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF87C6000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF893E000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF892E000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF888E000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 20480 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF88A6000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF7948000 C:\WINDOWS\System32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF8336000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xB6C72000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF8946000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF894A000 bsstor.sys 12288 bytes (B.H.A Co.,Ltd., B.H.A Storage Helper Driver (WindowsNT5.x))
0xF8A06000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF7954000 C:\WINDOWS\System32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF833E000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF8A2A000 C:\WINDOWS\system32\drivers\pfc.sys 12288 bytes (Padus, Inc., Padus® ASPI Shell)
0xF8A12000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7960000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)
0xF8AA4000 C:\WINDOWS\system32\drivers\aeaudio.sys 8192 bytes (Andrea Electronics Corporation, Andrea Audio Stub Driver)
0xF8AE2000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF8A52000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF8AE0000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF8A3A000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF8A36000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF8AE4000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF8A7E000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF8AE6000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF8ABA000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF8AC8000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF8A38000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF8C18000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF8B18000 C:\WINDOWS\System32\DRIVERS\DMICall.sys 4096 bytes (Sony Corporation, Windows 2000 DMI Call Kernel Driver)
0xF8C35000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF8B16000 C:\WINDOWS\System32\Drivers\hwinterface.sys 4096 bytes (Logix4u, hwinterface.sys)
0xF8C75000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF8AFE000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x824B6580 ] TID: 108
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824ACDA8 ] TID: 132
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824ACB30 ] TID: 136
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x824ABBA0 ] TID: 144
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x824BC4B8 ] TID: 152
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824D36A8 ] TID: 160
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824AC4A8 ] TID: 172
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824B19C0 ] TID: 180
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x824A96F8 ] TID: 184
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x824A8998 ] TID: 188
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824EBDA8 ] TID: 196
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x824B3B30 ] TID: 204
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x824B6998 ] TID: 212, 8781826 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824A4DA8 ] TID: 224
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824B7020 ] TID: 228, 8781828 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824C6020 ] TID: 232
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82ED2DA8 ] TID: 320, 8781829 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824CAAE0 ] TID: 392
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824A58E8 ] TID: 400
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824B4980 ] TID: 404
0x80561500 Faked ServiceTable–>smss.exe [ ETHREAD 0x82D1BDA8 ] TID: 504, 8781842 bytes
0x80561500 Faked ServiceTable–>smss.exe [ ETHREAD 0x82CDC4E0 ] TID: 508
0x80561500 Faked ServiceTable–>smss.exe [ ETHREAD 0x82EC4870 ] TID: 512, 8781854 bytes
0x80561500 Faked ServiceTable–>SV_Httpd.exe [ ETHREAD 0x82405C68 ] TID: 560
0x80561500 Faked ServiceTable–>csrss.exe [ ETHREAD 0x82C89020 ] TID: 568
0x80561500 Faked ServiceTable–>csrss.exe [ ETHREAD 0x82C69DA8 ] TID: 576
0x80561500 Faked ServiceTable–>SV_Httpd.exe [ ETHREAD 0x824059F0 ] TID: 600
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x82D61020 ] TID: 612
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x82D612D0 ] TID: 620
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82C56380 ] TID: 648
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82D0CC10 ] TID: 652, 8781862 bytes
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82C8A5E0 ] TID: 656
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82CF1588 ] TID: 660, 8781874 bytes
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82D00DA8 ] TID: 664
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82D00B30 ] TID: 668
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82D008B8 ] TID: 672
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82D00640 ] TID: 676
0x80561500 Faked ServiceTable–>SV_Httpd.exe [ ETHREAD 0x8240C5E8 ] TID: 684
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82E76888 ] TID: 688
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x822BDDA8 ] TID: 696
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82CA6020 ] TID: 712
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82CC9BA0 ] TID: 724
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82D01998 ] TID: 728
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x82C8C7B0 ] TID: 736
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x825BFBA0 ] TID: 740
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x825BF928 ] TID: 744
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x825BD970 ] TID: 748
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82C72600 ] TID: 772
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82D15DA8 ] TID: 780
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82C7F740 ] TID: 784
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x825CBDA8 ] TID: 788
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x825BCC90 ] TID: 804
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x82459DA8 ] TID: 828
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825B9B30 ] TID: 868
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82D8ADA8 ] TID: 872
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82D8AB30 ] TID: 876
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x825B2DA8 ] TID: 888
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x823E2DA8 ] TID: 892
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825A7998 ] TID: 912
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825B2928 ] TID: 916
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825B26B0 ] TID: 920
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825C99A0 ] TID: 924
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825ABC08 ] TID: 936
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x827B3550 ] TID: 940
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825A0DA8 ] TID: 952
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82599998 ] TID: 956
