Spyware / Malware / Virus Removal

Please Help

19 min read

Looking for the outcome? Ask AI

gikster Topic Starter

Post #1January 15, 2011, 3:51 PM UTC

Can anyone help me? My laptop is so slow! Took me about an hour just to start it up and get onto this page!!! Any help would be much apreachiated!

JonTom

Post #2January 15, 2011, 4:42 PM UTC

Hello gikster and

My name is JonTom

Malware Logs can sometimes take a lot of time to research and interpret.
Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

Are you experiencing any other problems besides system slowness (popups, redirects etc)? Lets take a look at your system with the following scan:

Please perform the following scan
Please download DDS from here and save it to your desktop.
Disable any script blocking protection (How to Disable your Security Programs)
Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.
Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

gikster

Post #3January 15, 2011, 5:18 PM UTC

Thanks for your response. I clicked on the link and on the toolbar at the top to allow to download file but it just says blank page and nothing starts downloading

JonTom

Post #4January 15, 2011, 11:39 PM UTC

Hello gikster

Try clicking on the link below and see if it works for you.

If it does not, right click on it and select "Copy Link Location". Then paste the link directly into your browser search bar and hit Enter.

http://download.bleepingcomputer.com/sUBs/dds.scr

If you are still unale to access DDS after trying the steps above let me know.

gikster

Post #5January 16, 2011, 7:06 PM UTC

Managed to download and save to desktop. When I double click, I get dds-notepad open up with loads of symbols, I assume this is not right :-/

JonTom

Post #6January 16, 2011, 9:08 PM UTC

Hello gikster

I assume this is not right

The log should be readable text rather than symbols. That does not sound right at all.

It may be possible that something is interfering with our tools.

Lets try this:

rkill
- Please download rkill (Courtesy of Bleepingcomputer.com).
- There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
- Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
- Note: You only need to get one of the tools to run, not all of them.
1. rkill.exe
2. rkill.com
3. rkill.scr
4. WiNlOgOn.exe
5. uSeRiNiT.exe

Note: You may receive a message telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.

Run rkill repeatedly until it's able to do it's job. This may take a few tries.

You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

Once rkill has been run try DDS again. If the log produced is meaningless (just symbols with no readable text) try the following tool:
Please run Random's System Information Tool
- Download Random's System Information Tool (RSIT) by Random/Random from here and save the file (called RSIT.exe) to your desktop.
- Double click on the RSIT.exe icon to run the program.
- Click "Continue" at the disclaimer screen.
- Once the scan has finished, two logs will be created.
- Please post the contents of the log.txt log (will be maximised) and the info.txt log (will be minimised).
If a log is produced please post it in your next reply. If the log only consists of symbols, please post a sample of the symbol log for me to take a look at.

