Spyware / Malware / Virus Removal

Possible bot and Generic Host Process problem

11 min read

Looking for the outcome? Ask AI

Fentyn Topic Starter

Post #1February 10, 2011, 1:29 AM UTC

Hey Guys, Thanks in advance for the help! I've been having some trouble with my PC lately and was hoping if you guys could help me out any. I have recently been noticing that my Google links start to redirect me to random websites and as I ran my BitDefender the other day it found some Backdoor.Bot file that it was unable to get rid of. There were I believe 4 of them and it said it got rid of 3 of them but couldn't do anything about the 4th. There was another file that it was unable to do anything with that was a Java.Trojan.OpenConnection.AI I believe it was, I forgot to write it down unfortunately. Those things aside, I keep getting a Generic Host Has encountered a problem and needs to close error. Most often the culprit seems to be an svchost.exe file and some .dll file (not sure if this is malware but I assume it might be). Here is my Hijackthis Log. And thanks again for your help.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:20:55, on 2/9/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Music\iTunes\iTunesHelper.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe
C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WUSB54Gv4] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [iTunesHelper] "D:\Music\iTunes\iTunesHelper.exe"
O4 - HKUS\S-1-5-18\..\Run: [jlqviiua] C:\WINDOWS\TEMP\iioerdmhh\sqedmxosika.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [jlqviiua] C:\WINDOWS\TEMP\iioerdmhh\sqedmxosika.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_b…sreqlab_srl.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: WUSB54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

–
End of file - 8099 bytes

mowman

Post #2February 10, 2011, 2:02 AM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

Fentyn

Post #3February 10, 2011, 3:53 AM UTC

The logs you requested.

TDSSKiller:

2011/02/09 22:38:09.0437 2688 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03
2011/02/09 22:38:09.0609 2688 ================================================================================
2011/02/09 22:38:09.0609 2688 SystemInfo:
2011/02/09 22:38:09.0609 2688
2011/02/09 22:38:09.0609 2688 OS Version: 5.1.2600 ServicePack: 3.0
2011/02/09 22:38:09.0609 2688 Product type: Workstation
2011/02/09 22:38:09.0609 2688 ComputerName: JANGO
2011/02/09 22:38:09.0609 2688 UserName: Ian Gough
2011/02/09 22:38:09.0609 2688 Windows directory: C:\WINDOWS
2011/02/09 22:38:09.0609 2688 System windows directory: C:\WINDOWS
2011/02/09 22:38:09.0609 2688 Processor architecture: Intel x86
2011/02/09 22:38:09.0609 2688 Number of processors: 4
2011/02/09 22:38:09.0609 2688 Page size: 0x1000
2011/02/09 22:38:09.0609 2688 Boot type: Normal boot
2011/02/09 22:38:09.0609 2688 ================================================================================
2011/02/09 22:38:09.0953 2688 Initialize success
2011/02/09 22:38:18.0609 0312 ================================================================================
2011/02/09 22:38:18.0609 0312 Scan started
2011/02/09 22:38:18.0609 0312 Mode: Manual;
2011/02/09 22:38:18.0609 0312 ================================================================================
2011/02/09 22:38:22.0031 0312 28927091 (7dd41b7ac1fbb1dbf20bb1f4e4fbe58c) C:\WINDOWS\system32\DRIVERS\28927091.sys
2011/02/09 22:38:22.0203 0312 28927092 (a305fad3719c5db0c13d1c2bfd08a04d) C:\WINDOWS\system32\DRIVERS\28927092.sys
2011/02/09 22:38:22.0265 0312 73121631 (7dd41b7ac1fbb1dbf20bb1f4e4fbe58c) C:\WINDOWS\system32\DRIVERS\73121631.sys
2011/02/09 22:38:22.0296 0312 73121632 (a305fad3719c5db0c13d1c2bfd08a04d) C:\WINDOWS\system32\DRIVERS\73121632.sys
2011/02/09 22:38:22.0453 0312 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/02/09 22:38:22.0531 0312 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/02/09 22:38:22.0656 0312 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
2011/02/09 22:38:22.0750 0312 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/02/09 22:38:23.0265 0312 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
2011/02/09 22:38:23.0562 0312 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/02/09 22:38:24.0031 0312 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/02/09 22:38:24.0203 0312 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/02/09 22:38:24.0421 0312 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/02/09 22:38:24.0546 0312 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/02/09 22:38:24.0703 0312 bdfm (ced6717bd8b67284afcf692b9316b464) C:\WINDOWS\system32\drivers\bdfm.sys
2011/02/09 22:38:24.0859 0312 bdfsfltr (70975049e22b2efec260816cf505e6e7) C:\WINDOWS\system32\drivers\bdfsfltr.sys
2011/02/09 22:38:25.0031 0312 bdftdif (a7bdb1958d9b8245a0ba83f46abb630c) C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys
2011/02/09 22:38:25.0265 0312 BDSelfPr (5eaf583c0b1cc2499761ea3b065f5db2) C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys
2011/02/09 22:38:25.0468 0312 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/02/09 22:38:25.0640 0312 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/02/09 22:38:25.0734 0312 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/02/09 22:38:25.0812 0312 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/02/09 22:38:25.0859 0312 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/02/09 22:38:26.0015 0312 ctlsb16 (e2b1aedb62845581d848037f0a614ee6) C:\WINDOWS\system32\drivers\ctlsb16.sys
2011/02/09 22:38:26.0234 0312 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/02/09 22:38:26.0468 0312 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/02/09 22:38:26.0578 0312 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/02/09 22:38:26.0640 0312 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/02/09 22:38:26.0734 0312 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/02/09 22:38:26.0828 0312 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/02/09 22:38:26.0968 0312 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/02/09 22:38:27.0046 0312 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/02/09 22:38:27.0062 0312 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/02/09 22:38:27.0078 0312 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/02/09 22:38:27.0125 0312 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/02/09 22:38:27.0156 0312 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/02/09 22:38:27.0171 0312 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/02/09 22:38:27.0203 0312 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/02/09 22:38:27.0234 0312 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/02/09 22:38:27.0281 0312 GTNDIS5 (fc80052194d5708254a346568f0e77c0) C:\WINDOWS\system32\GTNDIS5.SYS
2011/02/09 22:38:27.0390 0312 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/02/09 22:38:27.0421 0312 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/02/09 22:38:27.0718 0312 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/02/09 22:38:27.0781 0312 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys
2011/02/09 22:38:27.0812 0312 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/02/09 22:38:28.0093 0312 IntcAzAudAddService (512cc914475348d774d1bb9f866396a5) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/02/09 22:38:28.0187 0312 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/02/09 22:38:28.0203 0312 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/02/09 22:38:28.0250 0312 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/02/09 22:38:28.0312 0312 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/02/09 22:38:28.0437 0312 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/02/09 22:38:28.0687 0312 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/02/09 22:38:29.0015 0312 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/02/09 22:38:29.0343 0312 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/02/09 22:38:29.0718 0312 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/02/09 22:38:29.0796 0312 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/02/09 22:38:29.0906 0312 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/02/09 22:38:29.0968 0312 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/02/09 22:38:30.0312 0312 MDC8021X (d7010580bf4e45d5e793a1fe75758c69) C:\WINDOWS\system32\DRIVERS\mdc8021x.sys
2011/02/09 22:38:30.0468 0312 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/02/09 22:38:30.0937 0312 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/02/09 22:38:30.0984 0312 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
2011/02/09 22:38:31.0359 0312 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/02/09 22:38:31.0390 0312 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/02/09 22:38:31.0437 0312 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/02/09 22:38:31.0484 0312 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/02/09 22:38:31.0531 0312 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/02/09 22:38:31.0578 0312 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/02/09 22:38:31.0593 0312 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/02/09 22:38:31.0625 0312 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/02/09 22:38:31.0656 0312 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/02/09 22:38:31.0687 0312 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/02/09 22:38:31.0718 0312 MSW_USB (0da88e2b988233950225459d5232c895) C:\WINDOWS\system32\DRIVERS\MSWUSB51.sys
2011/02/09 22:38:31.0781 0312 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/02/09 22:38:31.0812 0312 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/02/09 22:38:31.0828 0312 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/02/09 22:38:31.0859 0312 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/02/09 22:38:31.0890 0312 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/02/09 22:38:31.0906 0312 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/02/09 22:38:31.0937 0312 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/02/09 22:38:31.0984 0312 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/02/09 22:38:32.0031 0312 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/02/09 22:38:32.0046 0312 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/02/09 22:38:32.0078 0312 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/02/09 22:38:32.0140 0312 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/02/09 22:38:32.0359 0312 nv (b9b1bb146eb9a83dcf0f5635b09d3d43) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/02/09 22:38:32.0625 0312 NVENETFD (85f2ffe9aa05487c7e48503b0c336d70) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2011/02/09 22:38:32.0656 0312 nvgts (619d8943725402d1179941fd58574cc8) C:\WINDOWS\system32\DRIVERS\nvgts.sys
2011/02/09 22:38:32.0687 0312 nvnetbus (683ed64f70cb63c8ea84657e45a66974) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2011/02/09 22:38:32.0734 0312 NVR0Dev (a2189fc364062aa336e3fc934e46e147) C:\WINDOWS\nvoclock.sys
2011/02/09 22:38:33.0453 0312 NVR0FLASHDev (d429e370a8581b80a3eaadfd88ce867b) C:\WINDOWS\nvflash.sys
2011/02/09 22:38:33.0531 0312 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/02/09 22:38:33.0562 0312 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/02/09 22:38:33.0625 0312 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/02/09 22:38:33.0656 0312 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/02/09 22:38:33.0687 0312 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/02/09 22:38:33.0734 0312 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/02/09 22:38:33.0750 0312 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/02/09 22:38:33.0796 0312 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/02/09 22:38:33.0828 0312 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/02/09 22:38:33.0968 0312 PnkBstrK (65a9b0e3a9004606ffad8d5dc3ce8803) C:\WINDOWS\system32\drivers\PnkBstrK.sys
2011/02/09 22:38:34.0015 0312 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/02/09 22:38:34.0093 0312 Profos (1bfe86c679a43994e36e623fb6898cdb) C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys
2011/02/09 22:38:34.0125 0312 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/02/09 22:38:34.0171 0312 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/02/09 22:38:34.0187 0312 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/02/09 22:38:34.0250 0312 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/02/09 22:38:34.0281 0312 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/02/09 22:38:34.0296 0312 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/02/09 22:38:34.0312 0312 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/02/09 22:38:34.0328 0312 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/02/09 22:38:34.0343 0312 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/02/09 22:38:34.0390 0312 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/02/09 22:38:34.0406 0312 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/02/09 22:38:34.0453 0312 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) D:\SuperAntiSpyware\SASDIFSV.SYS
2011/02/09 22:38:34.0468 0312 SASKUTIL (61db0d0756a99506207fd724e3692b25) D:\SuperAntiSpyware\SASKUTIL.SYS
2011/02/09 22:38:34.0531 0312 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/02/09 22:38:34.0546 0312 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/02/09 22:38:34.0593 0312 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/02/09 22:38:34.0640 0312 setup_9.0.0.722_08.11.2010_02-12drv (66ef49622baa18e4d4f1fe4bae1d51b8) C:\WINDOWS\system32\DRIVERS\7312163.sys
2011/02/09 22:38:34.0656 0312 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/02/09 22:38:34.0718 0312 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/02/09 22:38:34.0734 0312 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/02/09 22:38:34.0781 0312 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/02/09 22:38:34.0812 0312 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/02/09 22:38:34.0828 0312 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/02/09 22:38:34.0921 0312 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/02/09 22:38:34.0968 0312 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/02/09 22:38:35.0015 0312 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/02/09 22:38:35.0046 0312 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/02/09 22:38:35.0062 0312 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/02/09 22:38:35.0140 0312 Trufos (b16d66a71de03285e14e9f165b59eda4) C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys
2011/02/09 22:38:35.0203 0312 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/02/09 22:38:35.0250 0312 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/02/09 22:38:35.0312 0312 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/02/09 22:38:35.0359 0312 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/02/09 22:38:35.0421 0312 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/02/09 22:38:35.0453 0312 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/02/09 22:38:35.0468 0312 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/02/09 22:38:35.0531 0312 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/02/09 22:38:35.0593 0312 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/02/09 22:38:35.0656 0312 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/02/09 22:38:35.0687 0312 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/02/09 22:38:35.0718 0312 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/02/09 22:38:35.0765 0312 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/02/09 22:38:35.0796 0312 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/02/09 22:38:35.0875 0312 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/02/09 22:38:35.0921 0312 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/02/09 22:38:35.0968 0312 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/02/09 22:38:36.0015 0312 WUSB54GV4SRV (0f82a97056ea208183c0085589f83050) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys
2011/02/09 22:38:36.0078 0312 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/02/09 22:38:36.0078 0312 ================================================================================
2011/02/09 22:38:36.0078 0312 Scan finished
2011/02/09 22:38:36.0078 0312 ================================================================================
2011/02/09 22:38:36.0093 1952 Detected object count: 1
2011/02/09 22:38:59.0812 1952 \HardDisk0 - will be cured after reboot
2011/02/09 22:38:59.0812 1952 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/09 22:39:07.0125 2680 Deinitialize success