0x80561500 Faked ServiceTable–>alg.exe [ ETHREAD 0x824004C0 ] TID: 964
0x80561500 Faked ServiceTable–>alg.exe [ ETHREAD 0x8245EBA0 ] TID: 972
0x80561500 Faked ServiceTable–>alg.exe [ ETHREAD 0x82457790 ] TID: 992
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8259DBA0 ] TID: 1000
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82E779F0 ] TID: 1008
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82CF6D50 ] TID: 1012
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82CF6AD8 ] TID: 1016
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82CF6860 ] TID: 1020
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825A15A0 ] TID: 1024
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825B3798 ] TID: 1028
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825A36C0 ] TID: 1032
0x80561500 Faked ServiceTable–>alg.exe [ ETHREAD 0x8245FDA8 ] TID: 1036
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8258A790 ] TID: 1048
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8259D928 ] TID: 1056, 7536686 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82587670 ] TID: 1072
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8258A518 ] TID: 1088, 34209795 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x825928B8 ] TID: 1136
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8258BDA8 ] TID: 1148, 7012467 bytes
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x825757A8 ] TID: 1168
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x82575530 ] TID: 1172, 6094931 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82576998 ] TID: 1188
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82575DA8 ] TID: 1200, 50 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82578360 ] TID: 1204
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82583728 ] TID: 1240
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8256C790 ] TID: 1248
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8256C518 ] TID: 1252, 7471172 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82567DA8 ] TID: 1256
0x80561500 Faked ServiceTable–>shwserv.exe [ ETHREAD 0x8244E720 ] TID: 1268
0x80561500 Faked ServiceTable–>CTSVCCDA.EXE [ ETHREAD 0x8255BBA0 ] TID: 1300
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82573B28 ] TID: 1308
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8255D588 ] TID: 1324
0x80561500 Faked ServiceTable–>AppleMobileDeviceService.exe [ ETHREAD 0x82577748 ] TID: 1328
0x80561500 Faked ServiceTable–>AppleMobileDeviceService.exe [ ETHREAD 0x82579BA0 ] TID: 1336
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82552BA0 ] TID: 1340
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82556720 ] TID: 1348
0x80561500 Faked ServiceTable–>mDNSResponder.exe [ ETHREAD 0x82556478 ] TID: 1352
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x82559DA8 ] TID: 1372
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x82547020 ] TID: 1376
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x82547DA8 ] TID: 1380
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x82539020 ] TID: 1404
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x8253E020 ] TID: 1408
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x8254F020 ] TID: 1412
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x8255AC80 ] TID: 1416
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x82563BB8 ] TID: 1420
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8253CBA0 ] TID: 1432
0x80561500 Faked ServiceTable–>GPVSvr.exe [ ETHREAD 0x823FCDA8 ] TID: 1444
0x80561500 Faked ServiceTable–>shwserv.exe [ ETHREAD 0x8245BBA8 ] TID: 1464, 7929971 bytes
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x82521020 ] TID: 1480
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x82557AD8 ] TID: 1484
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82541DA8 ] TID: 1488
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x823717C0 ] TID: 1500
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x8251D020 ] TID: 1504
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x823FBDA8 ] TID: 1508
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x825517A8 ] TID: 1512
0x80561500 Faked ServiceTable–>PGPsdkServ.exe [ ETHREAD 0x82518588 ] TID: 1520
0x80561500 Faked ServiceTable–>PGPsdkServ.exe [ ETHREAD 0x82545C10 ] TID: 1532
0x80561500 Faked ServiceTable–>PGPsdkServ.exe [ ETHREAD 0x82521B30 ] TID: 1536
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82541B30 ] TID: 1540
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x82512588 ] TID: 1548
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8250E378 ] TID: 1568
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x825B7790 ] TID: 1580
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82518310 ] TID: 1584
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x82519DA8 ] TID: 1588, 5832787 bytes
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x8254DDA8 ] TID: 1592
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82518BA0 ] TID: 1600
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x825145A0 ] TID: 1612
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82513020 ] TID: 1636
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82513A08 ] TID: 1640
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82517600 ] TID: 1660
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x8250CC10 ] TID: 1668
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824FC380 ] TID: 1688
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82551348 ] TID: 1692
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8250EBA0 ] TID: 1704
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824FFDA8 ] TID: 1724
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x824FFB30 ] TID: 1728
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F2470 ] TID: 1732
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F96F0 ] TID: 1740
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x824FA588 ] TID: 1744
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824E5440 ] TID: 1748
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824D89C8 ] TID: 1752
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F5998 ] TID: 1756
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824DA998 ] TID: 1760
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824DA720 ] TID: 1764
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824DA4A8 ] TID: 1768
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824E2020 ] TID: 1772
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824D9DA8 ] TID: 1776
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x8250A720 ] TID: 1780, 7274612 bytes
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824FC020 ] TID: 1784
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824D9020 ] TID: 1788
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x824D9310 ] TID: 1792
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F2DA8 ] TID: 1796
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824EABA0 ] TID: 1800
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x824E76A8 ] TID: 1804
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F1A58 ] TID: 1808
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x82506DA8 ] TID: 1812
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x82515A98 ] TID: 1816