gikster

Post #7January 16, 2011, 9:58 PM UTC

info.txt logfile of random's system information tool 1.08 2011-01-16 21:49:46 ======Uninstall list====== –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{028EC2AF-F501-4567-9CEA-140030DE8544}\setup.exe" -l0x9 -u –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2580F4DA-324F-4945-B16F-B2B867325085}\setup.exe" -l0x9 -u –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x9 –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}\setup.exe" -l0x9 –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9 –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x9 –>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6366726-BA44-4D6A-8ECE-476E2E616AD1}\setup.exe" -l0x9 888casino–>C:\PROGRA~1\CASINO~1\UNWISE.EXE C:\PROGRA~1\CASINO~1\INSTALL.LOG 888poker–>C:\PROGRA~1\PACIFI~1\UNWISE.EXE C:\PROGRA~1\PACIFI~1\INSTALL.LOG ABBYY FineReader 6.0 Sprint–>MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07} Acrobat.com–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 Acrobat.com–>MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07} Ad-Aware–>"C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE Ad-Aware–>C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe Adobe AIR–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR–>MsiExec.exe /I{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB} Adobe Flash Player 10 ActiveX–>C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 10 Plugin–>C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Photoshop 7.0–>C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll" Adobe Reader 9.3.1–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001} Advanced Audio FX Engine–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x9 /remove Advanced Video FX Engine–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x9 /remove Akamai NetSession Interface–>C:\Program Files\Common Files\Akamai\uninstall.exe Apple Application Support–>MsiExec.exe /I{DAEAFD68-BB4A-4507-A241-C8804D2EA66D} Apple Mobile Device Support–>MsiExec.exe /I{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887} Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033} Ask Toolbar–>MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE} Betfair Poker–>MsiExec.exe /I{08716EF4-E4CC-4BC7-97D5-7B6990114ACD} Bonjour–>MsiExec.exe /X{FF1C31AE-0CDC-40CE-AB85-406F8B70D643} Browser Address Error Redirector–>MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F} bwin Poker–>"C:\bwinPoker\unins000.exe" Cisco EAP-FAST Module–>MsiExec.exe /I{BF53252E-4AB2-4C7F-A0FD-6100755745E3} Cisco LEAP Module–>MsiExec.exe /I{76F9CF97-FC4B-4E20-B363-D127C888448F} Cisco PEAP Module–>MsiExec.exe /I{4E5386F5-C0F6-4532-A54A-374865AEAB71} Compatibility Pack for the 2007 Office system–>MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} Conexant HDA D330 MDC V.92 Modem–>C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F\UIU32m.exe -U -Idel000fz.INF D3DX10–>MsiExec.exe /X{E09C4DB7-630C-4F06-A631-8EA7239923AF} Dell Dock–>MsiExec.exe /I{F6CB42B9-F033-4152-8813-FF11DA8E6A78} Dell Getting Started Guide–>MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045} Dell Support Center (Support Software)–>MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1} Dell Touchpad–>C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE Dell Webcam Center–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}\setup.exe" -l0x9 /remove Dell Webcam Manager–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6366726-BA44-4D6A-8ECE-476E2E616AD1}\setup.exe" -l0x9 /remove Dell Wireless WLAN Card–>"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card" Dell-eBay–>MsiExec.exe /I{B935C985-A17F-484B-8470-09E4FC27DC26} Digital Line Detect–>C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly EA Download Manager–>C:\Program Files\Electronic Arts\EADM\Uninstall.exe EDocs–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}\setup.exe" Epson Easy Photo Print 2–>C:\Program Files\InstallShield Installation Information\{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}\SETUP.EXE -runfromtemp -l0x0009 UNINST -removeonly Epson Event Manager–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48F22622-1CC2-4A83-9C1E-644DD96F832D}\SETUP.EXE" -l0x9 -u Epson Printer Software Downloader–>MsiExec.exe /I{B6A98E5F-D6A7-46FB-9E9D-1F7BF4434001} Epson Printer Software Downloader–>MsiExec.exe /I{B6A98E5F-D6A7-46FB-9E9D-1F7BF4434001} EPSON Scan–>C:\Program Files\epson\escndv\setup\setup.exe /r Epson Stylus SX510W_TX550W Manual–>C:\Program Files\EPSON\TPMANUAL\ESSX510W_TX550W\ENG\USE_G\DOCUNINS.EXE EPSON SX510W Series Printer Uninstall–>C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FINSFIE.EXE /R /APD /P:"EPSON SX510W Series" EpsonNet Print–>C:\Program Files\InstallShield Installation Information\{3E31400D-274E-4647-916C-2CACC3741799}\ENPSETUP.exe -runfromtemp -l0x0009 -EPSON -removeonly EpsonNet Setup–>"C:\Program Files\InstallShield Installation Information\{FFFAE01B-466F-4C07-9821-A94FD753BDDA}\Setup.exe" -runfromtemp -l0x0009 -removeonly FIFA MANAGER 10–>C:\Program Files\EA SPORTS\FIFA MANAGER 10\eauninstall.exe FrostWire 4.17.0–>C:\Program Files\FrostWire\Uninstall.exe Full Tilt Poker–>"C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -runfromtemp -l0x0009 -removeonly Futuremark SystemInfo–>"C:\Program Files\InstallShield Installation Information\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}\setup.exe" -runfromtemp -l0x0009 -removeonly GoToAssist 8.0.0.514–>C:\Program Files\Citrix\GoToAssist\514\G2AUninstaller.exe /uninstall High-Definition Video Playback–>MsiExec.exe /X{237CCB62-8454-43E3-B158-3ACD0134852E} HiJackThis–>MsiExec.exe /X{45A66726-69BC-466B-A7A4-12FCBA4883D7} Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)–>C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)–>C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT="" Intel® Matrix Storage Manager–>C:\Windows\System32\Imsmudlg.exe iPhone Configuration Utility–>MsiExec.exe /I{FA54AFB1-5745-4389-B8C1-9F7509672ED1} iTunes–>MsiExec.exe /I{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4} Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Junk Mail filter update–>MsiExec.exe /I{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4} Ladbrokes Poker–>C:\MICROG~1\Poker\LADBRO~1\LADBRO~1\UNWISE.EXE C:\MICROG~1\Poker\LADBRO~1\LADBRO~1\INSTALL.LOG Laptop Integrated Webcam Driver (1.04.01.1011) –>C:\Windows\CtDrvIns.exe -uninstall -script OEM002.uns -plugin OEM02Pin.dll -pluginres OEM02Pin.crl -nodisconprompt -langid 0x0409 LimeWire 5.1.4–>"C:\Program Files\LimeWire\uninstall.exe" Live! Cam Avatar Creator–>C:\Program Files\InstallShield Installation Information\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}\setup.exe -runfromtemp -l0x0009 -removeonly /remove Live! Cam Avatar v1.0–>C:\Program Files\InstallShield Installation Information\{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}\setup.exe -runfromtemp -l0x0009 -removeonly /remove MediaDirect–>C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0009 -cluninstall Microsoft .NET Framework 1.1 Security Update (KB2416447)–>"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M2416447\M2416447Uninstall.msp" Microsoft .NET Framework 1.1 Security Update (KB979906)–>"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M979906\M979906Uninstall.msp" Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 3.5 SP1–>c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Microsoft .NET Framework 3.5 SP1–>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} Microsoft .NET Framework 4 Client Profile–>C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client Microsoft .NET Framework 4 Client Profile–>MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6} Microsoft Games for Windows - LIVE Redistributable–>MsiExec.exe /X{1FDA5A37-B22D-43FF-B582-B8964050DC13} Microsoft Games for Windows - LIVE–>MsiExec.exe /X{86A4C6D9-29EE-4719-AFA1-BA3341862B83} Microsoft Money–>C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120 Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E} Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E} Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E} Microsoft Office 2007 Service Pack 2 (SP2)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B} Microsoft Office Click-to-Run 2010 (Beta)–>"C:\PROGRA~1\COMMON~1\MICROS~1\VIRTUA~1\CVHBS.EXE" /removeall Microsoft Office Click-to-Run 2010 (Beta)–>MsiExec.exe /I{20140000-006D-0409-0000-0000000FF1CE} Microsoft Office Excel MUI (English) 2007–>MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE} Microsoft Office Home and Business 2010 (Beta) - English–>C:\Program Files\Common Files\microsoft shared\virtualization handler\cvhbs.exe /uninstall {20140062-0062-0409-0000-0000000FF1CE} Microsoft Office Home and Student 2007–>"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL Microsoft Office Home and Student 2007–>MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE} Microsoft Office OneNote MUI (English) 2007–>MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (English) 2007–>MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE} Microsoft Office Proof (English) 2007–>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007–>MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007–>MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007–>MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)–>msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9} Microsoft Office Shared MUI (English) 2007–>MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office Word MUI (English) 2007–>MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE} Microsoft Silverlight–>MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053–>MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118} Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17–>MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148–>MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989} Microsoft Works–>MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8} Microsoft WSE 3.0 Runtime–>MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13} Modem Diagnostic Tool–>MsiExec.exe /I{294EAADF-E50F-4DD8-AD8D-19587EA10512} MSVCRT–>MsiExec.exe /I{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F} MSXML 4.0 SP2 (KB927978)–>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F} MSXML 4.0 SP2 (KB954430)–>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 4.0 SP2 (KB973688)–>MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC} Nero 10 Menu TemplatePack Basic–>MsiExec.exe /X{63AA3EAB-23BB-48B2-9AD0-44F878075604} Nero 10 Movie ThemePack Basic–>MsiExec.exe /X{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7} Nero BackItUp 10 Help (CHM)–>MsiExec.exe /X{08C8666B-C502-4AB3-B4CB-D74AC42D14FE} Nero BackItUp 10–>MsiExec.exe /X{68AB6930-5BFF-4FF6-923B-516A91984FE6} Nero Burning ROM 10–>MsiExec.exe /X{7A5D731D-B4B3-490E-B339-75685712BAAB} Nero BurningROM 10 Help (CHM)–>MsiExec.exe /X{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345} Nero BurnRights 10 Help (CHM)–>MsiExec.exe /X{555868C6-49FB-484F-BB43-8980651A1B00} Nero BurnRights 10–>MsiExec.exe /X{943CFD7D-5336-47AF-9418-E02473A5A517} Nero Control Center 10–>MsiExec.exe /X{6DFB899F-17A2-48F0-A533-ED8D6866CF38} Nero ControlCenter 10 Help (CHM)–>MsiExec.exe /X{523B2B1B-D8DB-4B41-90FF-C4D799E2758A} Nero Core Components 10–>MsiExec.exe /X{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F} Nero CoverDesigner 10 Help (CHM)–>MsiExec.exe /X{C3273C55-E1E4-41FF-8D69-0158090DB8D8} Nero CoverDesigner 10–>MsiExec.exe /X{FCF00A6E-FB58-477A-ABE9-232907105521} Nero DiscCopy Gadget 10–>MsiExec.exe /X{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5} Nero DiscCopyGadget 10 Help (CHM)–>MsiExec.exe /X{5F548A02-80BC-404D-BAE6-F05F9BF6B449} Nero DiscSpeed 10 Help (CHM)–>MsiExec.exe /X{C18A0418-442A-4186-AF98-D08F5054A2FC} Nero DiscSpeed 10–>MsiExec.exe /X{34490F4E-48D0-492E-8249-B48BECF0537C} Nero Dolby Files 10–>MsiExec.exe /X{C3580AC4-C827-4332-B935-9A282ED5BB97} Nero Express 10 Help (CHM)–>MsiExec.exe /X{33643918-7957-4839-92C7-EA96CB621A98} Nero Express 10–>MsiExec.exe /X{70550193-1C22-445C-8FA4-564E155DB1A7} Nero InfoTool 10 Help (CHM)–>MsiExec.exe /X{66049135-9659-4AAD-9169-9CCA269EBB3E} Nero InfoTool 10–>MsiExec.exe /X{F412B4AF-388C-4FF5-9B2F-33DB1C536953} Nero MediaHub 10 Help (CHM)–>MsiExec.exe /X{F467862A-D9CA-47ED-8D81-B4B3C9399272} Nero MediaHub 10–>MsiExec.exe /X{1F7FB68F-52F6-46A3-B42F-38CE46295AE5} Nero Multimedia Suite 10–>MsiExec.exe /I{277C1559-4CF7-44FF-8D07-98AA9C13AABD} Nero Recode 10 Help (CHM)–>MsiExec.exe /X{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF} Nero Recode 10–>MsiExec.exe /X{8ECEC853-5C3D-4B10-B5C7-FF11FF724807} Nero RescueAgent 10 Help (CHM)–>MsiExec.exe /X{92E25238-61A3-4ACD-A407-3C480EEF47A7} Nero RescueAgent 10–>MsiExec.exe /X{E337E787-CF61-4B7B-B84F-509202A54023} Nero SoundTrax 10 