OTL:

OTL Extras logfile created on: 2/9/2011 22:46:34 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Ian Gough\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.29 Gb Total Space | 3.10 Gb Free Space | 10.60% Space Free | Partition Type: NTFS
Drive D: | 203.58 Gb Total Space | 79.50 Gb Free Space | 39.05% Space Free | Partition Type: NTFS

Computer Name: JANGO | User Name: Ian Gough | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"57820:TCP" = 57820:TCP:*:Enabled:Pando Media Booster
"57820:UDP" = 57820:UDP:*:Enabled:Pando Media Booster
"58668:TCP" = 58668:TCP:*:Enabled:Pando Media Booster
"58668:UDP" = 58668:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"57820:TCP" = 57820:TCP:*:Enabled:Pando Media Booster
"57820:UDP" = 57820:UDP:*:Enabled:Pando Media Booster
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"58668:TCP" = 58668:TCP:*:Enabled:Pando Media Booster
"58668:UDP" = 58668:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Xfire\Xfire.exe" = C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire – (Xfire Inc.)
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager – (Nexon)
"C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe – (Flagship Industries, Inc.)
"D:\Steam\Steam.exe" = D:\Steam\Steam.exe:*:Enabled:Steam – (Valve Corporation)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – (AOL LLC)
"D:\Steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe" = D:\Steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe:*:Enabled:left4dead2 – ()
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"D:\Steam\steamapps\common\battlefield bad company 2\BFBC2Game.exe" = D:\Steam\steamapps\common\battlefield bad company 2\BFBC2Game.exe:*:Enabled:Battlefield: Bad Company 2 – (EA Digital Illusions CE AB)
"D:\Steam\steamapps\common\all points bulletin\Binaries\APB.exe" = D:\Steam\steamapps\common\all points bulletin\Binaries\APB.exe:*:Enabled:APB All Points Bulletin – (Realtime Worlds, Inc.)
"D:\Steam\steamapps\common\alien swarm\srcds.exe" = D:\Steam\steamapps\common\alien swarm\srcds.exe:*:Enabled:Alien Swarm Dedicated Server – ()
"D:\Steam\steamapps\common\global agenda live\Binaries\GlobalAgenda.exe" = D:\Steam\steamapps\common\global agenda live\Binaries\GlobalAgenda.exe:*:Enabled:Global Agenda – (HiRez Studios, Inc.)
"D:\Steam\steamapps\common\medal of honor beta\MoHMPGame.exe" = D:\Steam\steamapps\common\medal of honor beta\MoHMPGame.exe:*:Enabled:Medal of Honor Beta – (EA Digital Illusions CE AB)
"D:\Steam\steamapps\common\medal of honor beta\Support\EA Help\Electronic_Arts_Technical_Support.htm" = D:\Steam\steamapps\common\medal of honor beta\Support\EA Help\Electronic_Arts_Technical_Support.htm:*:Enabled:Medal of Honor Beta – ()
"D:\Steam\steamapps\common\alien swarm\swarm.exe" = D:\Steam\steamapps\common\alien swarm\swarm.exe:*:Enabled:Alien Swarm – ()
"D:\Music\iTunes\iTunes.exe" = D:\Music\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"D:\Steam\steamapps\common\left 4 dead 2\left4dead2.exe" = D:\Steam\steamapps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2 – ()
"D:\Steam\steamapps\common\call of duty black ops\BlackOps.exe" = D:\Steam\steamapps\common\call of duty black ops\BlackOps.exe:*:Enabled:Call of Duty: Black Ops – ()
"D:\Steam\steamapps\common\call of duty black ops\BlackOpsMP.exe" = D:\Steam\steamapps\common\call of duty black ops\BlackOpsMP.exe:*:Enabled:Call of Duty: Black Ops - Multiplayer – ()
"D:\Steam\steamapps\common\global agenda live\Binaries\LauncherBin\HiRezLauncherUI.exe" = D:\Steam\steamapps\common\global agenda live\Binaries\LauncherBin\HiRezLauncherUI.exe:*:Enabled:Global Agenda – (Hi-Rez Studios Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 23
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{516A594B-FEFF-4521-B857-69809AB266FF}" = VC8 CRT and ATL
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F69C969-2942-4E7B-B594-75B37664B8BA}" = NVIDIA System Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{91130409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Small Business
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1FA92EE-84A3-447D-A6C6-4514B5936DC2}" = BitDefender Antivirus 2009
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.36
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1E544E5-EF3C-4103-A57B-3A499FD91033}" = Nero 7 Essentials
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C7EEF2B9-8C16-4A04-B98D-B1A952A47E55}" = Linksys Wireless-G USB Network Adapter
"{CCD6072D-7813-40FD-88B3-ED1ACBCACECC}" = RuntimeLibsVC05
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}" = NVIDIA System Monitor
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AIM_6" = AIM 6
"Black Prophecy Client BETA_is1" = Black Prophecy Client BETA
"ChessBase" = ChessBase 2009
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Fraps" = Fraps
"Google Chrome" = Google Chrome
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty® 4 - Modern Warfare™ 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty® 4 - Modern Warfare™ 1.4 Patch
"InstallShield_{6F69C969-2942-4E7B-B594-75B37664B8BA}" = NVIDIA System Update
"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA Performance
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"InstallShield_{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}" = NVIDIA System Monitor
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"ProjectTINT_S_x86" = TINT Standard BETA R3
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 12.0" = RealPlayer
"Scid_is1" = Scid 4.0
"Steam App 17020" = Global Agenda
"Steam App 24960" = Battlefield: Bad Company 2
"Steam App 400" = Portal
"Steam App 4000" = Garry's Mod
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"Steam App 440" = Team Fortress 2
"Steam App 47770" = Medal of Honor Beta
"Steam App 550" = Left 4 Dead 2
"Steam App 590" = Left 4 Dead 2 Demo
"Steam App 630" = Alien Swarm
"SystemRequirementsLab" = System Requirements Lab
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.1.2
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xfire" = Xfire (remove only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/16/2010 22:49:25 | Computer Name = JANGO | Source = Application Error | ID = 1000
Description = Faulting application aim6.exe, version 1.4.9.1, faulting module ntdll.dll,
version 5.1.2600.5755, fault address 0x000666c6.