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F2B30 ] TID: 1820
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824FA020 ] TID: 1824
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x824EA020 ] TID: 1828
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F5DA8 ] TID: 1832
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x824D7310 ] TID: 1840
0x80561500 Faked ServiceTable–>avgcsrvx.exe [ ETHREAD 0x824F0020 ] TID: 1860
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F09E0 ] TID: 1872, 7077996 bytes
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824F0768 ] TID: 1876
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824E5DA8 ] TID: 1880
0x80561500 Faked ServiceTable–>avgrsx.exe [ ETHREAD 0x824E5B30 ] TID: 1884
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824D7998 ] TID: 1892
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C7020 ] TID: 1904
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C7928 ] TID: 1912
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C76B0 ] TID: 1916
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C7438 ] TID: 1920, 6357107 bytes
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C6DA8 ] TID: 1924
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C6928 ] TID: 1928
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C66B0 ] TID: 1932
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C6438 ] TID: 1936
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C5BA0 ] TID: 1940
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C3998 ] TID: 1944
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824D7DA8 ] TID: 1948
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824EF998 ] TID: 1956, 6357101 bytes
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x824C4BA0 ] TID: 1960
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824BBDA8 ] TID: 1964
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824EF720 ] TID: 1972
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8250BBA0 ] TID: 1976
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824BEDA8 ] TID: 1980
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8251EDA8 ] TID: 1988
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824BFDA8 ] TID: 1992
0x80561500 Faked ServiceTable–>spoolsv.exe [ ETHREAD 0x824B44A0 ] TID: 2040, 45 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82402C68 ] TID: 2052
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x824B8020 ] TID: 2064
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8244ADA8 ] TID: 2096
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82463C68 ] TID: 2108
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82461820 ] TID: 2112
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x823FF998 ] TID: 2244
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82409D48 ] TID: 2248
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8244D8F0 ] TID: 2264
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x826DB998 ] TID: 2268
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824068B0 ] TID: 2272
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824515A0 ] TID: 2276
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8245A800 ] TID: 2280
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8244CDA8 ] TID: 2284
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82400DA8 ] TID: 2288
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824778F8 ] TID: 2292
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82460DA8 ] TID: 2296
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x823FEBA0 ] TID: 2304, 7471204 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x822712A0 ] TID: 2312
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82289518 ] TID: 2316
0x80561500 Faked ServiceTable–>FxSvr2.exe [ ETHREAD 0x825AB020 ] TID: 2360
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8244F8B8 ] TID: 2380
0x80561500 Faked ServiceTable–>GPVSvr.exe [ ETHREAD 0x824D17B8 ] TID: 2440
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x823FC8F0 ] TID: 2472
0x80561500 Faked ServiceTable–>csrss.exe [ ETHREAD 0x824E19A0 ] TID: 2476, 56 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82598BA0 ] TID: 2492
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824AD4F8 ] TID: 2532
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x8244C020 ] TID: 2576
0x80561500 Faked ServiceTable–>winlogon.exe [ ETHREAD 0x82598608 ] TID: 2648
0x80561500 Faked ServiceTable–>explorer.exe [ ETHREAD 0x8272BDA8 ] TID: 2712
0x80561500 Faked ServiceTable–>explorer.exe [ ETHREAD 0x824CCDA8 ] TID: 2720
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x826F7720 ] TID: 2780
0x80561500 Faked ServiceTable–>explorer.exe [ ETHREAD 0x82339998 ] TID: 2832
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82754390 ] TID: 2844
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x82700BA0 ] TID: 2904
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x8255F5B0 ] TID: 2908
0x80561500 Faked ServiceTable–>avgchsvx.exe [ ETHREAD 0x823F6788 ] TID: 3100
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x82D31BC8 ] TID: 3116
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x8276BC00 ] TID: 3132
0x80561500 Faked ServiceTable–>LVCOMSX.EXE [ ETHREAD 0x82511708 ] TID: 3140
0x80561500 Faked ServiceTable–>LogiTray.exe [ ETHREAD 0x82492BA0 ] TID: 3152, 7864421 bytes
0x80561500 Faked ServiceTable–>LogiTray.exe [ ETHREAD 0x82EF8948 ] TID: 3160
0x80561500 Faked ServiceTable–>explorer.exe [ ETHREAD 0x824B4020 ] TID: 3200
0x80561500 Faked ServiceTable–>services.exe [ ETHREAD 0x825344B8 ] TID: 3224
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x826FDDA8 ] TID: 3260
0x80561500 Faked ServiceTable–>LVCOMSX.EXE [ ETHREAD 0x824926B0 ] TID: 3276
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82447DA8 ] TID: 3300
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x82447B30 ] TID: 3304
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x824478B8 ] TID: 3308
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x823F5020 ] TID: 3320, 6619239 bytes
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8272E7C8 ] TID: 3324
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x823F56E8 ] TID: 3328
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x823F5398 ] TID: 3340
0x80561500 Faked ServiceTable–>FxSvr2.exe [ ETHREAD 0x823F4BA8 ] TID: 3352
0x80561500 Faked ServiceTable–>explorer.exe [ ETHREAD 0x824379E0 ] TID: 3388, 52 bytes
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x8236A998 ] TID: 3492
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x8257CDA8 ] TID: 3512
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x823674F0 ] TID: 3528
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82364BA0 ] TID: 3532
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x823636A8 ] TID: 3536
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x8225E890 ] TID: 3540
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x8236FDA8 ] TID: 3544
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x8236CDA8 ] TID: 3556
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82323BA8 ] TID: 3560
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x8225BBC8 ] TID: 3564
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82534BA0 ] TID: 3568, 130 bytes
