Spyware / Malware / Virus Removal

Trojan- white smoke translater

19 min read

Looking for the outcome? Ask AI

suryacat Topic Starter

Post #1November 15, 2010, 9:20 PM UTC

Hi, I've got a nasty trojan on my laptop. It give me fake virus popups, reboots the computer, and installed some programs, called White Smoke. It also opens web pages in firefox. I need help. I downloaded Hijack this, here is the log file:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:11:31 PM, on 11/15/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Windows\PLFSetI.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\AVG\AVG9\avgui.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Microsoft Office\Office\EXCEL.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
C:\Users\Sheila\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
O2 - BHO: WhiteSmoke Toolbar - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: WhiteSmoke Toolbar - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [googletalk] C:\Users\Sheila\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [454D5A46_ 0] C:\Windows\TEMP\ufgaai.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [pNjIc02043] C:\ProgramData\pNjIc02043\pNjIc02043.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [454D5A46_ 0] C:\Windows\TEMP\ufgaai.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [pNjIc02043] C:\ProgramData\pNjIc02043\pNjIc02043.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O15 - Trusted Zone: *.west.com
O15 - Trusted Zone: *.westathome.com
O15 - Trusted Zone: *.westathome.net
O15 - Trusted Zone: *.workathomeagent.net
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\eMachines Games\eMachines Game Console\GameConsoleService.exe
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer - C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12606 bytes

Raktor

Post #2November 17, 2010, 2:13 AM UTC

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

Absence of symptoms does not always mean the computer is clean
Please do not run any scans or fixes without my direction.
Finally, stay with this topic until I give you the final 'All clear' post.

1) MBRCheck
Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

2) DDS
Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

3) GMER
Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.

Double click the exe file.
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

4) What You Will Need To Post:

MBRCheck log
DDS logs
GMER log

suryacat

Post #3November 18, 2010, 8:11 AM UTC

Here is the MBRCheck:

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: eMachines
BIOS Manufacturer: eMachines
System Manufacturer: eMachines
System Product Name: eMachines E627
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 210):
0x02C62000 \SystemRoot\system32\ntoskrnl.exe
0x02C19000 \SystemRoot\system32\hal.dll
0x00BCE000 \SystemRoot\system32\kdcom.dll
0x00CF8000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x00D05000 \SystemRoot\system32\PSHED.dll
0x00D19000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00E36000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00EDA000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00EE9000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00F40000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00F49000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00F53000 \SystemRoot\system32\DRIVERS\pci.sys
0x00F86000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00F93000 \SystemRoot\System32\drivers\partmgr.sys
0x00FA8000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00FB1000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00FBD000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00D77000 \SystemRoot\System32\drivers\volmgrx.sys
0x00FD2000 \SystemRoot\System32\drivers\mountmgr.sys
0x00FEC000 \SystemRoot\system32\DRIVERS\atapi.sys
0x00E00000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x00E2A000 \SystemRoot\system32\DRIVERS\msahci.sys
0x00DD3000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00FF5000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x010A7000 \SystemRoot\system32\drivers\fltmgr.sys
0x010F3000 \SystemRoot\system32\drivers\fileinfo.sys
0x01107000 \SystemRoot\system32\drivers\NISx64\1007020.00B\SYMEFA64.SYS
0x0120D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0116E000 \SystemRoot\System32\Drivers\msrpc.sys
0x013B0000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01000000 \SystemRoot\System32\Drivers\cng.sys
0x013CA000 \SystemRoot\System32\drivers\pcw.sys
0x013DB000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x014B7000 \SystemRoot\system32\drivers\ndis.sys
0x01400000 \SystemRoot\system32\drivers\NETIO.SYS
0x01460000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01602000 \SystemRoot\System32\drivers\tcpip.sys
0x015A9000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x018F0000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x0193C000 \SystemRoot\System32\Drivers\spldr.sys
0x01944000 \SystemRoot\System32\drivers\rdyboost.sys
0x0197E000 \SystemRoot\System32\Drivers\mup.sys
0x01990000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01999000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x019D3000 \SystemRoot\system32\DRIVERS\disk.sys
0x01800000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x01830000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x01870000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0189A000 \SystemRoot\System32\Drivers\Null.SYS
0x018A3000 \SystemRoot\System32\Drivers\Beep.SYS
0x018AA000 \SystemRoot\System32\drivers\vga.sys
0x018B8000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x018DD000 \SystemRoot\System32\drivers\watchdog.sys
0x019E9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x019F2000 \SystemRoot\system32\drivers\rdpencdd.sys
0x015F3000 \SystemRoot\system32\drivers\rdprefmp.sys
0x0148B000 \SystemRoot\System32\Drivers\Msfs.SYS
0x01496000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01073000 \SystemRoot\system32\DRIVERS\tdx.sys
0x014A7000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x036D0000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMTDI.SYS
0x0371C000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x03752000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMNDISV.SYS
0x03762000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMFW.SYS
0x03784000 \SystemRoot\System32\Drivers\avgtdia.sys
0x03600000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03645000 \SystemRoot\system32\drivers\afd.sys
0x037D5000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x011CC000 \SystemRoot\system32\DRIVERS\pacer.sys
0x037DE000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x037F4000 \SystemRoot\system32\DRIVERS\SymIMv.sys
0x013E5000 \SystemRoot\system32\DRIVERS\netbios.sys
0x00DE3000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x01091000 \SystemRoot\system32\DRIVERS\termdd.sys
0x00CC0000 \SystemRoot\system32\drivers\NISx64\1007020.00B\SRTSPX64.SYS
0x03A1F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x03A70000 \SystemRoot\system32\drivers\nsiproxy.sys
0x03A7C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x03A87000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20091111.001\IDSvia64.sys
0x03AFE000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x03B74000 \SystemRoot\System32\drivers\discache.sys
0x03B83000 \SystemRoot\System32\Drivers\dfsc.sys
0x03BA1000 \SystemRoot\system32\DRIVERS\ctxusbm.sys
0x03C97000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\ccHPx64.sys
0x03D2A000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x03D3B000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\BHDrvx64.sys
0x03D92000 \SystemRoot\System32\Drivers\avgmfx64.sys
0x03D9A000 \SystemRoot\System32\Drivers\avgldx64.sys
0x03C00000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x03C26000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x0486A000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x04E81000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04F75000 \SystemRoot\System32\drivers\dxgmms1.sys
0x04003000 \SystemRoot\system32\DRIVERS\athrx.sys
0x04174000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x04181000 \SystemRoot\system32\DRIVERS\L1C62x64.sys
0x04194000 \??\C:\Windows\system32\drivers\UBHelper.sys
0x0419C000 \??\C:\Windows\system32\drivers\NTIDrvr.sys
0x041A4000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x04800000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x041AF000 \SystemRoot\system32\DRIVERS\usbfilter.sys
0x041BB000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x041CC000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04FBB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x041F0000 \SystemRoot\SysWOW64\Drivers\DKbFltr.sys
0x04FD9000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x03C3D000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x041FC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04FE8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x04FF7000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x04856000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x03C86000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x03DE1000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x03BBC000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x0485B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x042E3000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04312000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0432D000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x0434E000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04368000 \SystemRoot\system32\DRIVERS\swenum.sys
0x0436A000 \SystemRoot\system32\DRIVERS\ks.sys
0x043AD000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04200000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x0425A000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04401000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x0426F000 \SystemRoot\system32\drivers\portcls.sys
0x042AC000 \SystemRoot\system32\drivers\drmk.sys
0x045E0000 \SystemRoot\system32\drivers\ksthunk.sys
0x00090000 \SystemRoot\System32\win32k.sys
0x045E6000 \SystemRoot\System32\drivers\Dxapi.sys
0x045F2000 \SystemRoot\System32\Drivers\crashdmp.sys
0x042CE000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x043BF000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x043CA000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x004A0000 \SystemRoot\System32\TSDDD.dll
0x03BE0000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x043EB000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x03A00000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x03A0C000 \SystemRoot\system32\DRIVERS\dot4usb.sys
0x01838000 \SystemRoot\system32\DRIVERS\Dot4.sys
0x00CD4000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x01860000 \SystemRoot\system32\DRIVERS\Dot4Prt.sys
0x02215000 \SystemRoot\System32\Drivers\usbvideo.sys
0x00760000 \SystemRoot\System32\cdd.dll
0x02243000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x02251000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x0226A000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x02273000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x02280000 \SystemRoot\system32\drivers\luafv.sys
0x022A3000 \SystemRoot\system32\drivers\WudfPf.sys
0x022C4000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x022D9000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x0232C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x0233F000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x02361000 \SystemRoot\System32\Drivers\fastfat.SYS
0x0387D000 \SystemRoot\system32\drivers\HTTP.sys
0x03945000 \SystemRoot\system32\DRIVERS\bowser.sys
0x03963000 \SystemRoot\System32\drivers\mpsdrv.sys
0x0397B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x039A8000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x03800000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x06493000 \SystemRoot\system32\drivers\peauth.sys
0x06539000 \SystemRoot\System32\Drivers\secdrv.SYS
0x06544000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x06571000 \SystemRoot\System32\drivers\tcpipreg.sys
0x06583000 \SystemRoot\System32\DRIVERS\srv2.sys
0x06A9B000 \SystemRoot\System32\DRIVERS\srv.sys
0x06B31000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x06A71000 \SystemRoot\system32\DRIVERS\monitor.sys
0x77850000 \Windows\System32\ntdll.dll
0x480E0000 \Windows\System32\smss.exe
0xFFB70000 \Windows\System32\apisetschema.dll
0xFF2F0000 \Windows\System32\autochk.exe
0xFF9E0000 \Windows\System32\urlmon.dll
0xFF970000 \Windows\System32\gdi32.dll
0xFF8D0000 \Windows\System32\comdlg32.dll
0xFF800000 \Windows\System32\usp10.dll
0x77750000 \Windows\System32\user32.dll
0xFF720000 \Windows\System32\oleaut32.dll
0xFF640000 \Windows\System32\advapi32.dll
0xFF530000 \Windows\System32\msctf.dll
0x77A20000 \Windows\System32\normaliz.dll
0xFF490000 \Windows\System32\clbcatq.dll
0xFF460000 \Windows\System32\imm32.dll
0xFF3C0000 \Windows\System32\msvcrt.dll
0xFF340000 \Windows\System32\shlwapi.dll
0x77A10000 \Windows\System32\psapi.dll
0xFF210000 \Windows\System32\wininet.dll
0xFE480000 \Windows\System32\shell32.dll
0xFE2A0000 \Windows\System32\setupapi.dll
0xFE280000 \Windows\System32\imagehlp.dll
0xFE150000 \Windows\System32\rpcrt4.dll
0xFE0D0000 \Windows\System32\difxapi.dll
0xFE0B0000 \Windows\System32\sechost.dll
0xFE0A0000 \Windows\System32\lpk.dll
0xFE050000 \Windows\System32\Wldap32.dll
0xFE000000 \Windows\System32\ws2_32.dll
0x77630000 \Windows\System32\kernel32.dll
0xFDDF0000 \Windows\System32\ole32.dll
0xFDDE0000 \Windows\System32\nsi.dll
0xFDB80000 \Windows\System32\iertutil.dll
0xFDB60000 \Windows\System32\devobj.dll
0xFDAF0000 \Windows\System32\KernelBase.dll
0xFDAB0000 \Windows\System32\wintrust.dll
0xFDA70000 \Windows\System32\cfgmgr32.dll
0xFD9D0000 \Windows\System32\comctl32.dll
0xFD860000 \Windows\System32\crypt32.dll
0xFD850000 \Windows\System32\msasn1.dll
0x75C50000 \Windows\SysWOW64\normaliz.dll