Help (CHM)–>MsiExec.exe /X{16987E99-C95C-4513-9239-7B44A0A71DB5} Nero SoundTrax 10–>MsiExec.exe /X{E1EE5339-5D32-458F-BAAB-B19F6301BCE2} Nero StartSmart 10 Help (CHM)–>MsiExec.exe /X{F6117F9C-ADB5-4590-9BE4-12C7BEC28702} Nero StartSmart 10–>MsiExec.exe /X{F61D489E-6C44-49AC-AD02-7DA8ACA73A65} Nero Update–>MsiExec.exe /X{65BB0407-4CC8-4DC7-952E-3EEFDF05602A} Nero Vision 10 Help (CHM)–>MsiExec.exe /X{329411A0-19F3-4740-874F-17400B126F27} Nero Vision 10–>MsiExec.exe /X{9A4297F3-2A51-4ED9-92CA-4BCB8380947E} Nero WaveEditor 10 Help (CHM)–>MsiExec.exe /X{7A295D8F-484B-4FFB-89AB-C1FD497591FE} Nero WaveEditor 10–>MsiExec.exe /X{EDCDFAD5-DF80-4600-A493-E9DAD6810230} NetWaiting–>C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly OGA Notifier 2.0.0048.0–>MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18} OutlookAddinSetup–>MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56} PKR–>"C:\Program Files\PKR\uninstall-pkr.exe" QuickSet–>MsiExec.exe /I{4B6AD248-D3BF-426A-8D64-847288154F13} QuickTime–>MsiExec.exe /I{E7004147-2CCA-431C-AA05-2AB166B9785D} Rapport–>msiexec /x{1DD81E7D-0D28-4ceb-87B2-C041A4FCB215} /lvx+ "C:\ProgramData\Trusteer\Rapport\logs\uninstall.log" Rapport–>MsiExec.exe /X{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215} Safari–>MsiExec.exe /I{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43} Samsung USB Driver–>"C:\Program Files\InstallShield Installation Information\{86D6A20D-3910-4441-A3E5-EB6977251C86}\Setup.exe" -runfromtemp -l0x0009 anything -removeonly Security Update for 2007 Microsoft Office System (KB2288621)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5C497F0B-2061-4CC9-A61C-6B45B867354D} Security Update for 2007 Microsoft Office System (KB2288931)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CD769337-C8AC-46DB-A7DC-643E50089263} Security Update for 2007 Microsoft Office System (KB2289158)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {210B16C0-CEBD-4DE9-B474-04A7E8735E16} Security Update for 2007 Microsoft Office System (KB2344875)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6FC5C4C1-D7AE-44C3-94B7-6424FC3E752F} Security Update for 2007 Microsoft Office System (KB2345043)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {536FB502-775F-4494-BACE-C02CC90B7A5B} Security Update for 2007 Microsoft Office System (KB969559)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08} Security Update for 2007 Microsoft Office System (KB976321)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A} Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)–>C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A8894F19-59C8-38D2-8A75-36C0CCE56A5B} /qb+ REBOOTPROMPT="" Security Update for Microsoft Office Excel 2007 (KB2345035)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B23002DD-34EC-4988-B810-A5E2A0BF04F1} Security Update for Microsoft Office InfoPath 2007 (KB979441)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB} Security Update for Microsoft Office PowerPoint 2007 (KB982158)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F5B70033-E79C-4569-90BF-BC9B4E4F3F46} Security Update for Microsoft Office PowerPoint Viewer (KB2413381)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3DED0A62-44C8-4E00-A785-5212F297A9D9} Security Update for Microsoft Office system 2007 (972581)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF} Security Update for Microsoft Office system 2007 (KB974234)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC} Security Update for Microsoft Office Visio Viewer 2007 (KB973709)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D} Security Update for Microsoft Office Word 2007 (KB2344993)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48} Segoe UI–>MsiExec.exe /I{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA} Sky Poker–>msiexec /qb /x {0DD14E2E-48E2-3CB0-1B52-CCF9FF79C8D4} Sky Poker–>MsiExec.exe /I{0DD14E2E-48E2-3CB0-1B52-CCF9FF79C8D4} System Requirements Lab–>C:\Program Files\SystemRequirementsLab\Uninstall.exe The Sims™ 3–>"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x0009 -removeonly The Sims™ Life Stories–>C:\Program Files\Electronic Arts\The Sims Life Stories\EAUninstall.exe Update for 2007 Microsoft Office System (KB967642)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for Microsoft .NET Framework 3.5 SP1 (KB963707)–>C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT="" Update for Microsoft Office 2007 Help for Common Features (KB963673)–>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42} Update for Microsoft Office Excel 2007 Help (KB963678)–>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9} Update for Microsoft Office OneNote 2007 (KB980729)–>msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF} Update for Microsoft Office OneNote 2007 Help (KB963670)–>msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245} Update for Microsoft Office Powerpoint 2007 Help (KB963669)–>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876} Update for Microsoft Office Script Editor Help (KB963671)–>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C} Update for Microsoft Office Word 2007 Help (KB963665)–>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726} Visual C++ 2008 x86 Runtime - (v9.0.30729)–>MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27} Visual C++ 2008 x86 Runtime - v9.0.30729.01–>C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT="" Vodafone Mobile Connect Lite Huawei–>MsiExec.exe /X{F7C0163D-9CD8-4F5F-BAC8-3E45A0000AFF} William Hill POKER CLUB–>"C:\Poker\William Hill POKER CLUB\_SetupPoker[1].exe" /uninstall Windows Live Communications Platform–>MsiExec.exe /I{D45240D3-B6B3-4FF9-B243-54ECE3E10066} Windows Live Essentials–>C:\Program Files\Windows Live\Installer\wlarp.exe Windows Live Essentials–>MsiExec.exe /I{FE044230-9CA5-43F7-9B58-5AC5A28A1F33} Windows Live ID Sign-in Assistant–>MsiExec.exe /I{61AD15B2-50DB-4686-A739-14FE180D4429} Windows Live Installer–>MsiExec.exe /I{0B0F231F-CE6A-483D-AA23-77B364F75917} Windows Live Mail–>MsiExec.exe /I{9D56775A-93F3-44A3-8092-840E3826DE30} Windows Live Mail–>MsiExec.exe /I{C66824E4-CBB3-4851-BB3F-E8CFD6350923} Windows Live Messenger–>MsiExec.exe /X{80956555-A512-4190-9CAD-B000C36D6B6B} Windows Live Messenger–>MsiExec.exe /X{EB4DF488-AAEF-406F-A341-CB2AAA315B90} Windows Live MIME IFilter–>MsiExec.exe /I{AF844339-2F8A-4593-81B3-9F4C54038C4E} Windows Live Photo Common–>MsiExec.exe /X{A9BDCA6B-3653-467B-AC83-94367DA3BFE3} Windows Live Photo Common–>MsiExec.exe /X{D436F577-1695-4D2F-8B44-AC76C99E0002} Windows Live PIMT Platform–>MsiExec.exe /I{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A} Windows Live SOXE Definitions–>MsiExec.exe /I{200FEC62-3C34-4D60-9CE8-EC372E01C08F} Windows Live SOXE–>MsiExec.exe /I{682B3E4F-696A-42DE-A41C-4C07EA1678B4} Windows Live UX Platform Language Pack–>MsiExec.exe /I{6A05FEDF-662E-46BF-8A25-010E3F1C9C69} Windows Live UX Platform–>MsiExec.exe /I{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2} Windows Live Writer Resources–>MsiExec.exe /X{DDC8BDEE-DCAC-404D-8257-3E8D4B782467} Windows Live Writer–>MsiExec.exe /X{AAAFC670-569B-4A2F-82B4-42945E0DE3EF} Wireless Audio Device Manager–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{33565C22-2E44-4B36-9147-23912E838F81}\setup.exe" -l0x9 -removeonly Xvid 1.1.2 final uninstall–>"C:\Program Files\Xvid\unins000.exe" ======Security center information====== AS: Lavasoft Ad-Watch Live! (disabled) AS: Windows Defender ======System event log====== Computer Name: Vicki-PC Event Code: 7000 Message: The BCM42RLY service failed to start due to the following error: The system cannot find the file specified. Record Number: 200500 Source Name: Service Control Manager Time Written: 20100220002500.000000-000 Event Type: Error User: Computer Name: Vicki-PC Event Code: 7000 Message: The BCM42RLY service failed to start due to the following error: The system cannot find the file specified. Record Number: 200499 Source Name: Service Control Manager Time Written: 20100220002459.000000-000 Event Type: Error User: Computer Name: Vicki-PC Event Code: 7000 Message: The BCM42RLY service failed to start due to the following error: The system cannot find the file specified. Record Number: 200493 Source Name: Service Control Manager Time Written: 20100220002459.000000-000 Event Type: Error User: Computer Name: Vicki-PC Event Code: 7000 Message: The Andrea ST Filters Service service failed to start due to the following error: The system cannot find the file specified. Record Number: 200461 Source Name: Service Control Manager Time Written: 20100220002459.000000-000 Event Type: Error User: Computer Name: Vicki-PC Event Code: 7000 Message: The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. Record Number: 200458 Source Name: Service Control Manager Time Written: 20100220002459.000000-000 Event Type: Error User: =====Application event log===== Computer Name: Vicki-PC Event Code: 10 Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Record Number: 14770 Source Name: Microsoft-Windows-WMI Time Written: 20090311165119.000000-000 Event Type: Error User: Computer Name: Vicki-PC Event Code: 1530 Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-678153772-1064406113-3951244242-1000_Classes: Process 988 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-678153772-1064406113-3951244242-1000_CLASSES Record Number: 14748 Source Name: Microsoft-Windows-User Profiles Service Time Written: 20090311114835.000000-000 Event Type: Warning User: NT AUTHORITY\SYSTEM Computer Name: Vicki-PC Event Code: 1530 Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-678153772-1064406113-3951244242-1000: Process 988 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-678153772-1064406113-3951244242-1000 Record Number: 14747 Source Name: Microsoft-Windows-User Profiles Service Time Written: 20090311114833.000000-000 Event Type: Warning User: NT AUTHORITY\SYSTEM Computer Name: Vicki-PC Event Code: 1000 Message: Faulting application bcmwltry.exe, version 4.170.25.12, time stamp 0x46f3437a, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x047371c2, process id 0x668, application start time 0x01c9a216489f72ac. Record Number: 14731 Source Name: Application Error Time Written: 20090311065512.000000-000 Event Type: Error User: Computer Name: Vicki-PC Event Code: 10 Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Record Number: 14729 Source Name: Microsoft-Windows-WMI Time Written: 20090311065510.000000-000 Event Type: Error User: =====Security event log===== Computer Name: Vicki-PC Event Code: 4672 Message: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Record Number: 41160 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090721102118.076200-000 Event Type: Audit Success User: Computer Name: Vicki-PC Event Code: 4624 Message: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: VICKI-PC$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2a0 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Record Number: 41159 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090721102118.076200-000 Event Type: Audit Success User: Computer Name: Vicki-PC Event Code: 4648 Message: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: VICKI-PC$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: SYSTEM Account Domain: NT AUTHORITY Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x2a0 Process Name: C:\Windows\System32\services.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command. Record Number: 41158 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090721102118.076200-000 Event Type: Audit Success User: Computer Name: Vicki-PC Event Code: 4634 Message: An account was logged off. Subject: Security ID: S-1-5-21-678153772-1064406113-3951244242-1000 Account Name: Vicki Account Domain: Vicki-PC Logon ID: 0x7ab026 Logon Type: 7 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. Record Number: 41157 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090721102041.158000-000 Event Type: Audit Success User: Computer Name: Vicki-PC Event Code: 4634 Message: An account was logged off. Subject: Security ID: S-1-5-21-678153772-1064406113-3951244242-1000 Account Name: Vicki Account Domain: Vicki-PC Logon ID: 0x7ab041 Logon Type: 7 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer. Record Number: 41156 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090721102041.158000-000 Event Type: Audit Success User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=C:\Program Files\Common Files\Microsoft Shared\Windows Live;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Windows Live\Shared "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel "PROCESSOR_REVISION"=0f0d "NUMBER_OF_PROCESSORS"=2 "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat "DFSTRACINGON"=FALSE "asl.log"=Destination=file;OnFirstLog=command,environment,parent "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip —————–EOF—————–