Error - 3/30/2010 16:32:40 | Computer Name = JANGO | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3727, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/9/2010 22:58:38 | Computer Name = JANGO | Source = Application Error | ID = 1000
Description = Faulting application hl2.exe, version 0.0.0.0, faulting module shaderapidx9.dll,
version 0.0.0.0, fault address 0x0002a1a6.

Error - 4/28/2010 22:51:43 | Computer Name = JANGO | Source = Application Hang | ID = 1002
Description = Hanging application Steam.exe, version 1.0.823.645, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/26/2010 15:18:32 | Computer Name = JANGO | Source = Application Error | ID = 1000
Description = Faulting application hl2.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x0d9d9d5d.

Error - 5/26/2010 21:56:06 | Computer Name = JANGO | Source = Application Hang | ID = 1002
Description = Hanging application Steam.exe, version 1.0.843.387, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/27/2010 17:33:47 | Computer Name = JANGO | Source = Application Error | ID = 1000
Description = Faulting application hl2.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x0d9e9d5d.

Error - 6/3/2010 15:17:46 | Computer Name = JANGO | Source = Application Error | ID = 1000
Description = Faulting application javaw.exe, version 6.0.200.2, faulting module
java.dll, version 6.0.200.2, fault address 0x00005875.

Error - 6/13/2010 16:13:04 | Computer Name = JANGO | Source = Application Hang | ID = 1002
Description = Hanging application vlc.exe, version 1.0.5.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/14/2010 2:55:12 | Computer Name = JANGO | Source = Application Error | ID = 1000
Description = Faulting application hl2.exe, version 0.0.0.0, faulting module unknown,
version 0.0.0.0, fault address 0x0da2b30d.

[ System Events ]
Error - 2/9/2011 23:33:28 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:33:28 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:33:28 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

Error - 2/9/2011 23:41:14 | Computer Name = JANGO | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.

< End of report >

OTL logfile created on: 2/9/2011 22:46:34 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Ian Gough\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.29 Gb Total Space | 3.10 Gb Free Space | 10.60% Space Free | Partition Type: NTFS
Drive D: | 203.58 Gb Total Space | 79.50 Gb Free Space | 39.05% Space Free | Partition Type: NTFS

Computer Name: JANGO | User Name: Ian Gough | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ian Gough\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
PRC - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe (BitDefender S. R. L.)
PRC - C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe (BitDefender S.R.L.)
PRC - C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe ()
PRC - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (BitDefender SRL)
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
PRC - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe (NVIDIA)
PRC - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe (Cisco Linksys Corporation)
PRC - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe ()
PRC - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe (GEMTEKS)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Ian Gough\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WUSB54Gv4SVC) – File not found
SRV - (AppMgmt) – File not found
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (VSSERV) – C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe (BitDefender S. R. L.)
SRV - (LIVESRV) – C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (BitDefender SRL)
SRV - (scan) – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll (S.C. BitDefender S.R.L)
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (nSvcIp) – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (Arrakis3) – C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe ()
SRV - (UpdateCenterService) – C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe (NVIDIA)
SRV - (nTuneService) – C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Driver Services (SafeList) ==========

DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (PnkBstrK) – C:\WINDOWS\system32\drivers\PnkBstrK.sys ()
DRV - (SASKUTIL) – D:\SuperAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – D:\SuperAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (73121632) – C:\WINDOWS\system32\DRIVERS\73121632.sys (Kaspersky Lab)
DRV - (28927092) – C:\WINDOWS\system32\DRIVERS\28927092.sys (Kaspersky Lab)
DRV - (setup_9.0.0.722_08.11.2010_02-12drv) – C:\WINDOWS\system32\drivers\7312163.sys (Kaspersky Lab)
DRV - (73121631) – C:\WINDOWS\system32\drivers\73121631.sys (Kaspersky Lab)
DRV - (28927091) – C:\WINDOWS\system32\drivers\28927091.sys (Kaspersky Lab)
DRV - (bdftdif) – C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys (BitDefender LLC)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvgts) – C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Trufos) – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys (BitDefender S.R.L.)
DRV - (BDSelfPr) – C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys (BitDefender S.R.L.)
DRV - (NVR0FLASHDev) – C:\WINDOWS\nvflash.sys (NVIDIA Corp.)
DRV - (NVR0Dev) – C:\WINDOWS\nvoclock.sys (NVIDIA Corp.)
DRV - (bdfsfltr) – C:\WINDOWS\system32\drivers\bdfsfltr.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (bdfm) – C:\WINDOWS\system32\drivers\bdfm.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (Profos) – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys ()
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (WUSB54GV4SRV) – C:\WINDOWS\system32\drivers\rt2500usb.sys (Ralink Technology Inc.)
DRV - (GTNDIS5) – C:\WINDOWS\system32\GTNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MSW_USB) – C:\WINDOWS\system32\drivers\MSWUSB51.sys (Microsoft® Corporation)
DRV - (ctlsb16) Creative SB16/AWE32/AWE64 Driver (WDM) – C:\WINDOWS\system32\drivers\ctlsb16.sys (Copyright © Creative Technology Ltd. 1994-2001)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: [removed]:4.0.15.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2009\FFToolbar\ [2011/02/09 20:11:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/09 21:33:37 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/09 17:23:10 | 000,000,000 | —D | M]