Processes (total 77):
0 System Idle Process
4 System
276 C:\Windows\System32\smss.exe
408 csrss.exe
480 C:\Windows\System32\wininit.exe
488 csrss.exe
500 C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
508 C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
544 C:\Windows\System32\winlogon.exe
624 C:\Windows\System32\services.exe
644 C:\Windows\System32\lsass.exe
652 C:\Windows\System32\lsm.exe
736 C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
556 C:\Windows\System32\svchost.exe
948 C:\Windows\System32\svchost.exe
744 C:\Windows\System32\atiesrxx.exe
1144 C:\Windows\System32\svchost.exe
1188 C:\Windows\System32\svchost.exe
1228 C:\Windows\System32\svchost.exe
1428 C:\Windows\System32\svchost.exe
1460 C:\Windows\System32\atieclxx.exe
1552 C:\Windows\System32\svchost.exe
1740 C:\Windows\System32\spoolsv.exe
1784 C:\Windows\System32\svchost.exe
1924 C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
1988 C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
1132 C:\Windows\System32\svchost.exe
1316 C:\Windows\System32\taskhost.exe
1620 C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
1820 C:\Windows\System32\dwm.exe
1828 C:\Windows\SysWOW64\svchost.exe
2028 C:\Windows\explorer.exe
2140 C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
2256 C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
2352 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
2360 C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
2368 C:\Windows\PLFSetI.exe
2376 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2460 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
2608 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
2652 C:\Windows\System32\svchost.exe
2856 C:\Program Files (x86)\Launch Manager\LManager.exe
2924 C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
3060 C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
2176 C:\Program Files (x86)\Java\jre6\bin\jusched.exe
2224 C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
1136 C:\Program Files (x86)\AVG\AVG9\avgtray.exe
2760 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2884 C:\Windows\System32\wbem\unsecapp.exe
3080 C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
3088 WmiPrvSE.exe
3288 C:\Program Files (x86)\AVG\AVG9\avgemc.exe
3320 C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
3452 C:\Program Files\eMachines\eMachines Power Management\ePowerEvent.exe
3676 C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
4052 C:\Windows\System32\SearchIndexer.exe
3632 WUDFHost.exe
4120 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
4808 C:\Program Files\Windows Media Player\wmpnetwk.exe
4944 C:\Windows\System32\svchost.exe
5080 C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
5016 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
4824 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
2208 C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
4984 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
5252 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
5704 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
2244 C:\Windows\System32\wuauclt.exe
5868 C:\Program Files\eMachines\eMachines Updater\ALU.exe
2868 C:\Program Files (x86)\AVG\AVG9\avgscana.exe
4104 C:\Windows\System32\conhost.exe
1812 C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
1652 C:\Windows\System32\svchost.exe
2040 C:\Windows\System32\audiodg.exe
2632 C:\Users\Sheila\Downloads\MBRCheck.exe
1968 C:\Windows\System32\conhost.exe
5724 C:\Windows\System32\dllhost.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000003`069e5800 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS545016B9A300, Rev: PBBOC60F

Size Device Name MBR Status
——————————————–
149 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 1BB72AA843C54C64E74C9F6C9BD22FA2AFA08966

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

suryacat

Post #4November 18, 2010, 8:25 AM UTC

Here is the DDS log:

