What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected with a rootkit

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, AVG flagged a trojan and tried to remove it, but not sure if it did, malware bites also found something as did tdsskiller. Posting logs below. Thanks in advance guys. AVG result "Object name";"C:\WINDOWS\system32\dla\tfsnifs.sys" "Detection name";"IRP hook, \FileSystem\Udfs IRP_MJ_FILE_SYSTEM_CONTROL -> tfsnifs.sys +0x56F" "Object type";"file" "SDK Type";"Rootkit" "Result";"Moved to Virus Vault" "Action history";"Moved to Virus Vault" mbam log mbam-log-2011-02-13 (03-30-56).txt Scan type: Quick scan Objects scanned: 197228 Time elapsed: 36 minute(s), 25 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\kev\local settings\temp\92.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully. TDSSKILLER log 02/13 13:23:06.0260 0812 ================================================================================ 2011/02/13 13:23:06.0260 0812 SystemInfo: 2011/02/13 13:23:06.0260 0812 2011/02/13 13:23:06.0260 0812 OS Version: 5.1.2600 ServicePack: 3.0 2011/02/13 13:23:06.0260 0812 Product type: Workstation 2011/02/13 13:23:06.0260 0812 ComputerName: IBM-F5A8855BD0A 2011/02/13 13:23:06.0260 0812 UserName: kev 2011/02/13 13:23:06.0260 0812 Windows directory: C:\WINDOWS 2011/02/13 13:23:06.0270 0812 System windows directory: C:\WINDOWS 2011/02/13 13:23:06.0270 0812 Processor architecture: Intel x86 2011/02/13 13:23:06.0270 0812 Number of processors: 1 2011/02/13 13:23:06.0270 0812 Page size: 0x1000 2011/02/13 13:23:06.0270 0812 Boot type: Normal boot 2011/02/13 13:23:06.0270 0812 ================================================================================ 2011/02/13 13:23:07.0992 0812 Initialize success 2011/02/13 13:23:12.0188 2400 ================================================================================ 2011/02/13 13:23:12.0188 2400 Scan started 2011/02/13 13:23:12.0188 2400 Mode: Manual; 2011/02/13 13:23:12.0188 2400 ================================================================================ 2011/02/13 13:23:16.0124 2400 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS 2011/02/13 13:23:16.0204 2400 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys 2011/02/13 13:23:16.0384 2400 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2011/02/13 13:23:16.0474 2400 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 2011/02/13 13:23:16.0615 2400 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys 2011/02/13 13:23:16.0665 2400 aeaudio (b2886807ac2543da273765cef4d82d68) C:\WINDOWS\system32\drivers\aeaudio.sys 2011/02/13 13:23:16.0755 2400 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2011/02/13 13:23:16.0875 2400 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys 2011/02/13 13:23:17.0075 2400 AgereSoftModem (ed5c8b22de2021339a7c7fccfe5c5d7e) C:\WINDOWS\system32\DRIVERS\AGRSM.sys 2011/02/13 13:23:17.0786 2400 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys 2011/02/13 13:23:17.0907 2400 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys 2011/02/13 13:23:17.0977 2400 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys 2011/02/13 13:23:18.0097 2400 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys 2011/02/13 13:23:18.0217 2400 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys 2011/02/13 13:23:18.0297 2400 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys 2011/02/13 13:23:18.0417 2400 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\System32\DRIVERS\alim1541.sys 2011/02/13 13:23:18.0527 2400 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\System32\DRIVERS\amdagp.sys 2011/02/13 13:23:18.0628 2400 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys 2011/02/13 13:23:18.0988 2400 AR5211 (38bd6a75203dbf828f83e21a56163ecc) C:\WINDOWS\system32\DRIVERS\ar5211.sys 2011/02/13 13:23:19.0138 2400 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys 2011/02/13 13:23:19.0248 2400 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys 2011/02/13 13:23:19.0319 2400 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys 2011/02/13 13:23:19.0479 2400 