gikster

Post #8January 16, 2011, 9:58 PM UTC

Logfile of random's system information tool 1.08 (written by random/random)
Run by [removed] at 2011-01-16 21:49:30
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 21 GB (21%) free of 101 GB
Total RAM: 2037 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:49:42, on 16/01/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18999)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIFIE.EXE
C:\Program Files\Digital Line Detect\DLG.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE
C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Vicki\Desktop\RSIT.exe
C:\Program Files\trend micro\Vicki.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=5080820
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Epson Stylus SX510W(Network)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFIE.EXE /FU "C:\Users\Vicki\AppData\Local\Temp\E_S9250.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Microgaming\Poker\ladbrokesMPP\MPPoker.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_b…sreqlab_srl.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - https://www.tescophoto.com/wpp/tesco/app/ImageUploader5.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark SystemInfo) - http://www.yougamers.com/systeminfo/FMSI.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - https://plugins.valueactive.eu/flashax/iefax.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9638 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Ad-Aware Update (Weekly).job
C:\Windows\tasks\Epson Printer Software Downloader.job
C:\Windows\tasks\User_Feed_Synchronization-{054FA9EA-E3C3-4B7E-9186-CE1DBE3DFE48}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}]
Easy Photo Print - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-04-02 266240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\Program Files\Dell\BAE\BAE.dll [2006-11-09 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-05-21 1233288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} - Easy Photo Print - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-04-02 266240]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-05-21 1233288]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ECenter"=C:\Dell\E-Center\EULALauncher.exe [2008-02-29 17920]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2008-05-04 167936]
"OEM02Mon.exe"=C:\Windows\OEM02Mon.exe [2008-03-04 36864]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-03-06 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-03-06 166424]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-03-06 133656]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-03-21 174872]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2008-05-16 3444736]
"dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2008-03-11 16384]
"EEventManager"=C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [2009-01-12 669520]
"dellsupportcenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2008-08-13 206064]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-09-08 47904]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-09-08 421888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-09-24 421160]
"NBAgent"=C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2010-09-28 1406248]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"Epson Stylus SX510W(Network)"=C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFIE.EXE [2008-11-20 199680]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2010-03-15 524632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
C:\Program Files\Electronic Arts\EADM\Core.exe [2009-09-03 3342336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iolo Startup]
C:\Program Files\iolo\Common\Lib\ioloLManager.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2010-09-24 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileConnect]
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2008-03-13 2060288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2010-09-22 4240760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
C:\Program Files\Dell\MediaDirect\PCMService.exe [2007-12-21 184320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2010-09-08 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Vicki^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dell Dock.lnk]
C:\PROGRA~1\Dell\DellDock\DellDock.exe [2008-05-13 1058088]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist]
C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll [2008-08-20 10536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-03-06 200704]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\GoToAssist]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"EnableLinkedConnections"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - NOTEPAD.EXE %1
.reg - open - NOTEPAD.EXE %1
.scr - open - NOTEPAD.EXE %1
.vbs - open - NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2011-01-16 21:49:30 —-D—- C:\rsit
2011-01-15 16:42:15 —-A—- C:\Windows\system32\win32k.sys
2011-01-15 16:41:56 —-A—- C:\Windows\system32\wmicmiplugin.dll
2011-01-15 16:41:56 —-A—- C:\Windows\system32\schedsvc.dll
2011-01-15 16:41:55 —-A—- C:\Windows\system32\taskschd.dll
2011-01-15 16:41:55 —-A—- C:\Windows\system32\taskeng.exe
2011-01-15 16:41:54 —-A—- C:\Windows\system32\taskcomp.dll
2011-01-15 16:41:39 —-A—- C:\Windows\system32\consent.exe
2011-01-15 16:41:26 —-A—- C:\Windows\system32\fontsub.dll
2011-01-15 16:41:26 —-A—- C:\Windows\system32\atmlib.dll
2011-01-15 16:41:26 —-A—- C:\Windows\system32\atmfd.dll
2011-01-15 16:40:48 —-A—- C:\Windows\system32\ieui.dll
2011-01-15 16:40:47 —-A—- C:\Windows\system32\iesysprep.dll
2011-01-15 16:40:47 —-A—- C:\Windows\system32\ieframe.dll
2011-01-15 16:40:46 —-A—- C:\Windows\system32\iesetup.dll
2011-01-15 16:40:46 —-A—- C:\Windows\system32\iernonce.dll
2011-01-15 16:40:46 —-A—- C:\Windows\system32\ie4uinit.exe
2011-01-15 16:40:45 —-A—- C:\Windows\system32\occache.dll
2011-01-15 16:40:45 —-A—- C:\Windows\system32\iertutil.dll
2011-01-15 16:40:44 —-A—- C:\Windows\system32\ieUnatt.exe
2011-01-15 16:40:41 —-A—- C:\Windows\system32\mshtmled.dll
2011-01-15 16:40:41 —-A—- C:\Windows\system32\mshtml.dll
2011-01-15 16:40:40 —-A—- C:\Windows\system32\msfeedssync.exe
2011-01-15 16:40:40 —-A—- C:\Windows\system32\msfeedsbs.dll
2011-01-15 16:40:40 —-A—- C:\Windows\system32\msfeeds.dll
2011-01-15 16:40:39 —-A—- C:\Windows\system32\licmgr10.dll
2011-01-15 16:40:39 —-A—- C:\Windows\system32\iepeers.dll
2011-01-15 16:40:38 —-A—- C:\Windows\system32\iedkcs32.dll
2011-01-15 16:40:37 —-A—- C:\Windows\system32\wininet.dll
2011-01-15 16:40:37 —-A—- C:\Windows\system32\jsproxy.dll
2011-01-15 16:40:35 —-A—- C:\Windows\system32\mstime.dll
2011-01-15 16:40:34 —-A—- C:\Windows\system32\urlmon.dll
2011-01-15 16:39:32 —-A—- C:\Windows\system32\tzres.dll
2011-01-15 16:25:03 —-A—- C:\Windows\system32\odbc32.dll
2011-01-15 16:24:00 —-A—- C:\Windows\system32\sdclt.exe
2011-01-15 16:02:46 —-D—- C:\Users\Vicki\AppData\Roaming\com.orbis.air.SkyPoker.7C82499D7E4526CADD9D1D1B010AFE250A7BEC27.1
2011-01-15 15:59:48 —-D—- C:\Program Files\SkyPoker