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82367D10 ] TID: 3572, 899792 bytes
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82EEDDA8 ] TID: 3576
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82260948 ] TID: 3584
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x8236B930 ] TID: 3620
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82366930 ] TID: 3628
0x80561500 Faked ServiceTable–>AVGIDSMonitor.exe [ ETHREAD 0x82EF86D0 ] TID: 3640
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82256DA8 ] TID: 3644
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82256B30 ] TID: 3648
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82254DA8 ] TID: 3652
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x82254B30 ] TID: 3656
0x80561500 Faked ServiceTable–>avgtray.exe [ ETHREAD 0x822548B8 ] TID: 3660
0x80561500 Faked ServiceTable–>AVGIDSMonitor.exe [ ETHREAD 0x8235F790 ] TID: 3668
0x80561500 Faked ServiceTable–>AVGIDSMonitor.exe [ ETHREAD 0x823EDBA8 ] TID: 3672
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x8224A548 ] TID: 3684
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x8226C020 ] TID: 3688
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x82354AC0 ] TID: 3700
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x82243B30 ] TID: 3708
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x8223E888 ] TID: 3736
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x82249BC8 ] TID: 3740
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x822267E0 ] TID: 3748
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x8222ABA0 ] TID: 3752
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x8223FBC8 ] TID: 3768
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x8223F950 ] TID: 3772
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x8222B020 ] TID: 3776
0x80561500 Faked ServiceTable–>iPodService.exe [ ETHREAD 0x8222B790 ] TID: 3780
0x80561500 Faked ServiceTable–>iTunesHelper.exe [ ETHREAD 0x82233998 ] TID: 3788
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x821D28D0 ] TID: 3820
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821D2658 ] TID: 3824
0x80561500 Faked ServiceTable–>AppleMobileDeviceService.exe [ ETHREAD 0x821D7230 ] TID: 3828
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821D5BA0 ] TID: 3832
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821C9BD8 ] TID: 3848
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821DCDA8 ] TID: 3852
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821DF020 ] TID: 3856
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x821B6878 ] TID: 3904
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821E44D8 ] TID: 3912
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821C8DA8 ] TID: 3916
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821A7BA0 ] TID: 3920
0x80561500 Faked ServiceTable–>BrccMCtl.exe [ ETHREAD 0x82271DA8 ] TID: 3928
0x80561500 Faked ServiceTable–>BrccMCtl.exe [ ETHREAD 0x821A44B0 ] TID: 3932
0x80561500 Faked ServiceTable–>BrccMCtl.exe [ ETHREAD 0x821A3DA8 ] TID: 3940
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x822283E0 ] TID: 3964
0x80561500 Faked ServiceTable–>svchost.exe [ ETHREAD 0x821AD2D0 ] TID: 3972
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x821A2720 ] TID: 3992
0x80561500 Faked ServiceTable–>UPnPFramework.exe [ ETHREAD 0x82199DA8 ] TID: 3996
0x80561500 Faked ServiceTable–>lsass.exe [ ETHREAD 0x821E4AF0 ] TID: 4044
WARNING: Virus alike driver modification [sonypvs1.sys]
WARNING: Virus alike driver modification [a308.sys]
WARNING: Virus alike driver modification [a314.sys]
WARNING: Virus alike driver modification [a302.sys]
WARNING: Virus alike driver modification [ialmsbw.sys]
WARNING: Virus alike driver modification [symdns.sys]
WARNING: Virus alike driver modification [acpiec.sys]
WARNING: Virus alike driver modification [cpqdap01.sys]
WARNING: Virus alike driver modification [a305.sys]
WARNING: Virus alike driver modification [nikedrv.sys]
WARNING: Virus alike driver modification [rio8drv.sys]
WARNING: Virus alike driver modification [riodrv.sys]
WARNING: Virus alike driver modification [e1000325.sys]
WARNING: Virus alike driver modification [fsvga.sys]
WARNING: Virus alike driver modification [nwlnkflt.sys]
WARNING: Virus alike driver modification [ftdisk.sys]
WARNING: Virus alike driver modification [imagesrv.sys]
WARNING: Virus alike driver modification [nv4_mini.sys]
WARNING: Virus alike driver modification [cbidf2k.sys]
WARNING: Virus alike driver modification [rdpwd.sys]
WARNING: Virus alike driver modification [e100b325.sys]
WARNING: Virus alike driver modification [smclib.sys]
WARNING: Virus alike driver modification [el90xnd5.sys]
WARNING: Virus alike driver modification [a306.sys]
WARNING: Virus alike driver modification [ctpdusb.sys]
WARNING: Virus alike driver modification [symfw.sys]
WARNING: Virus alike driver modification [symredrv.sys]
WARNING: Virus alike driver modification [partmgr.sys]
WARNING: Virus alike driver modification [wstcodec.sys]
WARNING: Virus alike driver modification [vch.sys]
WARNING: Virus alike driver modification [LV561AV.SYS]
WARNING: Virus alike driver modification [tsbvcap.sys]
WARNING: Virus alike driver modification [a307.sys]
WARNING: Virus alike driver modification [tcpip6.sys]
WARNING: Virus alike driver modification [usbcamd.sys]
WARNING: Virus alike driver modification [usbcamd2.sys]
WARNING: Virus alike driver modification [a309.sys]
WARNING: Virus alike driver modification [cinemst2.sys]
WARNING: Virus alike driver modification [symtdi.sys]
WARNING: Virus alike driver modification [a303.sys]
WARNING: Virus alike driver modification [sonyhcs.sys]
WARNING: Virus alike driver modification [atmepvc.sys]
WARNING: Virus alike driver modification [nwlnkfwd.sys]
WARNING: Virus alike driver modification [a311.sys]
WARNING: Virus alike driver modification [ipfltdrv.sys]
WARNING: Virus alike driver modification [a310.sys]
WARNING: Virus alike driver modification [wa301a.sys]
WARNING: Virus alike driver modification [wa301b.sys]
WARNING: Virus alike driver modification [rawwan.sys]
WARNING: Virus alike driver modification [atmuni.sys]
WARNING: Virus alike driver modification [isapnp.sys]
WARNING: Virus alike driver modification [symids.sys]
WARNING: Virus alike driver modification [a313.sys]
WARNING: Virus alike driver modification [sonyhcc.sys]
WARNING: Virus alike driver modification [R8139n51.sys]
WARNING: Virus alike driver modification [a304.sys]
WARNING: Virus alike driver modification [symndis.sys]
WARNING: Virus alike driver modification [AloPar.sys]
WARNING: Virus alike driver modification [tosdvd.sys]
WARNING: Virus alike driver modification [imagedrv.sys]
WARNING: Virus alike driver modification [nwlnkspx.sys]
WARNING: Virus alike driver modification [vdmindvd.sys]
WARNING: Virus alike driver modification [dmload.sys]
WARNING: Virus alike driver modification [rootmdm.sys]
WARNING: Virus alike driver modification [sonyhcb.sys]
WARNING: Virus alike driver modification [nwlnknb.sys]
WARNING: Virus alike driver modification [enum1394.sys]
WARNING: Virus alike driver modification [ALCXWDM.SYS]
WARNING: Virus alike driver modification [mcd.sys]
WARNING: Virus alike driver modification [ialmkchw.sys]
WARNING: Virus alike driver modification [ialmnt5.sys]