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2011/02/13 13:23:19.0589 2400 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2011/02/13 13:23:19.0889 2400 ati2mtag (2fbdfec8cd60cec3d55e615865333033) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 2011/02/13 13:23:20.0310 2400 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2011/02/13 13:23:20.0671 2400 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2011/02/13 13:23:20.0931 2400 AVGIDSDriver (0c61f066f4d94bd67063dc6691935143) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys 2011/02/13 13:23:21.0031 2400 AVGIDSEH (84853f800cd69252c3c764fe50d0346f) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys 2011/02/13 13:23:21.0161 2400 AVGIDSFilter (28d6adcd03e10f3838488b9b5d407dd4) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys 2011/02/13 13:23:21.0362 2400 AVGIDSShim (0eb16f4dbbb946360af30d2b13a52d1d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys 2011/02/13 13:23:21.0542 2400 Avgldx86 (5fe5a2c2330c376a1d8dcff8d2680a2d) C:\WINDOWS\system32\DRIVERS\avgldx86.sys 2011/02/13 13:23:22.0143 2400 Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 2011/02/13 13:23:22.0343 2400 Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys 2011/02/13 13:23:22.0543 2400 Avgtdix (660788ec46f10ece80274d564fa8b4aa) C:\WINDOWS\system32\DRIVERS\avgtdix.sys 2011/02/13 13:23:22.0844 2400 Bridge (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys 2011/02/13 13:23:22.0854 2400 BridgeMP (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys 2011/02/13 13:23:23.0014 2400 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys 2011/02/13 13:23:23.0414 2400 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys 2011/02/13 13:23:23.0605 2400 BTHPORT (662bfd909447dd9cc15b1a1c366583b4) C:\WINDOWS\system32\Drivers\BTHport.sys 2011/02/13 13:23:23.0815 2400 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys 2011/02/13 13:23:23.0955 2400 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys 2011/02/13 13:23:24.0025 2400 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2011/02/13 13:23:24.0146 2400 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys 2011/02/13 13:23:24.0286 2400 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2011/02/13 13:23:24.0386 2400 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2011/02/13 13:23:24.0466 2400 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2011/02/13 13:23:24.0887 2400 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 2011/02/13 13:23:25.0287 2400 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\System32\DRIVERS\cmdide.sys 2011/02/13 13:23:25.0588 2400 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys 2011/02/13 13:23:25.0728 2400 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys 2011/02/13 13:23:25.0898 2400 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys 2011/02/13 13:23:26.0038 2400 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys 2011/02/13 13:23:26.0138 2400 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2011/02/13 13:23:26.0429 2400 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 2011/02/13 13:23:26.0619 2400 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 2011/02/13 13:23:26.0789 2400 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2011/02/13 13:23:26.0919 2400 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2011/02/13 13:23:27.0040 2400 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys 2011/02/13 13:23:27.0160 2400 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2011/02/13 13:23:27.0580 2400 drvmcdb (9ca623cae513ac8b1fdaafb780b8b84c) C:\WINDOWS\system32\drivers\drvmcdb.sys 2011/02/13 13:23:27.0871 2400 drvnddm (8a68a047ecc4c3a7bacfd9d41e3c2c62) C:\WINDOWS\system32\drivers\drvnddm.sys 2011/02/13 13:23:28.0111 2400 E1000 (c42009e37e377ae55968768e521e05c3) C:\WINDOWS\system32\DRIVERS\e1000325.sys 2011/02/13 13:23:28.0281 2400 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys 2011/02/13 13:23:28.0552 2400 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2011/02/13 13:23:28.0902 2400 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 2011/02/13 