DDS (Ver_10-11-10.01) - NTFS_AMD64
Run by [removed] at 2:14:18.55 on Thu 11/18/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_17
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.1788.676 [GMT -6:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
C:\Windows\system32\lsm.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\AVG\AVG9\avgemc.exe
C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
C:\Program Files\eMachines\eMachines Power Management\ePowerEvent.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\eMachines\eMachines Updater\alu.exe
C:\Program Files (x86)\AVG\AVG9\avgscana.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Users\Sheila\Downloads\MBRCheck.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Sheila\Downloads\dds.com
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273612091045l03e4z195r48823961
uDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273612091045l03e4z195r48823961
mDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273612091045l03e4z195r48823961
mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e627&r=273612091045l03e4z195r48823961
mWinlogon: Userinit=userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
BHO: WhiteSmoke Toolbar: {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
TB: WhiteSmoke Toolbar: {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [googletalk] C:\Users\Sheila\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
dRun: [454D5A46_ 0] C:\Windows\TEMP\ufgaai.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
Trusted Zone: west.com
Trusted Zone: westathome.com
Trusted Zone: westathome.net
Trusted Zone: workathomeagent.net
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\CoIEPlg.dll
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
mRun-x64: [Acer ePower Management] C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
mRun-x64: [PLFSetI] C:\Windows\PLFSetI.exe
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
AppInit_DLLs-X64: avgrssta.dll

================= FIREFOX ===================

FF - ProfilePath - C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\digq6j45.default\
FF - component: C:\Program Files (x86)\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Java Console: No Registry Reference - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified
C:\Program Files (x86)\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.search-clsid", "{D23D8819-6440-48B6-A894-D00AD7D18E48}");

============= SERVICES / DRIVERS ===============

R1 AvgLdx64;AVG Free AVI Loader Driver x64;C:\Windows\System32\drivers\avgldx64.sys [2009-12-23 269904]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;C:\Windows\System32\drivers\avgmfx64.sys [2009-12-23 35536]
R1 AvgTdiA;AVG Free Network Redirector x64;C:\Windows\System32\drivers\avgtdia.sys [2009-12-23 317520]
R1 BHDrvx64;Symantec Heuristics Driver;C:\Windows\System32\drivers\NISx64\1007020.00B\BHDrvx64.sys [2009-12-4 334384]
R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\NISx64\1007020.00B\cchpx64.sys [2009-12-4 583296]

=============== Created Last 30 ================

2010-11-15 20:37:50 ——– d—–w- C:\Program Files (x86)\whitesmoketoolbar
2010-11-15 17:23:08 ——– d—–w- C:\PROGRA~3\WSTB
2010-11-15 17:22:59 ——– d—–w- C:\PROGRA~3\pNjIc02043

==================== Find3M ====================

2010-09-08 05:36:17 1192960 —-a-w- C:\Windows\System32\wininet.dll
2010-09-08 05:34:34 57856 —-a-w- C:\Windows\System32\licmgr10.dll
2010-09-08 04:30:04 978432 —-a-w- C:\Windows\SysWow64\wininet.dll
2010-09-08 04:28:15 44544 —-a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-08 04:16:38 482816 —-a-w- C:\Windows\System32\html.iec
2010-09-08 03:35:30 1638912 —-a-w- C:\Windows\System32\mshtml.tlb
2010-09-08 03:22:31 386048 —-a-w- C:\Windows\SysWow64\html.iec
2010-09-08 02:48:16 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2010-09-01 05:12:09 12625920 —-a-w- C:\Windows\System32\wmploc.DLL
2010-09-01 04:23:49 12625408 —-a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-01 02:58:34 3123712 —-a-w- C:\Windows\System32\win32k.sys
2010-08-31 04:32:30 954752 —-a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 04:32:30 954288 —-a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-27 06:14:02 236032 —-a-w- C:\Windows\System32\srvsvc.dll
2010-08-27 05:46:48 9728 —-a-w- C:\Windows\SysWow64\sscore.dll
2010-08-27 03:38:04 463360 —-a-w- C:\Windows\System32\drivers\srv.sys
2010-08-27 03:37:48 402944 —-a-w- C:\Windows\System32\drivers\srv2.sys
2010-08-27 03:37:26 161792 —-a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-26 05:27:28 148992 —-a-w- C:\Windows\System32\t2embed.dll
2010-08-26 04:39:58 109056 —-a-w- C:\Windows\SysWow64\t2embed.dll
2010-08-21 06:38:47 1024512 —-a-w- C:\Windows\System32\wmpmde.dll
2010-08-21 06:36:49 340992 —-a-w- C:\Windows\System32\schannel.dll
2010-08-21 06:31:06 633856 —-a-w- C:\Windows\System32\comctl32.dll
2010-08-21 06:29:47 558592 —-a-w- C:\Windows\System32\spoolsv.exe
2010-08-21 05:36:33 738816 —-a-w- C:\Windows\SysWow64\wmpmde.dll
2010-08-21 05:36:24 224256 —-a-w- C:\Windows\SysWow64\schannel.dll
2010-08-21 05:33:24 530432 —-a-w- C:\Windows\SysWow64\comctl32.dll

============= FINISH: 2:17:22.69 ===============

suryacat

Post #5November 18, 2010, 9:01 AM UTC

Attached is the DDS text file.

Attachments:

[attachment removed: Attach_dds.zip]

suryacat

Post #6November 18, 2010, 9:18 AM UTC

GMER did not find anything. The drop down only allowed it to be saved as a log file, but I named it Gmer.txt. But the file was blank. Thank you so much for your help.

Raktor

Post #7November 19, 2010, 2:23 AM UTC

Download Combofix from any of the links below to your desktop.

Link 1
Link 2

==================================

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

suryacat

Post #8November 19, 2010, 2:48 AM UTC

Combo fix says it won't work with Windows 7.

Raktor

Post #9November 19, 2010, 3:00 AM UTC

Whoops, you're totally correct, my mistake.

Please download TDSSKiller to your desktop.
Double click on TDSSKiller.exe and follow the prompts - choosing to cure if necessary.
Once TDSSKiller has finished, it will create a log in your C:\ drive called TDSSKiller_* (where "*" denotes version and date).
Please copy and paste the contents of this log into your next reply.