CatByte

Post #4October 28, 2010, 11:12 PM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

wd4ngi-2

Post #5October 30, 2010, 4:16 AM UTC

Hello CatByte,

I just finished running ComboFix. When I tried shutting off AVG in the system tray there was no selection for disabling it. It is simply not there.

Some of the other features are grayed out. I had to go into MSCONFIG and uncheck this item in the startup tab. That got rid of the AVG icon in the system tray when I rebooted but ComboFix still recognized the fact that it was still running although I had turned it off so I don't know what to say about that. Something has my AVG firewall and AV program all messed up. Maybe this report can shed some light on what is causing this. Here now is the log file. Thanks for your assistance in resolving my problems.

Thomas

ComboFix 10-10-28.03 - Thomas 10/29/2010 23:20:24.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.89 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\patch.exe
c:\windows\system32\42KJE738.ocx
c:\windows\system32\drivers\hwinterface.sys
c:\windows\system32\system
c:\windows\tempf.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_hwinterface
——-\Service_hwinterface

((((((((((((((((((((((((( Files Created from 2010-09-28 to 2010-10-30 )))))))))))))))))))))))))))))))
.

2010-10-25 22:52 . 2010-10-25 22:52 ——– d—–w- c:\program files\iPod
2010-10-25 22:51 . 2010-10-25 22:53 ——– d—–w- c:\program files\iTunes
2010-10-25 22:51 . 2010-10-25 22:53 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2010-10-25 22:47 . 2010-10-25 22:47 1409 —-a-w- c:\windows\QTFont.for
2010-10-25 22:46 . 2010-10-25 22:46 ——– d—–w- c:\documents and settings\Thomas\Local Settings\Application Data\Apple
2010-10-25 22:46 . 2010-10-25 22:46 ——– d—–w- c:\program files\Apple Software Update
2010-10-25 22:45 . 2010-10-25 22:45 ——– d—–w- c:\program files\Bonjour
2010-10-25 22:45 . 2010-10-25 22:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-10-25 22:45 . 2010-10-25 22:52 ——– d—–w- c:\program files\Common Files\Apple
2010-10-23 01:41 . 2010-10-23 01:45 56068 —-a-w- c:\windows\system32\asr_24365.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-10 01:54 . 2010-03-19 01:53 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-10 01:54 . 2010-09-10 01:54 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-09-10 01:54 . 2010-03-19 01:53 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-10 01:54 . 2010-03-19 01:53 25168 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys
2010-09-10 01:51 . 2010-03-19 01:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-08 15:17 . 2010-09-08 15:17 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 15:17 . 2010-09-08 15:17 69632 —-a-w- c:\windows\system32\QuickTime.qts
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 16:13 1115392 —-a-w- d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-07-16 4743168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-06 335872]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 88361]
"GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-03-07 5181440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MBCameraMonitor.lnk - c:\program files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe [2009-6-4 541976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-09-10 01:54 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AloPar.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Parallel Arbitrator]
@="Driver Group"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Philips GoGear ARIA Device Manager.lnk]
backup=c:\windows\pss\Philips GoGear ARIA Device Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2007-11-30 15:28 1637312 —-a-w- d:\program files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2009-10-10 18:32 203264 -c–a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG9_TRAY]
2010-09-10 01:54 2065760 —-a-w- d:\progra~1\AVG\AVG9\avgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-04-08 21:16 133104 —-atw- c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HijackThis startup scan]
2005-02-16 15:06 218112 -c–a-w- d:\program files\Hijackthis\HijackThis.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-08-21 08:59 1105920 -c–a-w- d:\program files\Ahead\inCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 06:10 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
2007-03-07 05:06 5181440 —-a-w- c:\program files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-07-16 18:22 323584 —-a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPage]
1998-12-08 18:44 44032 —-a-w- d:\program files\Caere\OmniPagePro90\OPware32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2005-03-17 18:25 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 15:17 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2008-07-30 18:45 1829712 –sha-r- d:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 14:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Adobe LM Service"=3 (0x3)
"YahooAUService"=2 (0x2)
"aawservice"=2 (0x2)
"SymWSC"=2 (0x2)
"gusvc"=3 (0x3)
"AVGIDSAgent"=2 (0x2)
"avgfws9"=2 (0x2)
"avg9wd"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"iPodService"=3 (0x3)
"ACDaemon"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Microsoft Works Update Detection"=c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\mirc\\mirc.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"d:\\Program Files\\KaZaA Lite\\Kazaa.exe"=
"d:\\Program Files\\WS_FTP Pro\\ftp95pro.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\Program Files\\Netscape\\Communicator\\Program\\AIM\\aim.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [3/18/2010 9:53 PM 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [3/18/2010 9:53 PM 52872]
R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [1/8/2004 5:56 PM 9344]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/18/2010 9:53 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/18/2010 9:53 PM 243024]
R2 GEARSecurity_BackUp;GEARSecurity_BackUp;system32\gearsec.exe –> system32\gearsec.exe [?]
R2 PGPsdkServ;PGPsdkService;c:\windows\system32\PGPsdkServ.exe [2/15/2004 2:04 PM 65536]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [3/18/2010 9:53 PM 30104]
S2 Ca533av;V3345 Video Device;c:\windows\system32\Drivers\Ca533av.sys –> c:\windows\system32\Drivers\Ca533av.sys [?]
S2 mrtRate;mrtRate; [x]
S3 11d62222-a0f8-4f2a-bfae-dc1d753e7764;11d62222-a0f8-4f2a-bfae-dc1d753e7764;\??\f:\cds300\cds300.dll –> f:\cds300\cds300.dll [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [3/18/2010 9:53 PM 30104]
S3 AVGIDSDriverxpx;AVG9IDSDriver;d:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [3/18/2010 9:53 PM 122448]
S3 AVGIDSFilterxpx;AVG9IDSFilter;d:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [3/18/2010 9:53 PM 30288]
S3 AVGIDSShimxpx;AVG9IDSShim;d:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [3/18/2010 9:53 PM 26192]
S3 GearAspiWDM_BackUp;GEARAspiWDM;c:\windows\system32\drivers\GEARAspiWDM.sys [2/2/2005 1:21 AM 26600]
S4 AloPar;AloPar;c:\windows\system32\drivers\AloPar.sys [12/19/2003 11:26 AM 5056]
S4 avg9wd;AVG WatchDog;d:\program files\AVG\AVG9\avgwdsvc.exe [9/9/2010 9:54 PM 308136]
S4 avgfws9;AVG Firewall;d:\program files\AVG\AVG9\avgfws9.exe [9/9/2010 9:51 PM 2331032]
S4 AVGIDSAgent;AVG9IDSAgent;d:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [9/9/2010 9:54 PM 5897808]
S4 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [1/8/2004 5:56 PM 364800]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-10-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3120504336-336703014-2257007806-1005Core.job
- c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-08 21:16]