13:23:29.0073 2400 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 2011/02/13 13:23:29.0203 2400 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 2011/02/13 13:23:29.0433 2400 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 2011/02/13 13:23:29.0513 2400 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2011/02/13 13:23:29.0653 2400 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2011/02/13 13:23:29.0864 2400 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 2011/02/13 13:23:30.0374 2400 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2011/02/13 13:23:30.0575 2400 gv3 (01cdb5b4649fae249e787a83be22916a) C:\WINDOWS\system32\DRIVERS\gv3.sys 2011/02/13 13:23:30.0835 2400 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2011/02/13 13:23:30.0945 2400 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys 2011/02/13 13:23:31.0176 2400 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 2011/02/13 13:23:31.0616 2400 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys 2011/02/13 13:23:31.0786 2400 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\System32\DRIVERS\i2omp.sys 2011/02/13 13:23:32.0017 2400 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2011/02/13 13:23:32.0217 2400 IBMPMDRV (293131c1da5f53cb05f75d637739d79c) C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys 2011/02/13 13:23:32.0518 2400 IBMTPCHK (28deeba2e29cb0e91b641ca95f7740fd) C:\WINDOWS\system32\drivers\IBMBLDID.SYS 2011/02/13 13:23:32.0708 2400 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2011/02/13 13:23:32.0878 2400 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys 2011/02/13 13:23:33.0158 2400 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\System32\DRIVERS\intelide.sys 2011/02/13 13:23:33.0259 2400 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2011/02/13 13:23:33.0419 2400 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 2011/02/13 13:23:33.0599 2400 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2011/02/13 13:23:34.0130 2400 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2011/02/13 13:23:34.0260 2400 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2011/02/13 13:23:34.0440 2400 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2011/02/13 13:23:34.0591 2400 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys 2011/02/13 13:23:34.0781 2400 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2011/02/13 13:23:34.0931 2400 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2011/02/13 13:23:35.0111 2400 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2011/02/13 13:23:35.0372 2400 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2011/02/13 13:23:35.0562 2400 KMW_SYS (624fda9ffa42b16f3f91861b462d69ae) C:\WINDOWS\system32\DRIVERS\KMW_SYS.sys 2011/02/13 13:23:35.0732 2400 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 2011/02/13 13:23:36.0123 2400 ltmodem5 (9ee18a5a45552673a67532ea37370377) C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys 2011/02/13 13:23:36.0744 2400 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2011/02/13 13:23:36.0904 2400 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 2011/02/13 13:23:37.0064 2400 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2011/02/13 13:23:37.0234 2400 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2011/02/13 13:23:37.0415 2400 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2011/02/13 13:23:37.0565 2400 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys 2011/02/13 13:23:37.0705 2400 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2011/02/13 13:23:37.0965 2400 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2011/02/13 13:23:38.0216 2400 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2011/02/13 13:23:38.0496 2400 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2011/02/13 13:23:38.0706 2400 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2011/02/13 13:23:38.0857 2400 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2011/02/13 13:23:39.0087 2400 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2011/02/13 13:23:39.0217 2400 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 