[2009/04/19 23:05:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Ian Gough\Application Data\Mozilla\Extensions
[2011/02/09 06:33:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Ian Gough\Application Data\Mozilla\Firefox\Profiles\ce9lx70r.default\extensions
[2010/04/26 19:41:35 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Ian Gough\Application Data\Mozilla\Firefox\Profiles\ce9lx70r.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/08 00:19:00 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Ian Gough\Application Data\Mozilla\Firefox\Profiles\ce9lx70r.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/04/21 22:27:33 | 000,000,000 | —D | M] (Battlefield Heroes Updater) – C:\Documents and Settings\Ian Gough\Application Data\Mozilla\Firefox\Profiles\ce9lx70r.default\extensions\[removed]
[2011/02/09 06:23:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/05/26 14:19:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/06 20:47:33 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/08 15:51:22 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/02/09 06:23:10 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2009/08/27 16:49:41 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/11/12 17:01:49 | 000,065,536 | —- | M] () – C:\Program Files\Mozilla Firefox\components\FFComm.dll
[2010/11/12 18:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/04/16 12:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2006/02/28 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll (Bitdefender)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe (BitDefender)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WUSB54Gv4] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.systemrequirementslab.com/srl_b…sreqlab_srl.cab (System Requirements Lab Class)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Ian Gough\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Ian Gough\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\SuperAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/02/22 22:52:54 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{6944de02-6847-11de-b2b0-00044b15c428}\Shell\AutoRun\command - "" = F:\setupSNK.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XFR1 - C:\WINDOWS\System32\xfcodec.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/02/09 22:43:52 | 000,602,624 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Ian Gough\Desktop\OTL.exe
[2011/02/09 22:37:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Ian Gough\Desktop\tdsskiller
[2011/02/09 22:18:33 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/02/09 22:17:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Gamigo
[2011/02/09 20:17:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Ian Gough\Start Menu\Programs\HiJackThis
[2011/02/09 06:23:09 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/02/09 06:23:09 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/02/09 06:23:09 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/02/09 06:20:02 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/02/09 06:19:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/09 22:44:00 | 000,000,892 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/09 22:44:00 | 000,000,888 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/09 22:43:52 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Ian Gough\Desktop\OTL.exe
[2011/02/09 22:40:59 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1292428093-764733703-725345543-1004.job
[2011/02/09 22:40:58 | 000,013,688 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/02/09 22:40:54 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/02/09 22:39:37 | 000,081,984 | —- | M] () – C:\WINDOWS\System32\bdod.bin
[2011/02/09 22:37:36 | 001,246,371 | —- | M] () – C:\Documents and Settings\Ian Gough\Desktop\tdsskiller.zip
[2011/02/09 22:29:21 | 000,000,416 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2011/02/09 22:29:21 | 000,000,416 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2011/02/09 22:23:37 | 000,494,340 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/02/09 22:23:37 | 000,084,758 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/02/09 22:17:15 | 000,001,043 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Launch Black Prophecy Client BETA .lnk
[2011/02/09 22:17:15 | 000,000,159 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Register for Black Prophecy Client BETA .url
[2011/02/09 21:58:01 | 000,000,972 | —- | M] () – C:\WINDOWS\System32\BDUpdateV1.xml
[2011/02/09 21:52:12 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/02/09 20:20:29 | 000,002,455 | —- | M] () – C:\Documents and Settings\Ian Gough\Desktop\HiJackThis.lnk
[2011/02/09 20:19:03 | 000,000,416 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2011/02/09 20:13:11 | 001,402,880 | —- | M] () – C:\Documents and Settings\Ian Gough\Desktop\HiJackThis.msi
[2011/02/09 17:08:27 | 000,000,416 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2011/02/09 06:22:31 | 000,000,036 | —- | M] () – C:\Documents and Settings\Ian Gough\Local Settings\Application Data\housecall.guid.cache
[2011/02/09 06:21:29 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/09 22:37:35 | 001,246,371 | —- | C] () – C:\Documents and Settings\Ian Gough\Desktop\tdsskiller.zip
[2011/02/09 22:17:15 | 000,001,043 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Launch Black Prophecy Client BETA .lnk
[2011/02/09 22:17:15 | 000,000,159 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Register for Black Prophecy Client BETA .url
[2011/02/09 20:17:13 | 000,002,455 | —- | C] () – C:\Documents and Settings\Ian Gough\Desktop\HiJackThis.lnk
[2011/02/09 20:14:10 | 001,402,880 | —- | C] () – C:\Documents and Settings\Ian Gough\Desktop\HiJackThis.msi
[2011/02/09 06:22:31 | 000,000,036 | —- | C] () – C:\Documents and Settings\Ian Gough\Local Settings\Application Data\housecall.guid.cache
[2009/10/23 23:14:37 | 000,000,038 | —- | C] () – C:\WINDOWS\ChssBase.ini
[2009/09/10 19:00:34 | 000,041,872 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2009/07/11 16:51:39 | 000,027,136 | —- | C] () – C:\Documents and Settings\Ian Gough\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/04 11:46:54 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2009/07/04 11:46:45 | 000,001,631 | —- | C] () – C:\WINDOWS\System32\WLAN.INI
[2009/07/04 00:38:35 | 000,000,121 | —- | C] () – C:\WINDOWS\bdagent.INI
[2009/06/25 21:18:19 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/06/20 22:04:54 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2009/06/05 16:57:28 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/05/21 14:09:06 | 000,138,624 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/05/21 14:09:06 | 000,138,056 | —- | C] () – C:\Documents and Settings\Ian Gough\Application Data\PnkBstrK.sys
[2009/05/21 14:08:22 | 000,000,319 | —- | C] () – C:\WINDOWS\game.ini
[2009/02/22 23:08:36 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/02/22 17:44:24 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/10/09 15:31:54 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\txmlutil.dll
[2007/01/31 13:50:32 | 000,913,408 | —- | C] () – C:\WINDOWS\System32\xreglib.dll

========== LOP Check ==========

[2009/08/27 22:47:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/04/19 23:09:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BitDefender
[2009/10/23 23:19:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ChessBase
[2009/06/24 15:23:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2011/02/09 21:43:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2009/02/22 23:01:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/27 22:47:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/04/07 19:01:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/10 21:45:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/25 16:20:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/08/27 22:48:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\acccore
[2009/04/19 23:08:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\BitDefender
[2010/12/03 06:14:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\Caini
[2009/10/23 23:19:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\ChessBase
[2009/11/23 13:47:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\GrabPro
[2010/07/12 21:28:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\Orbit
[2010/11/23 21:13:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\qbnut
[2009/08/23 15:59:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\QMulus
[2009/12/08 22:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\runic games
[2010/11/04 02:42:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\Suhiu
[2010/11/16 21:55:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\TS3Client
[2009/10/22 23:05:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\Viewpoint
[2010/12/02 01:20:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\Yffupu
[2010/12/02 01:09:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Ian Gough\Application Data\Ynoci
[2010/12/02 00:53:56 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2010/11/04 02:40:04 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At10.job
[2010/11/04 02:40:04 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At11.job
[2010/11/04 02:40:04 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At12.job
[2011/02/09 17:08:27 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At13.job
[2010/11/04 02:40:04 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At14.job
[2010/11/04 02:40:04 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At15.job
[2010/11/12 00:05:07 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At16.job
[2011/02/09 22:29:21 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At17.job
[2010/12/06 04:28:13 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At18.job
[2011/02/09 20:19:03 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At19.job
[2010/11/12 00:05:07 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2010/11/23 00:35:01 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At20.job
[2010/11/23 00:35:01 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At21.job
[2011/02/09 22:29:21 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At22.job
[2010/11/23 22:52:04 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At23.job
[2010/11/23 23:52:01 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At24.job
[2010/11/15 03:53:23 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2010/11/24 03:52:01 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2010/11/04 02:40:06 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At5.job
[2010/12/03 14:57:47 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At6.job
[2010/12/13 05:12:21 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At7.job
[2010/12/13 05:12:21 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At8.job
[2010/11/04 02:40:06 | 000,000,416 | —- | M] () – C:\WINDOWS\Tasks\At9.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/02/22 22:52:54 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/02/09 22:07:41 | 000,004,328 | —- | M] () – C:\bdlog.txt
[2009/02/22 22:48:44 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2009/02/22 22:52:54 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/02/22 22:52:54 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/08/27 22:47:59 | 000,000,370 | -H– | M] () – C:\IPH.PH
[2009/02/22 22:52:54 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2006/02/28 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/04/22 13:12:25 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/02/09 22:40:48 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/02/22 22:52:36 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/02/22 17:42:38 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/02/22 17:42:38 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/02/22 17:42:38 | 000,925,696 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/04/22 13:14:28 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/06/02 22:33:31 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Ian Gough\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/02/22 22:56:04 | 000,000,079 | —- | M] () – C:\Documents and Settings\Ian Gough\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2009/06/29 20:50:35 | 000,804,429 | —- | M] (http://www.rundegren.com) – C:\Documents and Settings\Ian Gough\Desktop\E179_SZ16.exe
[2011/02/09 22:43:52 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Ian Gough\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2010/03/08 21:13:55 | 018,499,623 | —- | M] () – C:\Documents and Settings\Ian Gough\My Documents\vlc-1.0.5-win32.exe
[2010/08/04 23:13:19 | 019,461,015 | —- | M] () – C:\Documents and Settings\Ian Gough\My Documents\vlc-1.1.2-win32.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/04/22 13:20:58 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Ian Gough\Favorites\Desktop.ini
[2009/04/20 00:24:29 | 000,001,288 | —- | M] () – C:\Documents and Settings\Ian Gough\Favorites\Microsoft bCentral.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/02/09 22:42:51 | 000,081,920 | —- | M] () – C:\Documents and Settings\Ian Gough\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-11-10 08:02:53

< End of report >

mowman

Post #4February 10, 2011, 4:06 AM UTC

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Fentyn

Post #5February 10, 2011, 5:41 AM UTC

Sorry, just saw your post. Here is the log from ComboFix.