suryacat

Post #10November 19, 2010, 3:25 AM UTC

2010/11/18 21:06:20.0861 TDSS rootkit removing tool 2.4.8.0 Nov 17 2010 07:23:12 2010/11/18 21:06:20.0861 ================================================================================ 2010/11/18 21:06:20.0861 SystemInfo: 2010/11/18 21:06:20.0861 2010/11/18 21:06:20.0861 OS Version: 6.1.7600 ServicePack: 0.0 2010/11/18 21:06:20.0861 Product type: Workstation 2010/11/18 21:06:20.0861 ComputerName: S-PC 2010/11/18 21:06:20.0861 UserName: S 2010/11/18 21:06:20.0861 Windows directory: C:\Windows 2010/11/18 21:06:20.0861 System windows directory: C:\Windows 2010/11/18 21:06:20.0861 Running under WOW64 2010/11/18 21:06:20.0861 Processor architecture: Intel x64 2010/11/18 21:06:20.0861 Number of processors: 1 2010/11/18 21:06:20.0861 Page size: 0x1000 2010/11/18 21:06:20.0861 Boot type: Normal boot 2010/11/18 21:06:20.0861 ================================================================================ 2010/11/18 21:06:20.0861 Utility is running under WOW64 2010/11/18 21:06:21.0360 Initialize success 2010/11/18 21:07:17.0427 ================================================================================ 2010/11/18 21:07:17.0427 Scan started 2010/11/18 21:07:17.0427 Mode: Manual; 2010/11/18 21:07:17.0427 ================================================================================ 2010/11/18 21:07:18.0690 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys 2010/11/18 21:07:18.0768 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 2010/11/18 21:07:18.0893 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 2010/11/18 21:07:18.0971 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 2010/11/18 21:07:19.0158 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 2010/11/18 21:07:19.0221 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 2010/11/18 21:07:19.0377 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys 2010/11/18 21:07:19.0501 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 2010/11/18 21:07:19.0595 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 2010/11/18 21:07:19.0735 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 2010/11/18 21:07:19.0798 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 2010/11/18 21:07:19.0860 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 2010/11/18 21:07:19.0985 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys 2010/11/18 21:07:20.0141 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 2010/11/18 21:07:20.0203 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys 2010/11/18 21:07:20.0266 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 2010/11/18 21:07:20.0437 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 2010/11/18 21:07:20.0531 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 2010/11/18 21:07:20.0625 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 2010/11/18 21:07:20.0718 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 2010/11/18 21:07:20.0827 athr (b2c3a8618867404475228f7dd260698b) C:\Windows\system32\DRIVERS\athrx.sys 2010/11/18 21:07:21.0171 atikmdag (2db9047aac9d981f59ce06d04d70c4d8) C:\Windows\system32\DRIVERS\atikmdag.sys 2010/11/18 21:07:21.0467 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys 2010/11/18 21:07:21.0717 AvgLdx64 (b447db072bf939db9e07bef2adf4ecbd) C:\Windows\System32\Drivers\avgldx64.sys 2010/11/18 21:07:21.0795 AvgMfx64 (405baabbb48f9176e220020b1a77c47b) C:\Windows\System32\Drivers\avgmfx64.sys 2010/11/18 21:07:21.0873 AvgTdiA (ce90aec358a809e7bce6bb0f1da84622) C:\Windows\System32\Drivers\avgtdia.sys 2010/11/18 21:07:22.0044 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 2010/11/18 21:07:22.0200 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 2010/11/18 21:07:22.0309 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 2010/11/18 21:07:22.0512 BHDrvx64 (4d7f8401eae7eaa4ef702fa6f4153269) C:\Windows\System32\Drivers\NISx64\1007020.00B\BHDrvx64.sys 2010/11/18 21:07:22.0621 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 2010/11/18 21:07:22.0731 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys 2010/11/18 21:07:22.0824 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 2010/11/18 21:07:22.0887 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 2010/11/18 21:07:22.0996 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 2010/11/18 21:07:23.0058 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 2010/11/18 21:07:23.0136 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 2010/11/18 21:07:23.0261 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 2010/11/18 21:07:23.0370 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 2010/11/18 21:07:23.0542 ccHP (1b79efc84b924a6932bb9d2a549de5c9) C:\Windows\System32\Drivers\NISx64\1007020.00B\ccHPx64.sys 2010/11/18 21:07:23.0698 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 2010/11/18 21:07:23.0807 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 2010/11/18 21:07:23.0932 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 2010/11/18 21:07:24.0010 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 2010/11/18 21:07:24.0166 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 2010/11/18 21:07:24.0228 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 2010/11/18 21:07:24.0275 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys 2010/11/18 21:07:24.0431 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 2010/11/18 21:07:24.0478 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 2010/11/18 21:07:24.0571 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 2010/11/18 21:07:24.0727 ctxusbm (ba8e5b2291c01ef71ca80e25f0c79d55) C:\Windows\system32\DRIVERS\ctxusbm.sys 2010/11/18 21:07:25.0149 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys 2010/11/18 21:07:25.0242 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 2010/11/18 21:07:25.0305 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 2010/11/18 21:07:25.0461 DKbFltr (d5bcb77be83cf99f508943945d46343d) C:\Windows\SysWOW64\Drivers\DKbFltr.sys 2010/11/18 21:07:25.0601 Dot4 (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys 2010/11/18 21:07:25.0695 Dot4Print (85135ad27e79b689335c08167d917cde) C:\Windows\system32\DRIVERS\Dot4Prt.sys 2010/11/18 21:07:25.0741 dot4usb (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys 2010/11/18 21:07:25.0851 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 2010/11/18 21:07:25.0944 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys 2010/11/18 21:07:26.0209 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 2010/11/18 21:07:26.0443 eeCtrl (8ecb5d35f400706016931bd25ae1b554) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 2010/11/18 21:07:26.0631 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 2010/11/18 21:07:26.0771 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 2010/11/18 21:07:26.0865 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 2010/11/18 21:07:26.0927 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 2010/11/18 21:07:27.0099 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 2010/11/18 21:07:27.0208 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 2010/11/18 21:07:27.0255 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 2010/11/18 21:07:27.0364 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 2010/11/18 21:07:27.0426 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 2010/11/18 21:07:27.0520 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 2010/11/18 21:07:27.0645 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 2010/11/18 21:07:27.0723 fvevol (b8b2a6e1558f8f5de5ce431c5b2c7b09) C:\Windows\system32\DRIVERS\fvevol.sys 2010/11/18 21:07:27.0785 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 2010/11/18 21:07:27.0941 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 2010/11/18 21:07:28.0003 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys 2010/11/18 21:07:28.0066 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 2010/11/18 21:07:28.0191 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 2010/11/18 21:07:28.0253 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 2010/11/18 21:07:28.0315 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 2010/11/18 21:07:28.0487 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 2010/11/18 21:07:28.0612 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 2010/11/18 21:07:28.0768 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 2010/11/18 21:07:28.0908 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 2010/11/18 21:07:28.0971 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 2010/11/18 21:07:29.0142 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys 2010/11/18 21:07:29.0361 IDSVia64 (9a793a1451b5e2cf54b4a33342cb58cf) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20091111.001\IDSvia64.sys 2010/11/18 21:07:29.0485 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 2010/11/18 21:07:29.0626 IntcAzAudAddService (0c3cf4b3bae28e121a1689e3538f8712) C:\Windows\system32\drivers\RTKVHD64.sys 2010/11/18 21:07:29.0813 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 2010/11/18 21:07:29.0891 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 2010/11/18 21:07:29.0953 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2010/11/18 21:07:30.0016 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 2010/11/18 21:07:30.0141 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 2010/11/18 21:07:30.0187 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 2010/11/18 21:07:30.0234 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 2010/11/18 21:07:30.0281 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 2010/11/18 21:07:30.0437 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 2010/11/18 21:07:30.0515 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 2010/11/18 21:07:30.0655 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys 2010/11/18 21:07:30.0733 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys 2010/11/18 21:07:30.0889 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 2010/11/18 21:07:30.0983 L1C (2377ec4cc3e356655b996f39b43486b6) C:\Windows\system32\DRIVERS\L1C62x64.sys 2010/11/18 21:07:31.0155 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 2010/11/18 21:07:31.0233 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 2010/11/18 21:07:31.0295 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 2010/11/18 21:07:31.0420 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 2010/11/18 21:07:31.0498 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 2010/11/18 21:07:31.0623 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 2010/11/18 21:07:31.0763 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 2010/11/18 21:07:31.0810 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 2010/11/18 21:07:31.0888 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 2010/11/18 21:07:32.0044 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 2010/11/18 21:07:32.0091 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 2010/11/18 21:07:32.0231 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 2010/11/18 21:07:32.0278 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 2010/11/18 21:07:32.0340 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 2010/11/18 21:07:32.0387 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 2010/11/18 21:07:32.0543 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 2010/11/18 21:07:32.0637 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys 2010/11/18 21:07:32.0746 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2010/11/18 21:07:32.0793 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2010/11/18 21:07:32.0855 