2011/02/13 13:23:39.0357 2400 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2011/02/13 13:23:39.0468 2400 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2011/02/13 13:23:39.0568 2400 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2011/02/13 13:23:39.0698 2400 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2011/02/13 13:23:39.0928 2400 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 2011/02/13 13:23:40.0128 2400 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2011/02/13 13:23:40.0249 2400 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2011/02/13 13:23:40.0379 2400 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2011/02/13 13:23:40.0539 2400 NSCIRDA (2adc0ca9945c65284b3d19bc18765974) C:\WINDOWS\system32\DRIVERS\nscirda.sys 2011/02/13 13:23:40.0809 2400 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2011/02/13 13:23:40.0960 2400 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2011/02/13 13:23:41.0120 2400 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2011/02/13 13:23:41.0340 2400 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2011/02/13 13:23:41.0531 2400 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys 2011/02/13 13:23:41.0651 2400 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 2011/02/13 13:23:41.0831 2400 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2011/02/13 13:23:41.0951 2400 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2011/02/13 13:23:41.0991 2400 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 2011/02/13 13:23:42.0041 2400 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2011/02/13 13:23:42.0081 2400 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys 2011/02/13 13:23:42.0221 2400 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys 2011/02/13 13:23:42.0242 2400 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys 2011/02/13 13:23:42.0302 2400 PMEM (fa292805788528c083f416e151b60ab6) C:\WINDOWS\system32\drivers\PMEMNT.SYS 2011/02/13 13:23:42.0362 2400 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2011/02/13 13:23:42.0382 2400 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 2011/02/13 13:23:42.0422 2400 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2011/02/13 13:23:42.0462 2400 PxHelp20 (faa729e2e2fd3afb8df7a45de8769cc3) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys 2011/02/13 13:23:42.0532 2400 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys 2011/02/13 13:23:42.0592 2400 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys 2011/02/13 13:23:42.0722 2400 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\System32\DRIVERS\ql12160.sys 2011/02/13 13:23:42.0782 2400 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys 2011/02/13 13:23:42.0862 2400 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys 2011/02/13 13:23:42.0912 2400 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2011/02/13 13:23:43.0303 2400 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys 2011/02/13 13:23:43.0453 2400 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2011/02/13 13:23:43.0543 2400 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2011/02/13 13:23:43.0684 2400 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2011/02/13 13:23:43.0794 2400 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2011/02/13 13:23:43.0954 2400 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2011/02/13 13:23:44.0004 2400 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2011/02/13 13:23:44.0114 2400 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2011/02/13 13:23:44.0194 2400 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 2011/02/13 13:23:44.0415 2400 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys 2011/02/13 13:23:44.0655 2400 S3SSavage (a94aa8161dd4711bc6f732f21d6407d6) C:\WINDOWS\system32\DRIVERS\s3ssavm.sys 2011/02/13 13:23:44.0865 2400 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2011/02/13 13:23:44.0945 2400 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 2011/02/13 13:23:45.0036 2400 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 2011/02/13 13:23:45.0116 