ComboFix 11-02-09.03 - Ian Gough 02/10/2011 0:33.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1345 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: BitDefender Antivirus *Disabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job

.
((((((((((((((((((((((((( Files Created from 2011-01-10 to 2011-02-10 )))))))))))))))))))))))))))))))
.

2011-02-10 03:18 . 2011-02-10 03:18 ——– d—–w- c:\program files\Microsoft.NET
2011-02-10 01:17 . 2011-02-10 01:17 388096 —-a-r- c:\documents and settings\Ian Gough\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-09 11:20 . 2011-02-09 11:20 ——– d—–w- c:\program files\Trend Micro
2011-02-09 11:19 . 2011-02-09 11:21 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-12 23:53 . 2010-05-26 19:19 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-11-12 21:34 . 2009-08-27 21:49 73728 —-a-w- c:\windows\system32\javacpl.cpl
2009-11-12 22:01 . 2009-04-20 04:10 65536 —-a-w- c:\program files\mozilla firefox\components\FFComm.dll
.

——- Sigcheck ——-

[7] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
[-] 2004-08-04 02:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\drivers\aec.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-12 782336]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"WUSB54Gv4"="c:\program files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe" [2004-04-19 24576]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-08-17 202256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-26 1753192]
"iTunesHelper"="d:\music\iTunes\iTunesHelper.exe" [2010-11-18 421160]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
setup_9.0.0.722_08.11.2010_02-12.lnk - c:\documents and settings\Ian Gough\Desktop\Virus Removal Tool\setup_9.0.0.722_08.11.2010_02-12\startup.exe [N/A]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\superantispyware\SASSEH.DLL" [2008-05-13 77824]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"d:\\Steam\\Steam.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"d:\\Steam\\steamapps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\Steam\\steamapps\\common\\battlefield bad company 2\\BFBC2Game.exe"=
"d:\\Steam\\steamapps\\common\\all points bulletin\\Binaries\\APB.exe"=
"d:\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"d:\\Steam\\steamapps\\common\\global agenda live\\Binaries\\GlobalAgenda.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Steam\\steamapps\\common\\medal of honor beta\\MoHMPGame.exe"=
"d:\\Steam\\steamapps\\common\\medal of honor beta\\Support\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"d:\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"d:\\Music\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"d:\\Steam\\steamapps\\common\\call of duty black ops\\BlackOps.exe"=
"d:\\Steam\\steamapps\\common\\call of duty black ops\\BlackOpsMP.exe"=
"d:\\Steam\\steamapps\\common\\global agenda live\\Binaries\\LauncherBin\\HiRezLauncherUI.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57820:TCP"= 57820:TCP:Pando Media Booster
"57820:UDP"= 57820:UDP:Pando Media Booster
"58668:TCP"= 58668:TCP:Pando Media Booster
"58668:UDP"= 58668:UDP:Pando Media Booster

R0 28927092;28927092 Boot Guard Driver;c:\windows\system32\drivers\28927092.sys [11/7/2010 20:13 37392]
R0 73121632;73121632 Boot Guard Driver;c:\windows\system32\drivers\73121632.sys [11/23/2010 1:30 37392]
R1 28927091;28927091;c:\windows\system32\drivers\28927091.sys [11/7/2010 20:13 128016]
R1 73121631;73121631;c:\windows\system32\drivers\73121631.sys [11/23/2010 1:30 128016]
R1 SASDIFSV;SASDIFSV;d:\superantispyware\sasdifsv.sys [2/17/2010 13:25 12872]
R1 SASKUTIL;SASKUTIL;d:\superantispyware\SASKUTIL.SYS [5/10/2010 13:41 67656]
R1 setup_9.0.0.722_08.11.2010_02-12drv;setup_9.0.0.722_08.11.2010_02-12drv;c:\windows\system32\drivers\7312163.sys [11/23/2010 1:30 315408]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 13:16 130384]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/27/2009 22:47 24652]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 11:09 111112]
R3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\windows\system32\drivers\rt2500usb.sys [7/4/2009 11:46 79616]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/13/2010 16:29 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/21/2009 22:23 1684736]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 18:16 172032]
S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);c:\windows\system32\drivers\ctlsb16.sys [4/21/2009 22:48 96256]
S3 Razerlow;Razer Copperhead Driver;c:\windows\system32\Drivers\Razerlow.sys –> c:\windows\system32\Drivers\Razerlow.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 13:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-13 21:29]

2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-13 21:29]

2011-02-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1292428093-764733703-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]

2010-11-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1292428093-764733703-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Ian Gough\Application Data\Mozilla\Firefox\Profiles\ce9lx70r.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Battlefield Heroes Updater: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-10 00:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1292428093-764733703-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:94,8e,91,8d,50,b8,5a,6e,b8,0e,59,b3,44,ec,45,23,2e,83,e1,d5,bf,
d8,21,d6,2b,53,cf,c0,dd,5a,c3,55,d9,b9,bd,32,f0,ed,8c,58,21,9a,f4,b8,f1,03,\
"rkeysecu"=hex:e0,ce,05,cf,d1,98,0d,c4,0d,d4,cc,6c,a5,9c,05,4f

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2011-02-10 00:39:29
ComboFix-quarantined-files.txt 2011-02-10 05:39

Pre-Run: 3,226,386,432 bytes free
Post-Run: 5,952,163,840 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 52EB84C755285FE43A811197A9AD8D00

mowman

Post #6February 10, 2011, 11:52 AM UTC

Please scan the following files

Please visit Virus Total by clicking here.
Click the Browse button and search for the following file: c:\windows\system32\drivers\28927092.sys
Click Open.
Then click Send File.
Please be patient while the file is scanned.
If Virus Total tells you that the file has already been scanned, click "reanalyse now".

Once the scan results appear, copy and paste them into Notepad and repeat the procedure for the following file(s):
c:\windows\system32\drivers\73121632.sys
Please provide the results from the scans in your next reply.