======List of files/folders modified in the last 1 months======

2011-01-16 21:49:42 —-D—- C:\Program Files\Trend Micro
2011-01-16 21:49:33 —-D—- C:\Windows\Temp
2011-01-16 21:47:39 —-D—- C:\Windows\winsxs
2011-01-16 21:32:18 —-D—- C:\Program Files\Common Files\Akamai
2011-01-16 19:23:38 —-D—- C:\Windows\system32\migration
2011-01-16 19:23:38 —-D—- C:\Windows\System32
2011-01-16 19:23:38 —-D—- C:\Program Files\Windows Mail
2011-01-16 19:23:38 —-D—- C:\Program Files\Internet Explorer
2011-01-16 19:23:23 —-D—- C:\Users\Vicki\AppData\Roaming\SoftGrid Client
2011-01-16 19:10:16 —-A—- C:\Windows\system32\mrt.exe
2011-01-16 19:06:09 —-D—- C:\Windows\system32\en-US
2011-01-16 19:04:46 —-D—- C:\Windows\system32\catroot
2011-01-16 19:02:23 —-SHD—- C:\System Volume Information
2011-01-16 18:56:24 —-D—- C:\Program Files\Microsoft Silverlight
2011-01-15 23:41:55 —-D—- C:\Windows\system32\config
2011-01-15 23:41:31 —-SD—- C:\Windows\Downloaded Program Files
2011-01-15 23:41:31 —-RSD—- C:\Windows\Media
2011-01-15 23:41:31 —-D—- C:\Windows\system32\wbem
2011-01-15 23:41:31 —-D—- C:\Program Files\Common Files\Services
2011-01-15 23:41:30 —-D—- C:\Windows\Tasks
2011-01-15 23:41:30 —-D—- C:\Windows\system32\Tasks
2011-01-15 23:41:30 —-D—- C:\Windows\system32\spool
2011-01-15 23:41:30 —-D—- C:\Windows\system32\Msdtc
2011-01-15 23:41:30 —-D—- C:\Windows\inf
2011-01-15 23:41:30 —-D—- C:\Windows
2011-01-15 23:41:25 —-D—- C:\Program Files\Full Tilt Poker
2011-01-15 23:41:20 —-D—- C:\Windows\registration
2011-01-15 16:42:06 —-D—- C:\Windows\system32\catroot2
2011-01-15 16:31:18 —-SHD—- C:\Windows\Installer
2011-01-15 16:30:11 —-D—- C:\Program Files\Microsoft Works
2011-01-15 16:23:39 —-D—- C:\ProgramData\Microsoft Help
2011-01-15 16:02:12 —-D—- C:\ProgramData\Adobe
2011-01-15 15:59:48 —-RD—- C:\Program Files
2011-01-15 15:58:37 —-D—- C:\Program Files\Adobe
2011-01-15 15:57:05 —-D—- C:\Program Files\Common Files\Adobe AIR
2011-01-15 15:55:56 —-D—- C:\Users\Vicki\AppData\Roaming\Microgaming
2011-01-15 15:55:13 —-D—- C:\Users\Vicki\AppData\Roaming\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys [2007-09-06 304920]
R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys [2009-05-04 64160]
R0 RapportKELL;RapportKELL; C:\Windows\System32\Drivers\RapportKELL.sys [2010-10-03 59240]
R1 RapportCerberus_19917;RapportCerberus_19917; \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [2010-10-03 34792]
R1 RapportPG;RapportPG; \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys [2010-10-03 169320]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2008-06-23 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-09-06 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-09-06 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-09-06 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2008-06-23 8704]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2008-05-04 164400]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2008-05-16 1044984]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2008-06-23 980992]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2008-06-23 208384]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-03-06 2016256]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service; C:\Windows\system32\drivers\IntcHdmi.sys [2008-03-06 111616]
R3 OEM02Dev;Creative Camera OEM002 Driver; C:\Windows\system32\DRIVERS\OEM02Dev.sys [2008-03-04 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver; C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2008-03-04 7424]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 sftfs;sftfs; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftfslh.sys [2009-09-23 543064]
R3 sftplay;sftplay; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftplaylh.sys [2009-09-23 190312]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2009-09-23 21848]
R3 sftvol;sftvol; \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftvollh.sys [2009-09-23 14680]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-06-23 661504]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-09-29 278528]
S3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys []
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-21 220672]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2008-09-17 27672]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2008-03-07 101504]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032]
S3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Akamai;Akamai NetSession Interface; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-07-27 345376]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2009-09-26 819600]
R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [2006-12-19 94208]
R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-03-21 355096]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-01 1029456]
R2 NAUpdate;@C:\Program Files\Nero\Update\NASvc.exe,-200; C:\Program Files\Nero\Update\NASvc.exe [2010-05-04 503080]
R2 RapportMgmtService;Rapport Management Service; C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe [2010-10-03 767208]
R2 sftlist;Application Virtualization Client; C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe [2009-09-23 447832]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-08-13 201968]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2008-05-16 24064]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2008-06-23 386560]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-09-24 820008]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe [2009-09-23 203608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 GoToAssist;GoToAssist; C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe [2008-08-20 16680]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2009-09-26 149336]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-09-26 4639136]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 VMCService;Vodafone Mobile Connect Service; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-03-13 24576]

—————–EOF—————–

JonTom

Post #9January 17, 2011, 8:36 AM UTC

Hello gikster

Thank you for the logs. Please work your way through the following steps:

Please un-install Ask Toolbar
- Click on "Windows Orb" then on "Computer" and then on the "Uninstall or change a program" tab.
- A list of currently installed programs will be displayed.
- Find the "Ask Toolbar" program, click on it once and then click on the "uninstall" button.
- If you are prompted to re-boot your computer to complete the uninstall please do so.
P2P Programs:
- P2P programs are a major source of Malware infections.
- From your log I see you have FrostWire 4.17.0 and LimeWire 5.1.4. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
- The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
- If you wish to keep the program(s), please do not use them until your computer is cleaned.
- Information regarding the risk of using these programs can be found from here and here.
- It is strongly recommend that you uninstall any P2P programs you have on your system.
- To do this, Click on the "Windows Orb" (bottom left hand corner of your screen), then on "Computer" and then on the "Uninstall or Change a Program" tab.
- A list of currently installed programs will be displayed.
- Find the "FrostWire" and "LimeWire" programs, click on them once and then click on the "Uninstall" button.
- If you are prompted to re-boot your computer to complete the uninstall please do so.
  