2400 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 2011/02/13 13:23:45.0206 2400 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\System32\DRIVERS\sisagp.sys 2011/02/13 13:23:45.0246 2400 Smapint (26341d0dd225d19fd50e0ee3c3c77502) C:\WINDOWS\system32\drivers\Smapint.sys 2011/02/13 13:23:45.0336 2400 smwdm (66aaa895b7f2337b5c52611241455614) C:\WINDOWS\system32\drivers\smwdm.sys 2011/02/13 13:23:45.0456 2400 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys 2011/02/13 13:23:45.0576 2400 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2011/02/13 13:23:45.0656 2400 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 2011/02/13 13:23:45.0757 2400 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys 2011/02/13 13:23:45.0817 2400 sscdbhk5 (03c111a71a00812eb89b9f42c8ca673f) C:\WINDOWS\system32\drivers\sscdbhk5.sys 2011/02/13 13:23:45.0887 2400 sscdbus (2d4027c46b4c6e45875e3c4ba3f67492) C:\WINDOWS\system32\DRIVERS\sscdbus.sys 2011/02/13 13:23:45.0977 2400 sscdmdfl (f548f1eba107bc19e91189e6a460bd0e) C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys 2011/02/13 13:23:46.0287 2400 sscdmdm (71d348d53597379dfe1de255d70af13c) C:\WINDOWS\system32\DRIVERS\sscdmdm.sys 2011/02/13 13:23:46.0728 2400 ssm_bus (df5c19f053eff7f8ba25d73aea899656) C:\WINDOWS\system32\DRIVERS\ssm_bus.sys 2011/02/13 13:23:47.0038 2400 ssm_mdfl (5347169fa449eabc4d0728ae39fab926) C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys 2011/02/13 13:23:47.0229 2400 ssm_mdm (7aae23dd105eed15c4f45fc269fa42a9) C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys 2011/02/13 13:23:47.0389 2400 ssrtln (78c88430ab1d6dff67380fa10174c152) C:\WINDOWS\system32\drivers\ssrtln.sys 2011/02/13 13:23:47.0569 2400 StarOpen (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys 2011/02/13 13:23:47.0709 2400 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2011/02/13 13:23:47.0890 2400 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2011/02/13 13:23:48.0110 2400 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys 2011/02/13 13:23:48.0160 2400 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys 2011/02/13 13:23:48.0230 2400 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys 2011/02/13 13:23:48.0290 2400 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys 2011/02/13 13:23:48.0410 2400 SynTP (d7dc30b8b41e7a913c3fccc0631e72ec) C:\WINDOWS\system32\DRIVERS\SynTP.sys 2011/02/13 13:23:48.0460 2400 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2011/02/13 13:23:48.0671 2400 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2011/02/13 13:23:48.0891 2400 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2011/02/13 13:23:49.0011 2400 TDSMAPI (e64da7318acaddf0a4400baa921e8ac1) C:\WINDOWS\system32\drivers\TDSMAPI.SYS 2011/02/13 13:23:49.0312 2400 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2011/02/13 13:23:49.0362 2400 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2011/02/13 13:23:49.0662 2400 tfsnboio (2880eba882a311c37b42ecb1322f98e2) C:\WINDOWS\system32\dla\tfsnboio.sys 2011/02/13 13:23:49.0832 2400 tfsncofs (f5cede196c20dc30fa7b813eb6274c7f) C:\WINDOWS\system32\dla\tfsncofs.sys 2011/02/13 13:23:50.0003 2400 tfsndrct (9ae5a9008054ca98be95d07a5ff40830) C:\WINDOWS\system32\dla\tfsndrct.sys 2011/02/13 13:23:50.0143 2400 tfsndres (26b58dbac6fb65e45d42dadf25069b3e) C:\WINDOWS\system32\dla\tfsndres.sys 2011/02/13 13:23:50.0393 2400 tfsnopio (7cd9a98437f6c6b114e71dc07a69ecbd) C:\WINDOWS\system32\dla\tfsnopio.sys 2011/02/13 13:23:50.0543 2400 tfsnpool (67f3a57f24359ca961fb08f7e2d88be9) C:\WINDOWS\system32\dla\tfsnpool.sys 2011/02/13 13:23:50.0674 2400 tfsnudf (7396a56b50afe368a79bab2b62e34f82) C:\WINDOWS\system32\dla\tfsnudf.sys 2011/02/13 13:23:50.0784 2400 tfsnudfa (901f2d599ceb2514964714f69d45351d) C:\WINDOWS\system32\dla\tfsnudfa.sys 2011/02/13 13:23:51.0014 2400 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\System32\DRIVERS\toside.sys 2011/02/13 13:23:51.0154 2400 TPHKDRV (1ced468858a1a4611961a24cf9dd05ef) C:\WINDOWS\system32\drivers\TPHKDRV.sys 2011/02/13 13:23:51.0265 2400 TPPWR (970ab1aef38db6f5e1aae277a6843d54) C:\WINDOWS\system32\drivers\Tppwr.sys 