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Fentyn

Post #7February 10, 2011, 9:27 PM UTC

The next set of logs. These scans were done while Bitdefender was running, although it turned off during ESET's scan. If I should redo them let me know. VirusTotal File 1: Antivirus Version Last Update Result AhnLab-V3 2011.02.06.00 2011.02.06 - AntiVir 7.11.3.40 2011.02.10 - Antiy-AVL 2.0.3.7 2011.02.10 - Avast 4.8.1351.0 2011.02.10 - Avast5 5.0.677.0 2011.02.10 - AVG 10.0.0.1190 2011.02.10 - BitDefender 7.2 2011.02.10 - CAT-QuickHeal 11.00 2011.02.10 - ClamAV 0.96.4.0 2011.02.10 - Commtouch 5.2.11.5 2011.02.10 - Comodo 7642 2011.02.10 - DrWeb 5.0.2.03300 2011.02.10 - Emsisoft 5.1.0.2 2011.02.10 - eSafe 7.0.17.0 2011.02.10 - eTrust-Vet 36.1.8151 2011.02.10 - F-Prot 4.6.2.117 2011.02.04 - F-Secure 9.0.16160.0 2011.02.10 - Fortinet 4.2.254.0 2011.02.10 - GData 21 2011.02.10 - Ikarus T3.1.1.97.0 2011.02.10 - Jiangmin 13.0.900 2011.02.10 - K7AntiVirus 9.83.3813 2011.02.10 - Kaspersky 7.0.0.125 2011.02.10 - McAfee 5.400.0.1158 2011.02.10 - McAfee-GW-Edition 2010.1C 2011.02.08 - Microsoft 1.6502 2011.02.10 - NOD32 5863 2011.02.10 - Norman 6.07.03 2011.02.10 - nProtect 2011-01-27.01 2011.02.02 - Panda 10.0.3.5 2011.02.10 - PCTools 7.0.3.5 2011.02.10 - Prevx 3.0 2011.02.10 - Rising 23.44.03.05 2011.02.10 - Sophos 4.61.0 2011.02.10 - SUPERAntiSpyware 4.40.0.1006 2011.02.10 - Symantec 20101.3.0.103 2011.02.10 - TheHacker 6.7.0.1.126 2011.02.10 - TrendMicro 9.200.0.1012 2011.02.10 - TrendMicro-HouseCall 9.200.0.1012 2011.02.10 - VBA32 3.12.14.3 2011.02.10 - VIPRE 8374 2011.02.10 - ViRobot 2011.2.10.4303 2011.02.10 - VirusBuster 13.6.193.0 2011.02.10 - MD5 : a305fad3719c5db0c13d1c2bfd08a04d SHA1 : cd7300ae608db1ca6583736b9648cf36b476f832 SHA256: a3f8d9139142391d5f68aeb75a501243852a487f084f5aa75c03eb173d2b8935 ssdeep: 768:M+hdvdtdNZnYvFOzz2o7fSgLa1TvanHWp66enLvbYCSm02:M+hdvdtdN1rz6qnLagDN/YeR File size : 37392 bytes First seen: 2009-11-25 16:43:41 Last seen : 2011-02-10 19:33:02 TrID: Win32 Executable Generic (68.0%) Generic Win/DOS Executable (15.9%) DOS Executable Generic (15.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) sigcheck: publisher….: Kaspersky Lab copyright….: Copyright © Kaspersky Lab 1997-2009. product……: Kaspersky Anti-Virus description..: Kaspersky Lab Boot Guard Driver original name: KLBG.SYS internal name: KLBG file version.: 9.1.0.0 comments…..: n/a signers……: Kaspersky Lab VeriSign Class 3 Code Signing 2004 CA Class 3 Public Primary Certification Authority signing date.: 10:54 AM 10/22/2009 verified…..: - PEInfo: PE structure information [[ basic data ]] entrypointaddress: 0x3CA0 timedatestamp….: 0x4AE02BB3 (Thu Oct 22 09:53:55 2009) machinetype……: 0x14c (I386) [[ 7 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 .text, 0x1000, 0x427E, 0x4400, 6.30, b2a5eb356209d15285e1808b9629411c .rdata, 0x6000, 0x150C, 0x1600, 7.38, 945af6e04dbf86c095c1755f343392a8 .data, 0x8000, 0x198, 0x200, 1.76, 38b21fbea339d3c01709e6603a4baa5c PAGECODE, 0x9000, 0x2EB, 0x400, 5.07, d6e2cfe49628330b8479e665ce2a9c2a INIT, 0xA000, 0x650, 0x800, 4.61, f1d93e70472651a3da107c37db60f3a4 .rsrc, 0xB000, 0x418, 0x600, 2.48, 7907b082561e0fcf5edc2821a6ea5738 .reloc, 0xC000, 0x422, 0x600, 4.20, 70b278bb5403516ecc43165f821d09c7 [[ 2 import(s) ]] ntoskrnl.exe: MmProbeAndLockPages, MmMapLockedPagesSpecifyCache, MmBuildMdlForNonPagedPool, IoAllocateMdl, _except_handler3, memset, ObfDereferenceObject, ObReferenceObjectByName, IoDriverObjectType, RtlInitUnicodeString, KeServiceDescriptorTable, PsGetCurrentProcessId, IoGetCurrentProcess, memcpy, ExFreePoolWithTag, ExAllocatePoolWithTag, KeLeaveCriticalRegion, ExReleaseResourceLite, ExAcquireResourceExclusiveLite, KeEnterCriticalRegion, ZwClose, ZwSetValueKey, ZwDeleteValueKey, ZwEnumerateValueKey, ZwOpenKey, ExInitializeResourceLite, MmIsAddressValid, KeWaitForSingleObject, IofCallDriver, IoBuildDeviceIoControlRequest, KeInitializeEvent, IoGetDeviceObjectPointer, ZwSetInformationFile, ZwQueryInformationFile, IoCreateFile, ZwWriteFile, ZwReadFile, RtlFreeAnsiString, RtlUnicodeStringToAnsiString, ZwNotifyChangeKey, IofCompleteRequest, IoCreateSymbolicLink, IoCreateDevice, IoDeleteSymbolicLink, IoDeleteDevice, IoRegisterBootDriverReinitialization, RtlCopyUnicodeString, InitSafeBootMode, ZwCreateKey, ZwEnumerateKey, ExAllocatePool, ZwDeleteKey, wcschr, MmUnlockPages, PsGetCurrentThreadId, IoFreeMdl, DbgPrint, RtlAnsiCharToUnicodeChar, KeBugCheckEx HAL.dll: KfLowerIrql, KeRaiseIrqlToDpcLevel VirusTotal File 2: Antivirus Version Last Update Result AhnLab-V3 2011.02.06.00 2011.02.06 - AntiVir 7.11.3.40 2011.02.10 - Antiy-AVL 2.0.3.7 2011.02.10 - Avast 4.8.1351.0 2011.02.10 - Avast5 5.0.677.0 2011.02.10 - AVG 10.0.0.1190 2011.02.10 - BitDefender 7.2 2011.02.10 - CAT-QuickHeal 11.00 2011.02.10 - ClamAV 0.96.4.0 2011.02.10 - Commtouch 5.2.11.5 2011.02.10 - Comodo 7642 2011.02.10 - DrWeb 5.0.2.03300 2011.02.10 - Emsisoft 5.1.0.2 2011.02.10 - eSafe 7.0.17.0 2011.02.10 - eTrust-Vet 36.1.8151 2011.02.10 - F-Prot 4.6.2.117 2011.02.04 - F-Secure 9.0.16160.0 2011.02.10 - Fortinet 4.2.254.0 2011.02.10 - GData 21 2011.02.10 - Ikarus T3.1.1.97.0 2011.02.10 - Jiangmin 13.0.900 2011.02.10 - K7AntiVirus 9.83.3813 2011.02.10 - Kaspersky 7.0.0.125 2011.02.10 - McAfee 5.400.0.1158 2011.02.10 - McAfee-GW-Edition 2010.1C 2011.02.08 - Microsoft 1.6502 2011.02.10 - NOD32 5863 2011.02.10 - Norman 6.07.03 2011.02.10 - nProtect 2011-01-27.01 2011.02.02 - Panda 10.0.3.5 2011.02.10 - PCTools 7.0.3.5 2011.02.10 - Prevx 3.0 2011.02.10 - Rising 23.44.03.05 2011.02.10 - Sophos 4.61.0 2011.02.10 - SUPERAntiSpyware 4.40.0.1006 2011.02.10 - Symantec 20101.3.0.103 2011.02.10 - TheHacker 6.7.0.1.126 2011.02.10 - TrendMicro 9.200.0.1012 2011.02.10 - TrendMicro-HouseCall 9.200.0.1012 2011.02.10 - VBA32 3.12.14.3 2011.02.10 - VIPRE 8374 2011.02.10 - ViRobot 2011.2.10.4303 2011.02.10 - VirusBuster 13.6.193.0 2011.02.10 - Additional information Show all MD5 : a305fad3719c5db0c13d1c2bfd08a04d SHA1 : cd7300ae608db1ca6583736b9648cf36b476f832 SHA256: a3f8d9139142391d5f68aeb75a501243852a487f084f5aa75c03eb173d2b8935 ssdeep: 768:M+hdvdtdNZnYvFOzz2o7fSgLa1TvanHWp66enLvbYCSm02:M+hdvdtdN1rz6qnLagDN/YeR File size : 37392 bytes First seen: 2009-11-25 16:43:41 Last seen : 2011-02-10 19:36:31 TrID: Win32 Executable Generic (68.0%) Generic Win/DOS Executable (15.9%) DOS Executable Generic (15.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) sigcheck: publisher….: Kaspersky Lab copyright….: Copyright © Kaspersky Lab 1997-2009. product……: Kaspersky Anti-Virus description..: Kaspersky Lab Boot Guard Driver original name: KLBG.SYS internal name: KLBG file version.: 9.1.0.0 comments…..: n/a signers……: Kaspersky Lab VeriSign Class 3 Code Signing 2004 CA Class 3 Public Primary Certification Authority signing date.: 10:54 AM 10/22/2009 verified…..: - PEInfo: PE structure information [[ basic data ]] entrypointaddress: 0x3CA0 timedatestamp….: 0x4AE02BB3 (Thu Oct 22 09:53:55 2009) machinetype……: 0x14c (I386) [[ 7 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 .text, 0x1000, 0x427E, 0x4400, 6.30, b2a5eb356209d15285e1808b9629411c .rdata, 0x6000, 0x150C, 0x1600, 7.38, 945af6e04dbf86c095c1755f343392a8 .data, 0x8000, 0x198, 0x200, 1.76, 38b21fbea339d3c01709e6603a4baa5c PAGECODE, 0x9000, 0x2EB, 0x400, 5.07, d6e2cfe49628330b8479e665ce2a9c2a INIT, 0xA000, 0x650, 0x800, 4.61, f1d93e70472651a3da107c37db60f3a4 .rsrc, 0xB000, 0x418, 0x600, 2.48, 7907b082561e0fcf5edc2821a6ea5738 .reloc, 0xC000, 0x422, 0x600, 4.20, 70b278bb5403516ecc43165f821d09c7 [[ 2 import(s) ]] ntoskrnl.exe: MmProbeAndLockPages, MmMapLockedPagesSpecifyCache, MmBuildMdlForNonPagedPool, IoAllocateMdl, _except_handler3, memset, ObfDereferenceObject, ObReferenceObjectByName, IoDriverObjectType, RtlInitUnicodeString, KeServiceDescriptorTable, PsGetCurrentProcessId, IoGetCurrentProcess, memcpy, ExFreePoolWithTag, ExAllocatePoolWithTag, KeLeaveCriticalRegion, ExReleaseResourceLite, ExAcquireResourceExclusiveLite, KeEnterCriticalRegion, ZwClose, ZwSetValueKey, ZwDeleteValueKey, ZwEnumerateValueKey, ZwOpenKey, ExInitializeResourceLite, MmIsAddressValid, KeWaitForSingleObject, IofCallDriver, IoBuildDeviceIoControlRequest, KeInitializeEvent, IoGetDeviceObjectPointer, ZwSetInformationFile, ZwQueryInformationFile, IoCreateFile, ZwWriteFile, ZwReadFile, RtlFreeAnsiString, RtlUnicodeStringToAnsiString, ZwNotifyChangeKey, IofCompleteRequest, IoCreateSymbolicLink, IoCreateDevice, IoDeleteSymbolicLink, IoDeleteDevice, IoRegisterBootDriverReinitialization, RtlCopyUnicodeString, InitSafeBootMode, ZwCreateKey, ZwEnumerateKey, ExAllocatePool, ZwDeleteKey, wcschr, MmUnlockPages, PsGetCurrentThreadId, IoFreeMdl, DbgPrint, RtlAnsiCharToUnicodeChar, KeBugCheckEx HAL.dll: KfLowerIrql, KeRaiseIrqlToDpcLevel MBAM Log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5735 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 2/10/2011 15:02:32 mbam-log-2011-02-10 (15-02-32).txt Scan type: Quick scan Objects scanned: 149661 Time elapsed: 2 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESET Log: ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=8df5c8a16d0d664aa5c6f4a43342fc89 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-02-10 09:22:51 # local_time=2011-02-10 04:22:51 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=2050 16776533 100 100 0 290301890 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=161747 # found=2 # cleaned=2 # scan_time=4195 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinMuollo1.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinMuollo4.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C Thank you for all of your help thus far!