2010-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3120504336-336703014-2257007806-1005UA.job
- c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-08 21:16]

2010-10-30 c:\windows\Tasks\User_Feed_Synchronization-{0D863B0A-A06D-48B8-A107-D8D539647EB9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant =
IE: &AOL; Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
IE: &Yahoo;! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport; to Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary; - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps; - file:///c:\program files\Yahoo!\Common/ycmap.htm
Trusted Zone: ameritrade.com
Trusted Zone: ameritrade.com\wwws
Trusted Zone: tdameritrade.com
TCP: {AB48CC95-3C23-4C6A-9CA0-ACEFF8400A20} = 216.139.64.16 216.139.64.17
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Thomas\Application Data\Mozilla\Firefox\Profiles\5n36y971.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: d:\program files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox\components\nsURLRecordEx.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npbeatnk.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPOFF12.DLL
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPOFF12.DLL
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\nppdf32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPSVG3.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPSWF32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\nptgeqplugin.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npwthost.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npwtplug.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-HP Update 4200C - c:\sj655\hpupdate.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe
MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\ypager.exe
AddRemove-Absolute Fretboard Trainer PRO - c:\windows\GPInstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-29 23:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0992D064-A13E-4C28-911B-A76E6FEE9270}]
@Denied: (Full) (S-1-5-21-3120504336-336703014-2257007806-1005)
@Denied: (Full) (Owner)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3216)
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Creative\Creative Zen Micro\Zen Micro Media Explorer\CTJBNS2.dll
c:\program files\Creative\Creative Zen Micro\Zen Micro Media Explorer\CTIntrfc.dll
c:\program files\Creative\Creative Zen Micro\Zen Micro Media Explorer\CTConfig.DLL
c:\program files\Creative\Creative Zen Micro\Zen Micro Media Explorer\JBNSRES.DLL
.
———————— Other Running Processes ————————
.
d:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\CTsvcCDA.EXE
d:\program files\AVG\AVG9\avgrsx.exe
c:\program files\sony\giga pocket\shwserv.exe
c:\program files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
d:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
c:\program files\Sony\giga pocket\RM_SV.exe
c:\windows\system32\wscntfy.exe
c:\windows\AGRSMMSG.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-10-29 23:53:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-30 03:53

Pre-Run: 659,845,120 bytes free
Post-Run: 1,032,192,000 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - F1D49A043D142764E420EA13389555DA

CatByte

Post #6October 30, 2010, 7:30 AM UTC

Hi

Please do the following:

submit a file to virustotal for analysis

Use the browse button on that page to navigate to the location of the file to be scanned.
In the right hand panel,
click on the file c:\windows\system32\asr_24365.exe
then click the open button.
The file will now be displayed in the submit box.
Scroll down a bit and click "send file", wait for the results
If you get a message saying File has already been analyzed: click Reanalyze file now
Once scanned, copy and paste the link to the results page in your next reply.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

wd4ngi-2

Post #7October 30, 2010, 10:50 PM UTC

Hi CatByte,

I didn't get very far this time. Let me explain… That file called "asr_24365.exe" located at c:\windows\system32\asr_24365.exe apparently was in use and would not allow me to access it to send it to "VirusTotal". I even tried a couple of browsers: IE and Firefox to no avail. I got the idea to copy it and put on a thumbdirve to send from my laptop to them. It would still not allow me to copy it. I simply shut down the computer and rebooted in safe mode and I had success in copying it to my thumb drive. I then took it to my laptop and tried sending it to http://www.virustotal.com/

When I hit send here is what I discovered with my AVG on the laptop:

[external image: Posted Image]

So as you can see, this file contains a Trojan Horse. I quarantined it. I waited around for the results from "VirusTotal" but it never showed up. I went to part 2 of your last response and downloaded the file: mbam-setup-1.46.exe

I will not install it until I hear further instructions about what I'm supposed to do with "VirusTotal". Apparently my AVG over on the infected computer is not working. I have no virus protection over there and that concerns me.