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys 2010/11/18 21:07:32.0917 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 2010/11/18 21:07:33.0073 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 2010/11/18 21:07:33.0151 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 2010/11/18 21:07:33.0183 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 2010/11/18 21:07:33.0307 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 2010/11/18 21:07:33.0385 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 2010/11/18 21:07:33.0432 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 2010/11/18 21:07:33.0495 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 2010/11/18 21:07:33.0635 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 2010/11/18 21:07:33.0713 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 2010/11/18 21:07:33.0822 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 2010/11/18 21:07:33.0869 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 2010/11/18 21:07:34.0041 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 2010/11/18 21:07:34.0321 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 2010/11/18 21:07:34.0493 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 2010/11/18 21:07:34.0555 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 2010/11/18 21:07:34.0711 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 2010/11/18 21:07:34.0774 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 2010/11/18 21:07:34.0821 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 2010/11/18 21:07:34.0977 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 2010/11/18 21:07:35.0039 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 2010/11/18 21:07:35.0164 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 2010/11/18 21:07:35.0476 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 2010/11/18 21:07:35.0538 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 2010/11/18 21:07:35.0632 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys 2010/11/18 21:07:35.0819 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys 2010/11/18 21:07:35.0913 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 2010/11/18 21:07:35.0975 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys 2010/11/18 21:07:36.0084 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys 2010/11/18 21:07:36.0147 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 2010/11/18 21:07:36.0193 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 2010/11/18 21:07:36.0443 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 2010/11/18 21:07:36.0505 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys 2010/11/18 21:07:36.0568 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 2010/11/18 21:07:36.0615 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 2010/11/18 21:07:36.0786 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 2010/11/18 21:07:36.0833 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 2010/11/18 21:07:36.0895 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 2010/11/18 21:07:37.0207 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 2010/11/18 21:07:37.0270 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 2010/11/18 21:07:37.0426 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 2010/11/18 21:07:37.0519 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 2010/11/18 21:07:37.0675 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 2010/11/18 21:07:37.0753 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 2010/11/18 21:07:37.0816 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 2010/11/18 21:07:37.0956 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 2010/11/18 21:07:38.0019 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 2010/11/18 21:07:38.0081 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 2010/11/18 21:07:38.0253 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 2010/11/18 21:07:38.0315 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 2010/11/18 21:07:38.0377 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 2010/11/18 21:07:38.0424 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 2010/11/18 21:07:38.0565 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 2010/11/18 21:07:38.0611 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 2010/11/18 21:07:38.0674 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys 2010/11/18 21:07:38.0721 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 2010/11/18 21:07:38.0939 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 2010/11/18 21:07:39.0157 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 2010/11/18 21:07:39.0220 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 2010/11/18 21:07:39.0329 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 2010/11/18 21:07:39.0485 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 2010/11/18 21:07:39.0532 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 2010/11/18 21:07:39.0594 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 2010/11/18 21:07:39.0672 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 2010/11/18 21:07:39.0719 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys 2010/11/18 21:07:39.0766 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys 2010/11/18 21:07:39.0922 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 2010/11/18 21:07:40.0000 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 2010/11/18 21:07:40.0047 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 2010/11/18 21:07:40.0187 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 2010/11/18 21:07:40.0265 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 2010/11/18 21:07:40.0483 SRTSP (9e399476e5d5e0d3c8822c857a7e9a9a) C:\Windows\System32\Drivers\NISx64\1007020.00B\SRTSP64.SYS 2010/11/18 21:07:40.0593 SRTSPX (3d7717b582f0365e75071556936e5a6b) C:\Windows\system32\drivers\NISx64\1007020.00B\SRTSPX64.SYS 2010/11/18 21:07:40.0702 srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys 2010/11/18 21:07:40.0873 srv2 (4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys 2010/11/18 21:07:40.0967 srvnet (5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys 2010/11/18 21:07:41.0061 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 2010/11/18 21:07:41.0185 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 2010/11/18 21:07:41.0279 SymEFA (4f87bb5389a93778ebc363b28271a65b) C:\Windows\system32\drivers\NISx64\1007020.00B\SYMEFA64.SYS 2010/11/18 21:07:41.0419 SymEvent (7e4d281982e19abd06728c7ee9ac40a8) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 2010/11/18 21:07:41.0529 SYMFW (6320bf296b62d324890866a13a296fc0) C:\Windows\System32\Drivers\NISx64\1007020.00B\SYMFW.SYS 2010/11/18 21:07:41.0669 SymIM (212bbf5a964513980d5de9397381534f) C:\Windows\system32\DRIVERS\SymIMv.sys 2010/11/18 21:07:41.0763 SYMNDISV (21dcc664a1e0af7bf4c8aded8c9ff9d5) C:\Windows\System32\Drivers\NISx64\1007020.00B\SYMNDISV.SYS 2010/11/18 21:07:41.0919 SYMTDI (56a1cb71b8bb7ba9c41d2c9706df43cd) C:\Windows\System32\Drivers\NISx64\1007020.00B\SYMTDI.SYS 2010/11/18 21:07:42.0012 SynTP (bcf305959b53b200ceb2ad25ad22f8a7) C:\Windows\system32\DRIVERS\SynTP.sys 2010/11/18 21:07:42.0199 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys 2010/11/18 21:07:42.0433 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys 2010/11/18 21:07:42.0574 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 2010/11/18 21:07:42.0636 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 2010/11/18 21:07:42.0683 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 2010/11/18 21:07:42.0745 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 2010/11/18 21:07:42.0886 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 2010/11/18 21:07:43.0026 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 2010/11/18 21:07:43.0089 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 2010/11/18 21:07:43.0198 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 2010/11/18 21:07:43.0260 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys 2010/11/18 21:07:43.0323 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys 2010/11/18 21:07:43.0525 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 2010/11/18 21:07:43.0588 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 2010/11/18 21:07:43.0635 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 2010/11/18 21:07:43.0775 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys 2010/11/18 21:07:43.0900 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 2010/11/18 21:07:44.0071 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys 2010/11/18 21:07:44.0149 usbfilter (6648c6d7323a2ce0c4776c36cefbcb14) C:\Windows\system32\DRIVERS\usbfilter.sys 2010/11/18 21:07:44.0290 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys 2010/11/18 21:07:44.0337 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys 2010/11/18 21:07:44.0399 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 2010/11/18 21:07:44.0461 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 2010/11/18 21:07:44.0836 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2010/11/18 21:07:44.0961 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys 2010/11/18 21:07:45.0039 usbvideo (d501e12614b00a3252073101d6a1a74b) C:\Windows\system32\Drivers\usbvideo.sys 2010/11/18 21:07:45.0163 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 2010/11/18 21:07:45.0273 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 2010/11/18 21:07:45.0351 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 2010/11/18 21:07:45.0429 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 2010/11/18 21:07:45.0475 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 2010/11/18 21:07:45.0585 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 2010/11/18 21:07:45.0819 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 2010/11/18 21:07:45.0943 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 2010/11/18 21:07:46.0037 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 2010/11/18 21:07:46.0131 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 2010/11/18 21:07:46.0240 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 2010/11/18 21:07:46.0302 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys 2010/11/18 21:07:46.0380 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 2010/11/18 21:07:46.0536 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 2010/11/18 21:07:46.0583 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 2010/11/18 21:07:46.0786 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 2010/11/18 21:07:46.0848 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 2010/11/18 21:07:47.0129 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 2010/11/18 21:07:47.0176 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 2010/11/18 21:07:47.0332 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 2010/11/18 21:07:47.0441 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 2010/11/18 21:07:47.0628 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys 2010/11/18 21:07:47.0722 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys 2010/11/18 21:07:47.0847 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0) 2010/11/18 21:07:47.0925 ================================================================================ 2010/11/18 21:07:47.0925 Scan finished 2010/11/18 21:07:47.0925 ================================================================================ 2010/11/18 21:07:47.0940 Detected object count: 1 2010/11/18 21:08:15.0349 \HardDisk0 - will be cured after reboot 2010/11/18 21:08:15.0349 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure 2010/11/18 21:08:28.0329 Deinitialize success