mowman

Post #8February 11, 2011, 1:24 AM UTC

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
FCopy::
c:\windows\ServicePackFiles\i386\aec.sys | c:\windows\system32\drivers\aec.sys
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[image unavailable: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also tell me how the computer is running now.

Fentyn

Post #9February 11, 2011, 3:10 AM UTC

The computer seems to be running fine. I've been turning it off in between your fixes so I haven't used it much. I just google'd some stuff and didn't get redirected. So far, during the time it has been on I haven't gotten the Generic Host Error yet either, but I can never tell what causes that error so I may just not have triggered it, but as I said it's running very nicely so far. Here is the combofix log (it didn't restart my computer either.)

ComboFix 11-02-09.05 - Ian Gough 02/10/2011 21:58:14.2.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1434 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ian Gough\Desktop\CFScript.txt
AV: BitDefender Antivirus *Disabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
————— FCopy —————

c:\windows\ServicePackFiles\i386\aec.sys –> c:\windows\system32\drivers\aec.sys
.
((((((((((((((((((((((((( Files Created from 2011-01-11 to 2011-02-11 )))))))))))))))))))))))))))))))
.

2011-02-10 20:04 . 2011-02-10 20:04 ——– d—–w- c:\program files\ESET
2011-02-10 03:18 . 2011-02-10 03:18 ——– d—–w- c:\program files\Microsoft.NET
2011-02-10 01:17 . 2011-02-10 01:17 388096 —-a-r- c:\documents and settings\Ian Gough\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-09 11:20 . 2011-02-09 11:20 ——– d—–w- c:\program files\Trend Micro
2011-02-09 11:19 . 2011-02-09 11:21 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 23:09 . 2010-11-08 01:00 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 23:08 . 2010-11-08 01:00 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-02-10 01:12 . 2009-04-20 04:10 65536 —-a-w- c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((( SnapShot@2011-02-10_05.38.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-02-11 02:51 . 2011-02-11 02:51 16384 c:\windows\Temp\Perflib_Perfdata_410.dat
+ 2011-02-11 02:51 . 2011-02-11 02:51 16384 c:\windows\Temp\Perflib_Perfdata_290.dat
+ 2009-04-20 04:16 . 2011-02-10 20:30 81984 c:\windows\system32\bdod.bin
- 2009-04-20 04:16 . 2011-02-10 04:05 81984 c:\windows\system32\bdod.bin
+ 2011-02-10 19:44 . 2011-02-10 19:44 54784 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting\70c840dc13aae2e1323b13d7b27030ae\System.Xaml.Hosting.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 35328 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Pres#\9bbefd2263d8f2169ab3695798208293\System.Windows.Presentation.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 24064 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Routing\9484262c4f1cfaace92aa9d1fee76025\System.Web.Routing.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 46592 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DynamicD#\569a7210fae634e8827a1bd805922540\System.Web.DynamicData.Design.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 24576 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Abstract#\0d2eb147f2b4b13af1141810688e2d5f\System.Web.Abstractions.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 82432 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c3831eb95ccf3904bab81a97a9b08ed3\System.ServiceModel.Channels.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 12288 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\2ac3fd2abc9bb5eab553ef8e44ca77ca\System.ServiceModel.ServiceMoniker40.ni.dll
+ 2009-04-22 03:57 . 2008-04-13 16:39 142592 c:\windows\system32\dllcache\aec.sys
+ 2011-02-10 19:45 . 2011-02-10 19:45 399360 c:\windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask\4daf91c66e01c3dd92b239feacaa8245\XamlBuildTask.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 245760 c:\windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\cc063533b04f9420d1aa571a36d1fabd\WindowsFormsIntegration.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 481792 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClient\ece129234f9ba9ad856d0e77e4849137\UIAutomationClient.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 192512 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\4cb0c81cca997d9fbecda9a1824f2fdb\System.Windows.Forms.DataVisualization.Design.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 858112 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Extensio#\2e2096834f67f11a362be1e5c0da4d54\System.Web.Extensions.Design.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 332288 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity\0d511c8f1da06cc18f2da9b593042841\System.Web.Entity.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 296448 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Entity.D#\c69974f79eb0c96357fbf031df6d8ed0\System.Web.Entity.Design.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 705536 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DynamicD#\a1d43a413800a3fa024cba9161c34c44\System.Web.DynamicData.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 256512 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DataVisu#\8fbe244f1f9ad9ce887c125bae44a50b\System.Web.DataVisualization.Design.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 421888 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\9e32918462a2d0c786fbf21a873cc358\System.ServiceModel.Activation.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 365056 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\76a5d670ce969c0c65a905b7303d4bbf\System.ServiceModel.Routing.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 651264 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Net\dd5c866d2462dd913ed0a0287396aa50\System.Net.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 625152 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Messaging\3ab3e80af8e5e95a5a62092cc9293c91\System.Messaging.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 392704 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management.I#\8b5fe7aff54a7aed07287257a9b8e420\System.Management.Instrumentation.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 405504 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IO.Log\150da10324f2811a48da58d3496bbe10\System.IO.Log.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 228352 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityMode#\386f41f744eedacd1517c8a15750a48b\System.IdentityModel.Selectors.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 911872 c:\windows\assembly\NativeImages_v4.0.30319_32\System.DirectorySer#\46a7f51ef1a9d917598b96f7a758a459\System.DirectoryServices.AccountManagement.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 112128 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Device\36342e6024e2844502d0bdaa9d30971a\System.Device.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 499712 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\ec884cc78d6c5bb67bc2c819b1f00ee5\System.Data.Services.Design.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 1055744 c:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationClients#\5904383f7c86f1374a14198872dfa7d8\UIAutomationClientsideProviders.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 1203712 c:\windows\assembly\NativeImages_v4.0.30319_32\System.WorkflowServ#\ad9facc364268611cc4ca65f77caeddd\System.WorkflowServices.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 1956352 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Run#\be049b8fe1bf23daab7e76159a7e00dd\System.Workflow.Runtime.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 4428800 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Com#\467bcaca5f4d2914922f62772ea4ea7d\System.Workflow.ComponentModel.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 2839552 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Workflow.Act#\544e73a3f3f2daea050f03e4c94e9a6d\System.Workflow.Activities.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 4496384 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Form#\9cf13572472dc2efe8f3b7c2ab6198d3\System.Windows.Forms.DataVisualization.ni.dll