  PLEASE NOTE:
- Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.
Please scan your system with GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
- Extract the contents of the zipped file to desktop.
- Right click on GMER.exe and select "Run as Administrator" to run the program. If asked to allow gmer.sys driver to load, please consent.
- If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
- In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please post the GMER log in your next reply. If you have any trouble getting the scan to complete just come back and let me know.

gikster

Post #10January 17, 2011, 11:20 PM UTC

I tried to uninstall ask toolbar but couldnt find it on programs list.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-17 23:18:23
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST912081 rev.3.AD
Running: gmer.exe; Driver: C:\Users\Vicki\AppData\Local\Temp\pglcypoc.sys

—- System - GMER 1.0.15 —-

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwAssignProcessToJobObject [0x8E97BFE4]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwCreateFile [0x8E97C996]
SSDT \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys ZwCreateThread [0x8F7EE864]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteFile [0x8E97CAF6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteKey [0x8E98036C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteValueKey [0x8E98039E]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwLoadKey [0x8E980500]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwOpenFile [0x8E97CA5A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwOpenProcess [0x8E97C128]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwOpenThread [0x8E97C31A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwProtectVirtualMemory [0x8E97C44C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwQueryValueKey [0x8E980476]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwRenameKey [0x8E9803E0]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwReplaceKey [0x8E980412]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwRestoreKey [0x8E980444]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSetContextThread [0x8E97BF8A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSetInformationFile [0x8E97CB56]
SSDT \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys ZwSetValueKey [0x8F7EE82E]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwSuspendThread [0x8E97BF26]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwTerminateProcess [0x8E97BE7A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwTerminateThread [0x8E97BEC2]
SSDT \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys ZwCreateThreadEx [0x8F7EE8DC]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 191 840F28F4 4 Bytes [E4, BF, 97, 8E]
.text ntkrnlpa.exe!KeSetEvent + 1D9 840F293C 4 Bytes [96, C9, 97, 8E]
.text ntkrnlpa.exe!KeSetEvent + 221 840F2984 4 Bytes CALL 8E8AB907 \SystemRoot\system32\DRIVERS\OEM02Dev.sys (Video Capture Device Driver/Creative Technology Ltd.)
.text ntkrnlpa.exe!KeSetEvent + 2D1 840F2A34 8 Bytes [F6, CA, 97, 8E, 6C, 03, 98, …]
.text ntkrnlpa.exe!KeSetEvent + 2E1 840F2A44 4 Bytes [9E, 03, 98, 8E]
.text …