Awaiting to hear from you,

Tom

CatByte

Post #8October 30, 2010, 11:12 PM UTC

OK

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/index.php?showtopic=115250&view=findpost&p=691529

Collect::
c:\windows\system32\asr_24365.exe

RegLockDel::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0992D064-A13E-4C28-911B-A76E6FEE9270}]

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

wd4ngi-2

Post #9October 31, 2010, 3:00 AM UTC

Hello again,

This will be my last posting for tonight. I accomplished the task you suggested. I also submitted the zipped file to Bleeping Computer for anlysis as part of ComboFix's final thing before it shut down. Here now is the log file you requested.

Thanks,
Tom

ComboFix 10-10-28.03 - Thomas 10/30/2010 21:55:44.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.81 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Thomas\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
* Created a new restore point

file zipped: c:\windows\system32\asr_24365.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\asr_24365.exe

.
((((((((((((((((((((((((( Files Created from 2010-09-28 to 2010-10-31 )))))))))))))))))))))))))))))))
.

2010-10-25 22:52 . 2010-10-25 22:52 ——– d—–w- c:\program files\iPod
2010-10-25 22:51 . 2010-10-25 22:53 ——– d—–w- c:\program files\iTunes
2010-10-25 22:51 . 2010-10-25 22:53 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2010-10-25 22:49 . 2010-10-25 22:49 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2010-10-25 22:47 . 2010-10-25 22:47 1409 —-a-w- c:\windows\QTFont.for
2010-10-25 22:46 . 2010-10-25 22:46 ——– d—–w- c:\documents and settings\Thomas\Local Settings\Application Data\Apple
2010-10-25 22:46 . 2010-10-25 22:46 ——– d—–w- c:\program files\Apple Software Update
2010-10-25 22:45 . 2010-10-25 22:45 ——– d—–w- c:\program files\Bonjour
2010-10-25 22:45 . 2010-10-25 22:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-10-25 22:45 . 2010-10-25 22:52 ——– d—–w- c:\program files\Common Files\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-10 01:54 . 2010-03-19 01:53 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-10 01:54 . 2010-09-10 01:54 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-09-10 01:54 . 2010-03-19 01:53 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-10 01:54 . 2010-03-19 01:53 25168 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys
2010-09-10 01:51 . 2010-03-19 01:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-08 15:17 . 2010-09-08 15:17 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 15:17 . 2010-09-08 15:17 69632 —-a-w- c:\windows\system32\QuickTime.qts
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 16:13 1115392 —-a-w- d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "d:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-07-16 4743168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-06 335872]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 88361]
"GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-03-07 5181440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
MBCameraMonitor.lnk - c:\program files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe [2009-6-4 541976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-09-10 01:54 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AloPar.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Parallel Arbitrator]
@="Driver Group"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Philips GoGear ARIA Device Manager.lnk]
backup=c:\windows\pss\Philips GoGear ARIA Device Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2007-11-30 15:28 1637312 —-a-w- d:\program files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2009-10-10 18:32 203264 -c–a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG9_TRAY]
2010-09-10 01:54 2065760 —-a-w- d:\progra~1\AVG\AVG9\avgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-04-08 21:16 133104 —-atw- c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HijackThis startup scan]
2005-02-16 15:06 218112 -c–a-w- d:\program files\Hijackthis\HijackThis.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-08-21 08:59 1105920 -c–a-w- d:\program files\Ahead\inCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 06:10 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
2007-03-07 05:06 5181440 —-a-w- c:\program files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-07-16 18:22 323584 —-a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPage]
1998-12-08 18:44 44032 —-a-w- d:\program files\Caere\OmniPagePro90\OPware32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2005-03-17 18:25 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 15:17 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2008-07-30 18:45 1829712 –sha-r- d:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 14:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Adobe LM Service"=3 (0x3)
"YahooAUService"=2 (0x2)
"aawservice"=2 (0x2)
"SymWSC"=2 (0x2)
"gusvc"=3 (0x3)
"AVGIDSAgent"=2 (0x2)
"avgfws9"=2 (0x2)
"avg9wd"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"iPodService"=3 (0x3)
"ACDaemon"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Microsoft Works Update Detection"=c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\mirc\\mirc.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"d:\\Program Files\\KaZaA Lite\\Kazaa.exe"=
"d:\\Program Files\\WS_FTP Pro\\ftp95pro.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\Program Files\\Netscape\\Communicator\\Program\\AIM\\aim.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"d:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [3/18/2010 9:53 PM 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [3/18/2010 9:53 PM 52872]
R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [1/8/2004 5:56 PM 9344]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/18/2010 9:53 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/18/2010 9:53 PM 243024]
R2 GEARSecurity_BackUp;GEARSecurity_BackUp;system32\gearsec.exe –> system32\gearsec.exe [?]
R2 PGPsdkServ;PGPsdkService;c:\windows\system32\PGPsdkServ.exe [2/15/2004 2:04 PM 65536]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [3/18/2010 9:53 PM 30104]
S2 Ca533av;V3345 Video Device;c:\windows\system32\Drivers\Ca533av.sys –> c:\windows\system32\Drivers\Ca533av.sys [?]
S2 mrtRate;mrtRate; [x]
S3 11d62222-a0f8-4f2a-bfae-dc1d753e7764;11d62222-a0f8-4f2a-bfae-dc1d753e7764;\??\f:\cds300\cds300.dll –> f:\cds300\cds300.dll [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [3/18/2010 9:53 PM 30104]
S3 AVGIDSDriverxpx;AVG9IDSDriver;d:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [3/18/2010 9:53 PM 122448]
S3 AVGIDSFilterxpx;AVG9IDSFilter;d:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [3/18/2010 9:53 PM 30288]
S3 AVGIDSShimxpx;AVG9IDSShim;d:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [3/18/2010 9:53 PM 26192]
S3 GearAspiWDM_BackUp;GEARAspiWDM;c:\windows\system32\drivers\GEARAspiWDM.sys [2/2/2005 1:21 AM 26600]
S4 AloPar;AloPar;c:\windows\system32\drivers\AloPar.sys [12/19/2003 11:26 AM 5056]
S4 avg9wd;AVG WatchDog;d:\program files\AVG\AVG9\avgwdsvc.exe [9/9/2010 9:54 PM 308136]
S4 avgfws9;AVG Firewall;d:\program files\AVG\AVG9\avgfws9.exe [9/9/2010 9:51 PM 2331032]
S4 AVGIDSAgent;AVG9IDSAgent;d:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [9/9/2010 9:54 PM 5897808]
S4 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [1/8/2004 5:56 PM 364800]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-10-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3120504336-336703014-2257007806-1005Core.job
- c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-08 21:16]