Raktor

Post #11November 19, 2010, 3:27 AM UTC

Please reboot, and then run MBRCheck again and post the log - it looks like we've hopefully taken out the heart of the infection. There's still a a fair few other things to get though.

suryacat

Post #12November 19, 2010, 1:33 PM UTC

Here is the MBRCheck:

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: eMachines
BIOS Manufacturer: eMachines
System Manufacturer: eMachines
System Product Name: eMachines E627
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 209):
0x02C0B000 \SystemRoot\system32\ntoskrnl.exe
0x031E7000 \SystemRoot\system32\hal.dll
0x00B97000 \SystemRoot\system32\kdcom.dll
0x00C97000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x00CA4000 \SystemRoot\system32\PSHED.dll
0x00CB8000 \SystemRoot\system32\CLFS.SYS
0x00D16000 \SystemRoot\system32\CI.dll
0x00EF1000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F95000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00FA4000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00E00000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00E09000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00E13000 \SystemRoot\system32\DRIVERS\pci.sys
0x00E46000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00E53000 \SystemRoot\System32\drivers\partmgr.sys
0x00E68000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E71000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E7D000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00E92000 \SystemRoot\System32\drivers\volmgrx.sys
0x00DD6000 \SystemRoot\System32\drivers\mountmgr.sys
0x00DF0000 \SystemRoot\system32\DRIVERS\atapi.sys
0x00C00000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x00C2A000 \SystemRoot\system32\DRIVERS\msahci.sys
0x00C35000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00C45000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x010E3000 \SystemRoot\system32\drivers\fltmgr.sys
0x0112F000 \SystemRoot\system32\drivers\fileinfo.sys
0x01143000 \SystemRoot\system32\drivers\NISx64\1007020.00B\SYMEFA64.SYS
0x0124B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01000000 \SystemRoot\System32\Drivers\msrpc.sys
0x01200000 \SystemRoot\System32\Drivers\ksecdd.sys
0x0105E000 \SystemRoot\System32\Drivers\cng.sys
0x0121A000 \SystemRoot\System32\drivers\pcw.sys
0x0122B000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0148D000 \SystemRoot\system32\drivers\ndis.sys
0x0157F000 \SystemRoot\system32\drivers\NETIO.SYS
0x01400000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01601000 \SystemRoot\System32\drivers\tcpip.sys
0x0142B000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x011AA000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x01475000 \SystemRoot\System32\Drivers\spldr.sys
0x00C50000 \SystemRoot\System32\drivers\rdyboost.sys
0x015DF000 \SystemRoot\System32\Drivers\mup.sys
0x015F1000 \SystemRoot\System32\drivers\hwpolicy.sys
0x018DC000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x01916000 \SystemRoot\system32\DRIVERS\disk.sys
0x0192C000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x0195C000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x0199C000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x019C6000 \SystemRoot\System32\Drivers\Null.SYS
0x019CF000 \SystemRoot\System32\Drivers\Beep.SYS
0x019D6000 \SystemRoot\System32\drivers\vga.sys
0x01800000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x01825000 \SystemRoot\System32\drivers\watchdog.sys
0x01835000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x0183E000 \SystemRoot\system32\drivers\rdpencdd.sys
0x01847000 \SystemRoot\system32\drivers\rdprefmp.sys
0x01850000 \SystemRoot\System32\Drivers\Msfs.SYS
0x0185B000 \SystemRoot\System32\Drivers\Npfs.SYS
0x0186C000 \SystemRoot\system32\DRIVERS\tdx.sys
0x0188A000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x02C70000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMTDI.SYS
0x02CBC000 \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
0x02CF2000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMNDISV.SYS
0x02D02000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMFW.SYS
0x02D24000 \SystemRoot\System32\Drivers\avgtdia.sys
0x02D75000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03A71000 \SystemRoot\system32\drivers\afd.sys
0x03AFB000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x03B04000 \SystemRoot\system32\DRIVERS\pacer.sys
0x03B2A000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x03B40000 \SystemRoot\system32\DRIVERS\SymIMv.sys
0x03B4B000 \SystemRoot\system32\DRIVERS\netbios.sys
0x03B5A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x03B75000 \SystemRoot\system32\DRIVERS\termdd.sys
0x03B89000 \SystemRoot\system32\drivers\NISx64\1007020.00B\SRTSPX64.SYS
0x03B9D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x03BEE000 \SystemRoot\system32\drivers\nsiproxy.sys
0x03A00000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x03C6E000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20091111.001\IDSvia64.sys
0x03CE5000 \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
0x03D5B000 \SystemRoot\System32\drivers\discache.sys
0x03D6A000 \SystemRoot\System32\Drivers\dfsc.sys
0x03D88000 \SystemRoot\system32\DRIVERS\ctxusbm.sys
0x036DD000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\ccHPx64.sys
0x03770000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x03781000 \SystemRoot\System32\Drivers\NISx64\1007020.00B\BHDrvx64.sys
0x037D8000 \SystemRoot\System32\Drivers\avgmfx64.sys
0x03600000 \SystemRoot\System32\Drivers\avgldx64.sys
0x03647000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x0366D000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x0485A000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x04E71000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04F65000 \SystemRoot\System32\drivers\dxgmms1.sys
0x03E59000 \SystemRoot\system32\DRIVERS\athrx.sys
0x03FCA000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x03FD7000 \SystemRoot\system32\DRIVERS\L1C62x64.sys
0x03FEA000 \??\C:\Windows\system32\drivers\UBHelper.sys
0x03FF2000 \??\C:\Windows\system32\drivers\NTIDrvr.sys
0x03E00000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x04800000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x03E0B000 \SystemRoot\system32\DRIVERS\usbfilter.sys
0x03E17000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x03E28000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04FAB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x03E4C000 \SystemRoot\SysWOW64\Drivers\DKbFltr.sys
0x04FC9000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x03684000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x03FFA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04FD8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x04FE7000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x04FF0000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x036CD000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x037E0000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x03DA3000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x03DC7000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x03C00000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x03C2F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x03C4A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x03DD3000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x03FFC000 \SystemRoot\system32\DRIVERS\swenum.sys
0x03A0B000 \SystemRoot\system32\DRIVERS\ks.sys
0x03DED000 \SystemRoot\system32\DRIVERS\umbus.sys
0x02C00000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x03A4E000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04411000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x02DBA000 \SystemRoot\system32\drivers\portcls.sys
0x01897000 \SystemRoot\system32\drivers\drmk.sys
0x045F0000 \SystemRoot\system32\drivers\ksthunk.sys
0x04400000 \SystemRoot\System32\Drivers\crashdmp.sys
0x03A63000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x04FF5000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x02C5A000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x018B9000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x01964000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x01975000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x01981000 \SystemRoot\system32\DRIVERS\dot4usb.sys
0x000C0000 \SystemRoot\System32\win32k.sys
0x019E4000 \SystemRoot\System32\drivers\Dxapi.sys
0x0522B000 \SystemRoot\system32\DRIVERS\Dot4.sys
0x05253000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x0526E000 \SystemRoot\system32\DRIVERS\Dot4Prt.sys
0x05278000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00520000 \SystemRoot\System32\TSDDD.dll
0x00630000 \SystemRoot\System32\cdd.dll
0x05286000 \SystemRoot\System32\Drivers\usbvideo.sys
0x052B4000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x052C2000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x052DB000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x052E4000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x052F1000 \SystemRoot\system32\drivers\luafv.sys
0x05314000 \SystemRoot\system32\drivers\WudfPf.sys
0x05335000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x0534A000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x0539D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x053B0000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x053C8000 \SystemRoot\System32\Drivers\fastfat.SYS
0x03205000 \SystemRoot\system32\drivers\HTTP.sys
0x032CD000 \SystemRoot\system32\DRIVERS\bowser.sys
0x032EB000 \SystemRoot\System32\drivers\mpsdrv.sys
0x03303000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x03330000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0337E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x0465F000 \SystemRoot\system32\drivers\peauth.sys
0x04705000 \SystemRoot\System32\Drivers\secdrv.SYS
0x04710000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0473D000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0474F000 \SystemRoot\System32\DRIVERS\srv2.sys
0x056E6000 \SystemRoot\System32\DRIVERS\srv.sys
0x0577C000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x77590000 \Windows\System32\ntdll.dll
0x47E40000 \Windows\System32\smss.exe
0xFF8B0000 \Windows\System32\apisetschema.dll
0xFFAF0000 \Windows\System32\autochk.exe
0xFF800000 \Windows\System32\clbcatq.dll
0xFF760000 \Windows\System32\msvcrt.dll
0x77760000 \Windows\System32\normaliz.dll
0xFF6C0000 \Windows\System32\comdlg32.dll
0xFF690000 \Windows\System32\imm32.dll
0x77470000 \Windows\System32\kernel32.dll
0xFF640000 \Windows\System32\ws2_32.dll
0x77750000 \Windows\System32\psapi.dll
0xFF530000 \Windows\System32\msctf.dll
0xFF510000 \Windows\System32\imagehlp.dll
0xFF490000 \Windows\System32\difxapi.dll
0xFF310000 \Windows\System32\urlmon.dll
0x77370000 \Windows\System32\user32.dll
0xFF240000 \Windows\System32\usp10.dll
0xFF220000 \Windows\System32\sechost.dll
0xFE490000 \Windows\System32\shell32.dll
0xFE440000 \Windows\System32\Wldap32.dll
0xFE310000 \Windows\System32\wininet.dll
0xFE0B0000 \Windows\System32\iertutil.dll
0xFE0A0000 \Windows\System32\lpk.dll
0xFDEC0000 \Windows\System32\setupapi.dll
0xFDDE0000 \Windows\System32\advapi32.dll
0xFDD70000 \Windows\System32\gdi32.dll
0xFDD60000 \Windows\System32\nsi.dll
0xFDB50000 \Windows\System32\ole32.dll
0xFDAD0000 \Windows\System32\shlwapi.dll
0xFD9A0000 \Windows\System32\rpcrt4.dll
0xFD8C0000 \Windows\System32\oleaut32.dll
0xFD880000 \Windows\System32\wintrust.dll
0xFD840000 \Windows\System32\cfgmgr32.dll
0xFD7A0000 \Windows\System32\comctl32.dll
0xFD630000 \Windows\System32\crypt32.dll
0xFD5C0000 \Windows\System32\KernelBase.dll
0xFD5A0000 \Windows\System32\devobj.dll
0xFD590000 \Windows\System32\msasn1.dll