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1060] ntdll.dll!KiUserApcDispatcher 77D75D18 5 Bytes JMP 00414C10 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1060] USER32.dll!InSendMessageEx + 3B1 76FAE6B0 6 Bytes JMP 716E001E
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1060] WS2_32.dll!getaddrinfo 7647418A 5 Bytes JMP 71640022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1060] WS2_32.dll!gethostbyname 764862D4 5 Bytes JMP 71670022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3324] ntdll.dll!KiUserApcDispatcher 77D75D18 5 Bytes JMP 004397C0 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (RapportService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3324] WS2_32.dll!getaddrinfo 7647418A 5 Bytes JMP 71670022
.text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[3324] WS2_32.dll!gethostbyname 764862D4 5 Bytes JMP 716E0022
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] ntdll.dll!LdrLoadDll + 1 77D39391 5 Bytes [22, 00, 67, 71, C3]
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] ntdll.dll!KiUserApcDispatcher 77D75D18 5 Bytes JMP 02317420 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] kernel32.dll!SetUnhandledExceptionFilter 76B4A84F 6 Bytes PUSH 71580022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!DdeInitializeW 76FA7921 6 Bytes PUSH 71520022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!RegisterClassExW 76FADA30 6 Bytes PUSH 716E0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!RegisterClassA 76FADF42 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!RegisterClassW 76FAE1AB 6 Bytes PUSH 715E0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!CreateWindowExW 76FB1305 5 Bytes JMP 6C82DB44 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!TranslateMessage 76FC01AD 6 Bytes PUSH 714C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!DialogBoxParamW 76FD10B0 5 Bytes JMP 6C755501 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!DialogBoxIndirectParamW 76FD2EF5 5 Bytes JMP 6C924FEF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!GetClipboardData 76FE715A 6 Bytes PUSH 714F0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!DialogBoxParamA 76FE8152 5 Bytes JMP 6C924F8C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!DialogBoxIndirectParamA 76FE847D 5 Bytes JMP 6C925052 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!MessageBoxIndirectA 76FFD4D9 5 Bytes JMP 6C924F21 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!MessageBoxIndirectW 76FFD5D3 5 Bytes JMP 6C924EB6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!MessageBoxExA 76FFD639 5 Bytes JMP 6C924E54 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] USER32.dll!MessageBoxExW 76FFD65D 5 Bytes JMP 6C924DF2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] GDI32.dll!BitBlt 77F270A6 6 Bytes PUSH 715B0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] ole32.dll!CoCreateInstance 76EA9F3E 5 Bytes JMP 71640022
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] ole32.dll!CoCreateInstanceEx 76EA9F81 5 Bytes JMP 71550022
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetCloseHandle 76859088 6 Bytes PUSH 71340022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetQueryDataAvailable 7685BF83 6 Bytes PUSH 711F0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpAddRequestHeadersA 7685CF4E 6 Bytes PUSH 71490022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpOpenRequestA 7685D508 6 Bytes PUSH 71460022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetConnectA 7685DEAE 6 Bytes PUSH 71310022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetConnectW 7685F862 6 Bytes PUSH 712E0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpSendRequestW 7685FABE 6 Bytes PUSH 71370022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpOpenRequestW 7685FBFB 6 Bytes PUSH 71430022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetOpenA 7686D690 6 Bytes PUSH 71250022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetOpenW 7686DB09 6 Bytes PUSH 71220022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetSetStatusCallback 7686DCC8 6 Bytes PUSH 71190022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpSendRequestA 7686EE89 6 Bytes PUSH 71400022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetReadFileExA 76873381 6 Bytes PUSH 711C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetGetCookieExA 76874BD0 6 Bytes PUSH 71280022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetWriteFile 768B608E 6 Bytes PUSH 71160022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpSendRequestExA 768CA666 6 Bytes PUSH 713D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!HttpSendRequestExW 768CA6BF 6 Bytes PUSH 713A0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] WININET.dll!InternetGetCookieA 768CBD44 6 Bytes PUSH 712B0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] ws2_32.dll!connect 764740D9 5 Bytes JMP 710F0022
.text C:\Program Files\Internet Explorer\iexplore.exe[3852] ws2_32.dll!getaddrinfo 7647418A 5 Bytes JMP 710B0022
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtClose 77D74314 5 Bytes JMP 69594A22 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtCreateFile 77D743D4 5 Bytes JMP 69593754 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtCreateKey 77D74414 5 Bytes JMP 69590ACC C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtDeleteFile 77D747B4 5 Bytes JMP 69593571 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtDeleteKey 77D747C4 5 Bytes JMP 6959023F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtDeleteValueKey 77D747F4 5 Bytes JMP 69590502 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtDuplicateObject 77D74824 5 Bytes JMP 69594AF8 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtEnumerateKey 77D74864 5 Bytes JMP 695902E3 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtEnumerateValueKey 77D74894 5 Bytes JMP 6959045C C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtFlushKey 77D748F4 5 Bytes JMP 69590291 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtNotifyChangeKey 77D74B64 5 Bytes JMP 695905B0 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtNotifyChangeMultipleKeys 77D74B74 5 Bytes JMP 6959063E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtOpenFile 77D74BB4 5 Bytes JMP 695938DF C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtOpenKey 77D74BE4 5 Bytes JMP 695909DD C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryAttributesFile 77D74D54 5 Bytes JMP 695935DC C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryDirectoryFile 77D74DB4 5 Bytes JMP 695927E2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryFullAttributesFile 77D74E04 5 Bytes JMP 6959364C C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryKey 77D74EB4 5 Bytes JMP 69590336 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryMultipleValueKey 77D74EC4 5 Bytes JMP 6959055D C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryObject 77D74EE4 5 Bytes JMP 69594B4E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQuerySecurityObject 77D74F44 5 Bytes JMP 69594A92 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtQueryValueKey 77D74FD4 5 Bytes JMP 69590409 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtRenameKey 77D750C4 5 Bytes JMP 69590B41 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtSetInformationFile 77D752E4 5 Bytes JMP 695936BC C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtSetInformationKey 77D75304 5 Bytes JMP 6959039C C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtSetSecurityObject 77D753B4 5 Bytes JMP 69594BAB C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ntdll.dll!NtSetValueKey 77D75454 5 Bytes JMP 695904AF C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] kernel32.dll!CreateProcessW 76B21BF3 5 Bytes JMP 6956F355 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] kernel32.dll!CreateProcessA 76B21C28 5 Bytes JMP 6956F493 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] kernel32.dll!LoadLibraryExW 76B49109 7 Bytes JMP 6956FEAA C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] kernel32.dll!SetDllDirectoryW 76BB2467 5 Bytes JMP 6957031E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] kernel32.dll!WinExec 76BB5CF7 5 Bytes JMP 6956FA4C C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] GDI32.dll!AddFontResourceW 77F4CC93 5 Bytes JMP 6957D5BE C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] GDI32.dll!AddFontResourceA 77F4CFBF 5 Bytes JMP 6957D5A2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!StartServiceA 77E5A24D 7 Bytes JMP 6957FD2B C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!CreateProcessAsUserA 77E5CEB9 5 Bytes JMP 6956F80B C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!CreateProcessAsUserW 77E71EE9 5 Bytes JMP 6956F6C9 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!OpenSCManagerA 77E72D93 7 Bytes JMP 6957F741 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!OpenServiceA 77E72EBD 7 Bytes JMP 6957F8B0 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!StartServiceW 77E73E0B 7 Bytes JMP 6957FC95 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceStatusEx 77E74FFE 7 Bytes JMP 6957FF39 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceConfigW 77E750A4 7 Bytes JMP 695809D5 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceConfigA 77E751AD 7 Bytes JMP 69580A6E C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!OpenSCManagerW 77E77137 7 Bytes JMP 6957F6B5 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!CloseServiceHandle 77E782A5 7 Bytes JMP 69580143 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!OpenServiceW 77E78354 7 Bytes JMP 6957F824 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceStatus 77E7842C 7 Bytes JMP 6957FEA6 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!CreateServiceW 77E99EB4 7 Bytes JMP 6957F9AE C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ControlService 77E99FB8 7 Bytes JMP 6957FE1A C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!DeleteService 77E9A07E 7 Bytes JMP 695801D1 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!GetServiceDisplayNameW 77E9B0B3 7 Bytes JMP 69580824 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!GetServiceKeyNameW 77E9B164 7 Bytes JMP 69580673 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!EnumServicesStatusExA 77E9B31B 7 Bytes JMP 69580FB3 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ControlServiceExA 77ED662E 7 Bytes JMP 6957F167 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ControlServiceExW 77ED6741 7 Bytes JMP 6957F0EE C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!EnumServicesStatusExW 77ED6909 7 Bytes JMP 69580EED C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!EnumServicesStatusA 77ED6B47 7 Bytes JMP 69580E2F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceObjectSecurity 77ED6C21 7 Bytes JMP 69580C3F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!SetServiceObjectSecurity 77ED6CD9 7 Bytes JMP 69580CDB C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ChangeServiceConfigA 77ED6DD9 7 Bytes JMP 69580344 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ChangeServiceConfigW 77ED6F81 7 Bytes JMP 6958025F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ChangeServiceConfig2A 77ED7099 7 Bytes JMP 695805DD C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!ChangeServiceConfig2W 77ED71E1 7 Bytes JMP 69580547 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!CreateServiceA 77ED72A1 7 Bytes JMP 6957FA84 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!EnumDependentServicesA 77ED7505 7 Bytes JMP 6958008C C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!EnumDependentServicesW 77ED75D9 7 Bytes JMP 6957FFD5 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!GetServiceDisplayNameA 77ED76B1 7 Bytes JMP 695808DC C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!GetServiceKeyNameA 77ED7759 7 Bytes JMP 6958072B C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceConfig2A 77ED7891 7 Bytes JMP 69580BA3 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!QueryServiceConfig2W 77ED7A19 7 Bytes JMP 69580B07 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ADVAPI32.dll!EnumServicesStatusW 77ED7F61 5 Bytes JMP 69580D71 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoRegisterPSClsid 76E52746 5 Bytes JMP 69585C79 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoResumeClassObjects + 7 76E62C12 7 Bytes JMP 69586248 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoRegisterClassObject 76E67DBE 5 Bytes JMP 69586CE8 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!OleInitialize 76E6EE4B 5 Bytes JMP 69585FB2 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!OleRun 76E6F3F4 5 Bytes JMP 69586103 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoGetPSClsid 76E71B2B 5 Bytes JMP 69585DEF C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoGetClassObject 76E8FAE8 5 Bytes JMP 69587049 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoRevokeClassObject 76E9B109 5 Bytes JMP 6958585F C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoCreateInstanceEx 76EA9F81 5 Bytes JMP 69586688 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoInitializeEx 76EAADFB 5 Bytes JMP 69585E62 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoUninitialize 76EAD309 5 Bytes JMP 69585EE4 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoSuspendClassObjects + 7 76EB19A9 7 Bytes JMP 69586173 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!OleUninitialize 76ECB90D 6 Bytes JMP 69586022 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!CoGetInstanceFromFile 76EFC595 5 Bytes JMP 69587501 C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[4300] ole32.dll!OleRegEnumFormatEtc 76F45657 5 Bytes JMP 6958608D C:\Windows\system32\sftldr.dll (Microsoft Application Virtualization SoftLoader/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] ntdll.dll!LdrLoadDll + 1 77D39391 5 Bytes [22, 00, 67, 71, C3]
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] ntdll.dll!KiUserApcDispatcher 77D75D18 5 Bytes JMP 01D67420 c:\program files\trusteer\rapport\bin\rooksdol.dll (Rooks/Dolomite/Trusteer Ltd.)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] kernel32.dll!SetUnhandledExceptionFilter 76B4A84F 6 Bytes PUSH 71580022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!CreateDialogParamW 76FA72A2 5 Bytes JMP 6C82DED0 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!DdeInitializeW 76FA7921 6 Bytes PUSH 71520022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!GetAsyncKeyState 76FA863C 5 Bytes JMP 6C748F1F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!SetWindowsHookExW 76FA87AD 5 Bytes JMP 6C829AE9 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!CallNextHookEx 76FA8E3B 5 Bytes JMP 6C81D145 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!UnhookWindowsHookEx 76FA98DB 5 Bytes JMP 6C794696 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!EnableWindow 76FACD8B 5 Bytes JMP 6C82DD5D C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!RegisterClassExW 76FADA30 6 Bytes PUSH 716E0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!RegisterClassA 76FADF42 6 Bytes PUSH 71610022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!RegisterClassW 76FAE1AB 6 Bytes PUSH 715E0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!CreateWindowExW 76FB1305 5 Bytes JMP 6C82DB44 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!GetKeyState 76FB8CB1 5 Bytes JMP 6C82D30B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!TranslateMessage 76FC01AD 6 Bytes PUSH 714C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!IsDialogMessageW 76FC0745 5 Bytes JMP 6C755A13 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!CreateDialogParamA 76FC17AA 5 Bytes JMP 6C925C74 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!IsDialogMessage 76FC1847 5 Bytes JMP 6C925510 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!CreateDialogIndirectParamA 76FC26F1 5 Bytes JMP 6C925CAB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!CreateDialogIndirectParamW 76FC9A62 5 Bytes JMP 6C925CE2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!SetKeyboardState 76FD0987 5 Bytes JMP 6C92587F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!DialogBoxParamW 76FD10B0 5 Bytes JMP 6C755501 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!DialogBoxIndirectParamW 76FD2EF5 5 Bytes JMP 6C924FEF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!SendInput 76FD2F75 5 Bytes JMP 6C92643B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!EndDialog 76FD326E 5 Bytes JMP 6C757EBA C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!SetCursorPos 76FE6FB2 5 Bytes JMP 6C92648F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!GetClipboardData 76FE715A 6 Bytes PUSH 714F0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!DialogBoxParamA 76FE8152 5 Bytes JMP 6C924F8C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!DialogBoxIndirectParamA 76FE847D 5 Bytes JMP 6C925052 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!MessageBoxIndirectA 76FFD4D9 5 Bytes JMP 6C924F21 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!MessageBoxIndirectW 76FFD5D3 5 Bytes JMP 6C924EB6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!MessageBoxExA 76FFD639 5 Bytes JMP 6C924E54 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!MessageBoxExW 76FFD65D 5 Bytes JMP 6C924DF2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] USER32.dll!keybd_event 76FFD972 5 Bytes JMP 6C9267BF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] GDI32.dll!BitBlt 77F270A6 6 Bytes PUSH 715B0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] SHELL32.dll!SHRestricted + D95 772089A8 4 Bytes [4D, 30, 75, 67] {DEC EBP; XOR [EBP+0x67], DH}
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] SHELL32.dll!SHRestricted + D9D 772089B0 8 Bytes [57, 2F, 75, 67, 9C, 5B, 74, …] {PUSH EDI; DAS ; JNZ 0x6b; PUSHF ; POP EBX; JZ 0x6f}
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] ole32.dll!OleLoadFromStream 76E71E80 5 Bytes JMP 6C925370 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] ole32.dll!CoCreateInstance 76EA9F3E 5 Bytes JMP 6C82DBA0 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] ole32.dll!CoCreateInstanceEx 76EA9F81 5 Bytes JMP 71550022
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WS2_32.dll!connect 764740D9 5 Bytes JMP 710F0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WS2_32.dll!getaddrinfo 7647418A 5 Bytes JMP 710B0022
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetCloseHandle 76859088 6 Bytes PUSH 71340022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetQueryDataAvailable 7685BF83 6 Bytes PUSH 711F0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpAddRequestHeadersA 7685CF4E 6 Bytes PUSH 71490022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpOpenRequestA 7685D508 6 Bytes PUSH 71460022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetConnectA 7685DEAE 6 Bytes PUSH 71310022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetConnectW 7685F862 6 Bytes PUSH 712E0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpSendRequestW 7685FABE 6 Bytes PUSH 71370022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpOpenRequestW 7685FBFB 6 Bytes PUSH 71430022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetOpenA 7686D690 6 Bytes PUSH 71250022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetOpenW 7686DB09 6 Bytes PUSH 71220022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetSetStatusCallback 7686DCC8 6 Bytes PUSH 71190022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpSendRequestA 7686EE89 6 Bytes PUSH 71400022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetReadFileExA 76873381 6 Bytes PUSH 711C0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetGetCookieExA 76874BD0 6 Bytes PUSH 71280022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetWriteFile 768B608E 6 Bytes PUSH 71160022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpSendRequestExA 768CA666 6 Bytes PUSH 713D0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!HttpSendRequestExW 768CA6BF 6 Bytes PUSH 713A0022; RET
.text C:\Program Files\Internet Explorer\iexplore.exe[4920] WININET.dll!InternetGetCookieA 768CBD44 6 Bytes PUSH 712B0022; RET