2010-10-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3120504336-336703014-2257007806-1005UA.job
- c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-08 21:16]

2010-10-31 c:\windows\Tasks\User_Feed_Synchronization-{0D863B0A-A06D-48B8-A107-D8D539647EB9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant =
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
Trusted Zone: ameritrade.com
Trusted Zone: ameritrade.com\wwws
Trusted Zone: tdameritrade.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Thomas\Application Data\Mozilla\Firefox\Profiles\5n36y971.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: d:\program files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox\components\nsURLRecordEx.dll
FF - plugin: c:\documents and settings\Thomas\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npbeatnk.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPOFF12.DLL
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\nppdf32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPSVG3.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\NPSWF32.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\nptgeqplugin.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npwthost.dll
FF - plugin: d:\program files\Netscape\Communicator\Program\Plugins\npwtplug.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-30 22:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-10-30 22:16:08
ComboFix-quarantined-files.txt 2010-10-31 02:15
ComboFix2.txt 2010-10-30 03:53

Pre-Run: 1,014,620,160 bytes free
Post-Run: 974,123,008 bytes free

- - End Of File - - 714DC1CCBCD6D60736FB89FF34BA3D0F

CatByte

Post #10October 31, 2010, 1:44 PM UTC

thanks please continue on with Malwarebytes and Kaspersky

wd4ngi-2

Post #11October 31, 2010, 6:29 PM UTC

Roger roger, will do! Just wanted to let you know there are still 2 items that I believe were associated with that last file that was infected, namely: asr_luziw and asr_qsaoz, see screen shot below. Also, notice that my AVG is still not working and I am getting the "Red shield" notice in the system tray. The ComboFix program showed the following:

AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

I have no way of turning these on or off that I am now aware of. I beleive the "Red shield" notice is some sort of trick by a spyware program. We will soon find out I suppose when I do the other scans from Malwarebytes and Kaspersky. One more comment, I noticed that Kaspersky online scanner was down a few days ago. They had posted a message about it being down. That is why I went to Housecall online scanner the other day.

Thanks,

Tom

[external image: Posted Image]

[external image: Posted Image]

CatByte

Post #12October 31, 2010, 7:17 PM UTC

Hi

The link I supplied for Kaspersky will work

and we'll take care of those other two files as well

please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

http://forums.whatthetech.com/index.php?showtopic=115250

Collect::
c:\windows\system32\asr_luziw 
c:\windows\system32\asr_qsaoz

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

wd4ngi-2

Post #13November 1, 2010, 9:56 PM UTC

Hello again,

This is taking some time because I am on dialup at 26.8KBS, slow I know but I live in the country. Anyway after a couple of tries of leaving Kaspersky running all night it does not complete the update and crashes. I am doing this again now. Here is the screenshot showing the percentage as of a few minutes ago:

[external image: Posted Image]

By the way, I ran Malwarebytes' Anti-Malware 1.46 last night and here is the log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5008

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

10/31/2010 3:31:56 PM
mbam-log-2010-10-31 (15-31-56).txt

Scan type: Quick scan
Objects scanned: 210415
Time elapsed: 11 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\meedia (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\77U3RR9AJUzDs0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\9b7NKmwbPk7P5N.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\e25D42oiebn2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\L5a23P6f8b.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\lM88IrII1JDWE4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\UXPW7E93GQ.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\w8qgfaW36.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Prior to re-loading the page at Kaspersky here are some screenshots of the problems I encountered:

[external image: Posted Image]

[external image: Posted Image]

I will continue to try to get these updates in and run the scan. If it crashes again I suppose I'll have to give up. One thing I keep forgetting to ask you is: Do I need to have my Windows XP System Restore turned off? I still have it on. Wouldn't the viruses keep returning?? More next time CatByte.

Tom

CatByte

Post #14November 1, 2010, 10:04 PM UTC

No,

System restore should never be turned off.

An infected restore point is better than none at all.

I didn't realize you were on dial up

try this scanner instead:

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.

wd4ngi-2

Post #15November 2, 2010, 10:02 AM UTC

Hi, Kaspersky got to 35 % and I got disconnected from internet again. Thanks for info on other webscanner from ESET. I went there and had a successful scan! Here are those results: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=a4cc1690ed95cf4987e6e767d76b05a2 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-11-02 08:23:59 # local_time=2010-11-02 04:23:59 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=1031 16777178 100 93 0 19556424 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=138502 # found=10 # cleaned=0 # scan_time=9648 C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062104.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062105.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062106.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062107.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062108.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062109.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP525\A0062110.exe MSIL/Drat.A trojan 00000000000000000000000000000000 I D:\temp\SmitfraudFix.exe multiple threats 00000000000000000000000000000000 I Thanks, Tom

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

catchme.exe TROJ Generic.AD

✨ Ask AI

Ask AI