Processes (total 75):
0 System Idle Process
4 System
264 C:\Windows\System32\smss.exe
404 csrss.exe
476 C:\Windows\System32\wininit.exe
488 csrss.exe
500 C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
508 C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
560 C:\Windows\System32\services.exe
568 C:\Windows\System32\lsass.exe
576 C:\Windows\System32\lsm.exe
648 C:\Windows\System32\winlogon.exe
712 C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
800 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\svchost.exe
320 C:\Windows\System32\atiesrxx.exe
1028 C:\Windows\System32\svchost.exe
1060 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\svchost.exe
1164 C:\Windows\System32\audiodg.exe
1220 C:\Windows\System32\svchost.exe
1392 C:\Windows\System32\atieclxx.exe
1488 C:\Windows\System32\svchost.exe
1672 C:\Windows\System32\spoolsv.exe
1700 C:\Windows\System32\svchost.exe
1804 C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
1868 C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe
1912 C:\Windows\System32\svchost.exe
1940 C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
1988 C:\Windows\SysWOW64\svchost.exe
2024 C:\Windows\System32\svchost.exe
1212 C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
1792 C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
1424 C:\Windows\System32\svchost.exe
1096 C:\Windows\System32\svchost.exe
1656 C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
2316 C:\Program Files (x86)\AVG\AVG9\avgemc.exe
2356 C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
2640 C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
2968 WUDFHost.exe
3100 C:\Windows\System32\taskhost.exe
3160 C:\Windows\System32\dwm.exe
3180 C:\Windows\explorer.exe
3284 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
3292 C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe
3300 C:\Windows\PLFSetI.exe
3308 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3416 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
3492 C:\Program Files (x86)\Launch Manager\LManager.exe
3504 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
3660 C:\Windows\System32\wbem\unsecapp.exe
3716 C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
3820 C:\Program Files (x86)\Java\jre6\bin\jusched.exe
3828 C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
3876 C:\Program Files (x86)\AVG\AVG9\avgtray.exe
3936 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
3976 WmiPrvSE.exe
3232 C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
3656 C:\Program Files\eMachines\eMachines Power Management\ePowerEvent.exe
304 C:\Windows\System32\SearchIndexer.exe
3604 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
1764 C:\Program Files\Windows Media Player\wmpnetwk.exe
4828 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
4892 C:\Windows\System32\svchost.exe
5088 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
2032 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
2168 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
3008 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3788 C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
3376 C:\Windows\System32\wuauclt.exe
1684 C:\Windows\servicing\TrustedInstaller.exe
4152 C:\Windows\System32\taskeng.exe
160 C:\Users\Sheila\Desktop\MBRCheck.exe
2384 C:\Windows\System32\conhost.exe
4952 C:\Windows\System32\dllhost.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000003`069e5800 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS545016B9A300, Rev: PBBOC60F

Size Device Name MBR Status
——————————————–
149 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

Raktor

Post #13November 20, 2010, 3:49 AM UTC

Great, that part is fixed.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

suryacat

Post #14November 20, 2010, 5:22 AM UTC

OTL logfile created on: 11/19/2010 11:10:01 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\S\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 61.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 104.73 Gb Free Space | 76.47% Space Free | Partition Type: NTFS
Drive E: | 3.75 Gb Total Space | 3.75 Gb Free Space | 99.90% Space Free | Partition Type: FAT32

Computer Name: SHEILA-PC | User Name: Sheila | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Sheila\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe (Acer)
PRC - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe (Acer Incorporated)
PRC - C:\Windows\PLFSetI.exe ()

========== Modules (SafeList) ==========

MOD - C:\Users\Sheila\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (ePowerSvc) – C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (Updater Service) – C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe (Acer)
SRV - (avg9emc) – C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Norton Internet Security) – C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe (Symantec Corporation)
SRV - (NTISchedulerSvc) – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) – C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Greg_Service) – C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe (Acer Incorporated)
SRV - (GameConsoleService) – C:\Program Files (x86)\eMachines Games\eMachines Game Console\GameConsoleService.exe (WildTangent, Inc.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (USBCCID) – C:\Windows\SysNative\DRIVERS\RtsUCcid.sys File not found
DRV:64bit: - (RtsUIR) – C:\Windows\SysNative\DRIVERS\Rts516xIR.sys File not found
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\Drivers\RtsUStor.sys File not found
DRV:64bit: - (AvgTdiA) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AvgLdx64) – C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AvgMfx64) – C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (ccHP) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\cchpx64.sys (Symantec Corporation)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (BHDrvx64) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\BHDrvx64.sys (Symantec Corporation)
DRV:64bit: - (SYMTDI) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\symtdi.sys (Symantec Corporation)
DRV:64bit: - (SYMFW) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\symfw.sys (Symantec Corporation)
DRV:64bit: - (SYMNDISV) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\symndisv.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\NISx64\1007020.00B\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymIM) – C:\Windows\SysNative\drivers\SymIMV.sys (Symantec Corporation)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (NTIDrvr) – C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) – C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091111.001\IDSviA64.sys (Symantec Corporation)
DRV - (DKbFltr) Dritek Keyboard Filter Driver (64-bit) – C:\Windows\SysWOW64\Drivers\DKbFltr.sys (Dritek System Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A…e4z195r48823961
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.863
FF - prefs.js..extensions.enabledItems: [removed]:4.51
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.07103010
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009/12/03 16:24:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/10/26 12:13:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/11/11 18:34:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/10/30 07:17:33 | 000,000,000 | —D | M]