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

JonTom

Post #11January 18, 2011, 8:10 AM UTC

Hello gikster

Thank you for the logs.

Are you experiencing any other symptoms besides a slow machine (redirects, popups, error messages etc)?

I tried to uninstall ask toolbar but couldnt find it on programs list.

We can take care of it manually:

Please search for the following folder
- Right-click your "Windows Orb" button and select "Explore".
- Navigate to and delete the following folder in bold.
C:\Program Files\Ask.com <==== Delete this folder.
Temporary File Cleaner
- Download TFC to your desktop.
- Close any open windows.
- Right click the TFC icon and select "Run as Administrator" to run the program.
- TFC will close all open programs itself in order to run.
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish.
- Once complete it should automatically reboot your machine.
- If your machine does not reboot automatically, manually reboot to ensure a complete clean.
- Note: After running TFC your machine may take slightly longer to boot the first time. This is normal.
Please perform the following scan:
- Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
- Right click on the mbam-setup.exe icon and select "Run as Administrator" to install the program.
- Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
- Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
- Click on the "Update" tab and then on "Check for Updates".
- The program will now install the latest Malware definition files.
- Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
- Once the program has scanned your computer, a log file will be created in Notepad.
- Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
- If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
- When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
- The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
- Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
- Come back here to this thread and Paste the log in your next reply.
Security Check
- Please download Security Check by screen317 from here or here and save the file (called securitycheck.exe) to your desktop.
- Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box (NOTE: If you are running Vista or Win7 please Right click and select "Run as Administrator"..
- A Notepad document should open automatically called checkup.txt; please post the contents of that document in your next reply.
Please post the MBAM log and the Security Check log in your next reply

gikster

Post #12January 18, 2011, 2:05 PM UTC

Hi, Am getting definately getting pop ups, not noticed any redirects or error messages

gikster

Post #13January 18, 2011, 2:14 PM UTC

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5544 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18999 18/01/2011 14:14:01 mbam-log-2011-01-18 (14-14-01).txt Scan type: Quick scan Objects scanned: 163252 Time elapsed: 7 minute(s), 33 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 2 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully. Folders Infected: c:\Users\Vicki\AppData\Roaming\microsoft\Windows\start menu\Programs\videoplay (Trojan.DNSChanger) -> Quarantined and deleted successfully. c:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully. Files Infected: c:\Users\Vicki\local settings\application data\_rr_ahuqufun.dll (Trojan.Hiloti) -> Quarantined and deleted successfully. c:\Users\Vicki\local settings\application data\_rr_unstof.dll (Trojan.Hiloti) -> Quarantined and deleted successfully. c:\Users\Katie\local settings\temporary internet files\Content.IE5\I5VD2ER3\play_mp3[1].exe (Adware.PlayMP3) -> Quarantined and deleted successfully. c:\Users\Vicki\local settings\temporary internet files\Content.IE5\MYX2V2HJ\downloadclient[1].exe (PUP.Casino) -> Quarantined and deleted successfully.

gikster

Post #14January 18, 2011, 2:24 PM UTC

Results of screen317's Security Check version 0.99.8
Windows Vista Service Pack 2 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
Java™ 6 Update 5
Out of date Java installed!
Adobe Flash Player 10.0.32.18
Adobe Reader 9.3.1
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSASCui.exe
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe
Windows Defender MSASCui.exe
``````````End of Log````````````

JonTom

Post #15January 18, 2011, 8:16 PM UTC

Hello gikster

Thank you for the log.

Am getting definately getting pop ups

Thank you for letting me know

The security check log indicates that you do not have a real time anti-virus installed. While we are cleaning your system please refrain from using the Iternet except to download the tools we require and to post replies back to this forum. Once you machine is clean I will provide some links to a number os free (and trustworthy) AV products.

In the meantime, please do the following:

Combofix
Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
Right click on ComboFix.exe and select "Run as Administrator" to run the program. Follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please Help

✨ Ask AI

Ask AI