+ 2011-02-10 19:45 . 2011-02-10 19:45 2324992 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Mobile\c7b1290bb35d3e3c53d20e5928c9fa73\System.Web.Mobile.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 3078144 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.Extensio#\0f643b7bd4525c3165733f6988bdbfe2\System.Web.Extensions.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 4429312 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Web.DataVisu#\9df99ed350ef0a43fbcc1b9e586f1c7f\System.Web.DataVisualization.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1992192 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Speech\61a931da70f8078539a51cef3888d02d\System.Speech.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1127424 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\dbf07cb14b4dcc210cdf8b5d90a12a56\System.ServiceModel.Discovery.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1388032 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\52481fccddb053768631c640d5059d4b\System.ServiceModel.Activities.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1046528 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\51c60db370e050d9cdcac17060aaac53\System.ServiceModel.Web.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1159168 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Management\6a6f4be744ed5bc5273cbcf0fcf303e3\System.Management.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1065984 c:\windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\9eac876f58a3ebca8878b8654efdc817\System.IdentityModel.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 2008576 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Services\62f067f8572551df931b3ee6493383d7\System.Data.Services.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 1332736 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Service#\685c7df1332a74aaa899f2bdb3beabc3\System.Data.Services.Client.ni.dll
+ 2011-02-10 19:43 . 2011-02-10 19:43 1398272 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity.#\7bab044e648dfea461b73dc898150539\System.Data.Entity.Design.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 2441728 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.JScript\08b2c2639708ab20748653185d6b67be\Microsoft.JScript.ni.dll
+ 2011-02-10 19:44 . 2011-02-10 19:44 17919488 c:\windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\250b525aa8c17327216e102569c0d766\System.ServiceModel.ni.dll
+ 2011-02-10 19:43 . 2011-02-10 19:43 13273600 c:\windows\assembly\NativeImages_v4.0.30319_32\System.Data.Entity\642a7b3d47828fb0070a55cfeb58f42b\System.Data.Entity.ni.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2011-02-10 843144]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"WUSB54Gv4"="c:\program files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe" [2004-04-19 24576]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-08-17 202256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-26 1753192]
"iTunesHelper"="d:\music\iTunes\iTunesHelper.exe" [2010-11-18 421160]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
setup_9.0.0.722_08.11.2010_02-12.lnk - c:\documents and settings\Ian Gough\Desktop\Virus Removal Tool\setup_9.0.0.722_08.11.2010_02-12\startup.exe [N/A]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\superantispyware\SASSEH.DLL" [2008-05-13 77824]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"d:\\Steam\\Steam.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"d:\\Steam\\steamapps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"d:\\Steam\\steamapps\\common\\battlefield bad company 2\\BFBC2Game.exe"=
"d:\\Steam\\steamapps\\common\\all points bulletin\\Binaries\\APB.exe"=
"d:\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"d:\\Steam\\steamapps\\common\\global agenda live\\Binaries\\GlobalAgenda.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Steam\\steamapps\\common\\medal of honor beta\\MoHMPGame.exe"=
"d:\\Steam\\steamapps\\common\\medal of honor beta\\Support\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"d:\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"d:\\Music\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"d:\\Steam\\steamapps\\common\\call of duty black ops\\BlackOps.exe"=
"d:\\Steam\\steamapps\\common\\call of duty black ops\\BlackOpsMP.exe"=
"d:\\Steam\\steamapps\\common\\global agenda live\\Binaries\\LauncherBin\\HiRezLauncherUI.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57820:TCP"= 57820:TCP:Pando Media Booster
"57820:UDP"= 57820:UDP:Pando Media Booster
"58668:TCP"= 58668:TCP:Pando Media Booster
"58668:UDP"= 58668:UDP:Pando Media Booster

R0 28927092;28927092 Boot Guard Driver;c:\windows\system32\drivers\28927092.sys [11/7/2010 20:13 37392]
R0 73121632;73121632 Boot Guard Driver;c:\windows\system32\drivers\73121632.sys [11/23/2010 1:30 37392]
R1 28927091;28927091;c:\windows\system32\drivers\28927091.sys [11/7/2010 20:13 128016]
R1 73121631;73121631;c:\windows\system32\drivers\73121631.sys [11/23/2010 1:30 128016]
R1 SASDIFSV;SASDIFSV;d:\superantispyware\sasdifsv.sys [2/17/2010 13:25 12872]
R1 SASKUTIL;SASKUTIL;d:\superantispyware\SASKUTIL.SYS [5/10/2010 13:41 67656]
R1 setup_9.0.0.722_08.11.2010_02-12drv;setup_9.0.0.722_08.11.2010_02-12drv;c:\windows\system32\drivers\7312163.sys [11/23/2010 1:30 315408]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/27/2009 22:47 24652]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 11:09 111112]
R3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\windows\system32\drivers\rt2500usb.sys [7/4/2009 11:46 79616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 13:16 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/13/2010 16:29 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/21/2009 22:23 1684736]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 18:16 172032]
S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);c:\windows\system32\drivers\ctlsb16.sys [4/21/2009 22:48 96256]
S3 Razerlow;Razer Copperhead Driver;c:\windows\system32\Drivers\Razerlow.sys –> c:\windows\system32\Drivers\Razerlow.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 13:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2011-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-13 21:29]

2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-13 21:29]

2011-02-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1292428093-764733703-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]

2010-11-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1292428093-764733703-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Ian Gough\Application Data\Mozilla\Firefox\Profiles\ce9lx70r.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Battlefield Heroes Updater: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-10 22:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1292428093-764733703-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:94,8e,91,8d,50,b8,5a,6e,b8,0e,59,b3,44,ec,45,23,2e,83,e1,d5,bf,
d8,21,d6,2b,53,cf,c0,dd,5a,c3,55,d9,b9,bd,32,f0,ed,8c,58,21,9a,f4,b8,f1,03,\
"rkeysecu"=hex:e0,ce,05,cf,d1,98,0d,c4,0d,d4,cc,6c,a5,9c,05,4f

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3712)
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-02-10 22:03:23
ComboFix-quarantined-files.txt 2011-02-11 03:03
ComboFix2.txt 2011-02-10 05:39

Pre-Run: 5,730,701,312 bytes free
Post-Run: 5,709,664,256 bytes free

- - End Of File - - F00B1DBEC75239F57C0C559E3D9943EF

mowman

Post #10February 11, 2011, 3:26 AM UTC

You appear clean of infections,please do the following.

ComboFix - Cleanup
Time for some housekeeping

Click Start…select Run from the menu.
Copy and paste the following into the text entry box:
Combofix /Uninstall
Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

Fentyn

Post #11February 11, 2011, 3:41 AM UTC

Thanks very much! I appreciate all of your help and intend on reading a bunch of those websites you offered. Do you think this will take care of my generic host error? Was that something that was popping up due to some of the infection that I had? Or is that not your area of expertise? In any event, thank you very much!

mowman

Post #12February 11, 2011, 4:08 AM UTC

Do you think this will take care of my generic host error? Was that something that was popping up due to some of the infection that I had?

Not 100% sure on this,it could have been the rootkit which you had causing it or could be down to needing windows updating

mowman

Post #13February 11, 2011, 10:19 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Possible bot and Generic Host Process problem

✨ Ask AI

Ask AI