[2009/12/04 10:43:46 | 000,000,000 | —D | M] – C:\Users\Sheila\AppData\Roaming\Mozilla\Extensions
[2010/11/19 20:00:20 | 000,000,000 | —D | M] – C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\digq6j45.default\extensions
[2010/04/19 18:05:43 | 000,000,000 | —D | M] – C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\digq6j45.default\extensions\[removed]
[2010/11/19 20:00:20 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/08/22 10:56:32 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/09/12 23:05:42 | 000,124,240 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\CCMSDK.dll
[2009/09/12 23:06:22 | 000,070,488 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\CgpCore.dll
[2009/09/12 23:06:32 | 000,091,480 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\confmgr.dll
[2009/09/12 23:06:28 | 000,022,360 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\ctxlogging.dll
[2009/09/12 23:08:36 | 000,406,864 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll
[2009/09/12 23:06:24 | 000,023,896 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\TcpPServ.dll
[2010/11/15 14:35:58 | 000,001,919 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing-zugo.xml
[2010/11/08 05:17:56 | 000,002,212 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\websearch.xml

O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (WhiteSmoke Toolbar) - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (WhiteSmoke Toolbar) - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [googletalk] C:\Users\Sheila\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: west.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: westathome.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: westathome.net ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: workathomeagent.net ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.0.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.2.11\CoIEPlg.dll (Symantec Corporation)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/19 23:07:00 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Sheila\Desktop\OTL.exe
[2010/11/18 21:04:25 | 001,339,480 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Sheila\Desktop\tdsskiller.exe
[2010/11/18 20:43:44 | 000,000,000 | R–D | C] – C:\32788R22FWJFW
[2010/11/15 19:05:50 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Users\Sheila\Desktop\mbam-setup.exe
[2010/11/15 14:37:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\whitesmoketoolbar
[2010/11/15 11:23:08 | 000,000,000 | —D | C] – C:\ProgramData\WSTB
[2010/11/15 11:22:59 | 000,000,000 | —D | C] – C:\ProgramData\pNjIc02043
[2 C:\Users\Sheila\Desktop\*.tmp files -> C:\Users\S\Desktop\*.tmp -> ]
[1 C:\Users\Sheila\Documents\*.tmp files -> C:\Users\S\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/19 23:08:15 | 000,019,456 | —- | M] () – C:\Users\S\Desktop\Calculate work search hrs.doc
[2010/11/19 23:08:00 | 000,022,528 | —- | M] () – C:\Users\S\Documents\bills.xls
[2010/11/19 23:07:30 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Sheila\Desktop\OTL.exe
[2010/11/19 17:10:20 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/11/19 08:27:45 | 067,836,206 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2010/11/19 07:26:56 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/11/19 07:26:55 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/11/19 07:22:26 | 000,713,888 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/11/19 07:22:26 | 000,615,360 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/11/19 07:22:26 | 000,103,702 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/11/19 07:17:18 | 1406,177,280 | -HS- | M] () – C:\hiberfil.sys
[2010/11/18 21:04:56 | 001,339,480 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Sheila\Desktop\tdsskiller.exe
[2010/11/18 11:04:23 | 000,055,808 | —- | M] () – C:\Users\S\Desktop\Newworkhistory.doc
[2010/11/18 02:32:53 | 000,003,154 | —- | M] () – C:\Users\S\Desktop\Attach-dds.zip
[2010/11/18 02:05:22 | 000,026,112 | —- | M] () – C:\Users\S\Desktop\Job Search Log.xls
[2010/11/18 02:05:10 | 000,045,056 | —- | M] () – C:\Users\S\Desktop\S.doc
[2010/11/18 02:04:41 | 000,080,384 | —- | M] () – C:\Users\S\Desktop\MBRCheck.exe
[2010/11/16 11:42:24 | 332,566,561 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/11/16 07:15:35 | 000,026,624 | —- | M] () – C:\Users\S\Documents\ps-xxx-training.doc
[2010/11/15 19:07:05 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Users\Sheila\Desktop\mbam-setup.exe
[2010/11/15 14:35:48 | 000,001,112 | —- | M] () – C:\Windows\SysWow64\Improve Your PC.lnk
[2010/11/15 11:02:42 | 000,024,064 | —- | M] () – C:\Users\S\Desktop\new -resume_S_Armstrong.doc
[2010/11/12 13:06:56 | 000,019,456 | —- | M] () – C:\Users\S\Documents\testing_questions.doc
[2010/11/06 10:28:38 | 000,020,992 | —- | M] () – C:\Users\S\Documents\Angel was abandoned at the Voss Petsmart.doc
[2 C:\Users\Sheila\Desktop\*.tmp files -> C:\Users\S\Desktop\*.tmp -> ]
[1 C:\Users\Sheila\Documents\*.tmp files -> C:\Users\S\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/19 08:08:01 | 000,019,456 | —- | C] () – C:\Users\S\Desktop\Calculate work search hrs.doc
[2010/11/18 02:32:53 | 000,003,154 | —- | C] () – C:\Users\S\Desktop\Attach-dds.zip
[2010/11/18 02:04:37 | 000,080,384 | —- | C] () – C:\Users\S\Desktop\MBRCheck.exe
[2010/11/15 14:35:48 | 000,001,112 | —- | C] () – C:\Windows\SysWow64\Improve Your PC.lnk
[2010/11/14 14:08:06 | 000,026,112 | —- | C] () – C:\Users\S\Desktop\Job Search Log.xls
[2010/11/12 13:06:56 | 000,019,456 | —- | C] () – C:\Users\S\Documents\testing_questions.doc
[2010/11/06 10:25:29 | 000,020,992 | —- | C] () – C:\Users\S\Documents\Angel was abandoned at the Voss Petsmart.doc
[2010/03/02 16:55:16 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/12/08 10:24:15 | 000,000,000 | —- | C] () – C:\Users\S\AppData\Roaming\wklnhst.dat
[2009/12/04 17:54:15 | 000,000,600 | —- | C] () – C:\Users\S\AppData\Local\PUTTY.RND
[2009/12/04 04:19:53 | 000,001,131 | —- | C] () – C:\ProgramData\hpzinstall.log
[2009/10/31 03:11:00 | 000,626,688 | —- | C] () – C:\Windows\Image.dll
[2009/10/31 03:11:00 | 000,000,036 | —- | C] () – C:\Windows\PidList.ini
[2009/07/13 17:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[1999/01/22 12:46:58 | 000,065,536 | —- | C] () – C:\Windows\SysWow64\MSRTEDIT.DLL
[1998/01/12 02:00:00 | 000,040,448 | —- | C] () – C:\Windows\SysWow64\REGOBJ.DLL

========== LOP Check ==========

[2009/12/04 15:39:41 | 000,000,000 | —D | M] – C:\Users\S\AppData\Roaming\Five9
[2009/12/21 10:27:42 | 000,000,000 | —D | M] – C:\Users\S\AppData\Roaming\ICAClient
[2009/12/04 11:00:07 | 000,000,000 | —D | M] – C:\Users\S\AppData\Roaming\WildTangent
[2010/08/22 19:14:02 | 000,000,000 | —D | M] – C:\Users\S\AppData\Roaming\Windows Live Writer
[2010/10/01 06:50:05 | 000,032,586 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Raktor

Post #15November 20, 2010, 5:26 AM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O2 - BHO: (WhiteSmoke Toolbar) - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll ()
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.O3 - HKLM\..\Toolbar: (WhiteSmoke Toolbar) - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll ()
O3 - HKLM\..\Toolbar: (WhiteSmoke Toolbar) - {52794457-af6c-4c50-9def-f2e24f4c8889} - C:\Program Files (x86)\whitesmoketoolbar\whitesmoketoolbarX.dll ()
[2010/11/15 14:37:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\whitesmoketoolbar[2010/11/15 11:22:59 | 000,000,000 | —D | C] – C:\ProgramData\pNjIc02043
[2010/11/15 11:22:59 | 000,000,000 | —D | C] – C:\ProgramData\pNjIc02043

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan- white smoke translater

✨ Ask AI

Ask AI