2011/02/13 13:23:51.0365 2400 TSMAPIP (f2aba3066d7921d7fcdbd66dea88be11) C:\WINDOWS\system32\drivers\TSMAPIP.SYS 2011/02/13 13:23:51.0455 2400 TwoTrack (17687545f77a648af7f9f1064eb61191) C:\WINDOWS\system32\DRIVERS\TwoTrack.sys 2011/02/13 13:23:51.0635 2400 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2011/02/13 13:23:51.0925 2400 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys 2011/02/13 13:23:52.0136 2400 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2011/02/13 13:23:52.0396 2400 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys 2011/02/13 13:23:52.0616 2400 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2011/02/13 13:23:52.0767 2400 usbcm (a31c1f4b2448eeeff7c0d4e4d58bd9b3) C:\WINDOWS\system32\DRIVERS\usbcm.sys 2011/02/13 13:23:52.0877 2400 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2011/02/13 13:23:53.0087 2400 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2011/02/13 13:23:53.0297 2400 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2011/02/13 13:23:53.0458 2400 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2011/02/13 13:23:53.0558 2400 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2011/02/13 13:23:53.0668 2400 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2011/02/13 13:23:53.0758 2400 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2011/02/13 13:23:53.0948 2400 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\System32\DRIVERS\viaagp.sys 2011/02/13 13:23:54.0219 2400 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys 2011/02/13 13:23:54.0349 2400 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/02/13 13:23:54.0569 2400 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2011/02/13 13:23:54.0750 2400 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 2011/02/13 13:23:55.0020 2400 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2011/02/13 13:23:55.0330 2400 WinDriver6 (22db0dcb37e73195d9fe43b2480b884f) C:\WINDOWS\system32\drivers\windrvr6.sys 2011/02/13 13:23:55.0901 2400 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 2011/02/13 13:23:56.0212 2400 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2011/02/13 13:23:56.0362 2400 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2011/02/13 13:23:56.0412 2400 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0) 2011/02/13 13:23:56.0412 2400 ================================================================================ 2011/02/13 13:23:56.0412 2400 Scan finished 2011/02/13 13:23:56.0412 2400 ================================================================================ 2011/02/13 13:23:56.0412 1932 Detected object count: 1 2011/02/13 13:24:34.0897 1932 \HardDisk0 - will be cured after reboot 2011/02/13 13:24:34.0897 1932 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
Post #2 last edited
can't insert or attach OTL scan logs, connection is crashing or server is down error from mozilla. Now added below.
Post #4
Any advice would be appreciated to confirm if I should continue with light and cautious usage without logging passwords etc…. or is it safe to continue? Thanks in advance
Post #5
Sorry about the delay in responding :( We look for post with 0 replies, so when you posted to your own log, we assumed you were being helped. Please run TDSSKiller again to make sure the rootkit is gone.
Post #6
Hi, Thanks for picking this up. Ran TDSS and came back clean, however just completed an eset scan and this flagged 4 trojans? See below, I clicked delete these via eset. The TDSS scan was post the eset scan. Thanks C:\WINDOWS\system32\drivers\etc\hosts.20081031-002343.backup Win32/Qhost trojan cleaned by deleting - quarantined C:\WINDOWS\system32\drivers\etc\hosts.20081207-211315.backup Win32/Qhost trojan cleaned by deleting - quarantined C:\WINDOWS\system32\drivers\etc\hosts.20081231-160113.backup Win32/Qhost trojan cleaned by deleting - quarantined C:\WINDOWS\system32\drivers\etc\hosts.msn Win32/Qhost trojan cleaned by deleting - quarantined
Post #7
Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")


Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have XP SP3, use the XP SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.
Post #8
Hi, I disabled avg and combfix didn't like it said it was still running. Tried uninstalling avg and that was not possible either… avg error log posted below. Is there a simple command to delete avg? [AVG.MFA.Core] INFO 2011-02-15 23:55:57,996 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7E31E31A-D3CF-4270-A532-6A5362FDD68E:18.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,006 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0876df7e-4ce9-40da-b5dd-63f1ec9a8b12:181.1204.150614.0 MSG:aBORTM8h5su7msASUTSfWBKj2neoUw1CHjwxU9ODbDui9NThEnF9aX3yb3hKPhdK6mDPvbgAuhJM AC/MUe5IeKOfQGgnyWPytyeZ/ [AVG.MFA.APP] INFO 2011-02-15 23:55:58,006 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0876df7e-4ce9-40da-b5dd-63f1ec9a8b12:742.1204.150614.0 MSG:aAQ5rkEN9AIcb/FRIbeTdlgwaVZDtiHkFqNM9s0wTuOyOOJIy/+f5szpajArT+CoYDMRaXv80zTe21a0MD75yrPIcZJE+D2LiHIAGAFjV/N9UUhfRpvcNYrzQJbFKBKTs+g60Fqy3u79KHLw1ofFHMxrfWUmwYI8v1Nuhe0GDQpG/F3T1MA== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,006 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0876df7e-4ce9-40da-b5dd-63f1ec9a8b12:752.1204.150614.0 MSG:aCrCXUf5H5jSAx4TiZroKEKZH5NsYSgv82CJgxclBOBZTLaTtNBvNJorFBVzd51DRnqcX1B73pLB X [AVG.Lng] WARN 2011-02-15 23:55:58,016 IBM-F5A8855BD0A PID:2640 THID:2672 ID:{92E43B1B-87EB-4c5b-8B4C-F1F0E33933BA}:1110.1204.150614.0 MSG:aDMnX3/EW8xpzSyubZEq6DK7h86oxwQef [AVG.Lng] INFO 2011-02-15 23:55:58,016 IBM-F5A8855BD0A PID:2640 THID:2672 ID:{92E43B1B-87EB-4c5b-8B4C-F1F0E33933BA}:202.1204.150614.0 MSG:aBwx2NG2tC4ga3UAfXwGC6/N/uJ6vKlVq+qTvuvZd/MksGZqTHOB0qudr/CNtLSZOUnOZhQUKMulG1M+VRCXJYH06HjV9xQGzELUgVBdK0K3JEKyz+X9eBo/CkcGbK5yvU2zyiQvLEMjtcfU= [AVG.Lng] INFO 2011-02-15 23:55:58,016 IBM-F5A8855BD0A PID:2640 THID:2672 ID:{92E43B1B-87EB-4c5b-8B4C-F1F0E33933BA}:233.1204.150614.0 MSG:aCyImk5Zn/QHohL+78Bovg40= [AVG.Lng] INFO 2011-02-15 23:55:58,116 IBM-F5A8855BD0A PID:2640 THID:2672 ID:{92E43B1B-87EB-4c5b-8B4C-F1F0E33933BA}:277.1204.150614.0 MSG:* [AVG.Lng] INFO 2011-02-15 23:55:58,116 IBM-F5A8855BD0A PID:2640 THID:2672 ID:{92E43B1B-87EB-4c5b-8B4C-F1F0E33933BA}:343.1204.150614.0 MSG:aBORTJMtk2oifuiD0D3iBRv2rhIs= [AVG.MFA.APP] INFO 2011-02-15 23:55:58,226 IBM-F5A8855BD0A PID:2640 THID:2672 ID:403666d6-be21-4eb5-b55f-9053e9681562:85.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,226 IBM-F5A8855BD0A PID:2640 THID:2672 ID:403666d6-be21-4eb5-b55f-9053e9681562:97.1204.150614.0 MSG:* [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aDMnX3vQL7gwKNBfubkryWa7hob0= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCyImhJV6lSi01bL47kZxwJqqXPc= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCYTZzFHWri46mGg1PhITIXoAO20= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCIZsGOfHFJDXIAXfh25fLLGgpVs= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCyImhJV6lSi01bL47kZxwJqrV/c= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aDZragiaP6Gg+md29ctWpezDHtIA= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCyImhJV6lSi01bL47kZxwJqrUPc= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aAQ5rh0BgaPYG4AxfDoC/nA0NTpc= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aDZragiaP6Gg+md29ctWpezDGvIA= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aDZragiaP6Gg+md29ctWpezDGuoA= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCYTZzFHWri46mGg1PhITIXoBP20= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aDZragiaP6Gg+md29ctWpezDH6YA= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCIZsGOfHFJDXIAXfh25fLLGh8ls= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aBUSkbqqOF2Vnvx33mk90JWZ+Vc0= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aALNbhmxnzdr5qA0C/UfAQjj7pqw= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aAuF9wtoOjeEiq8p6mo2o1LNnBXk= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aAuF9wtoOjeEiq8p6mo2o1LNnVXk= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,236 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCyImhJV6lSi01bL47kZxwJqqV/c= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,246 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aD/kL3lm7+HtU3JL1daT9tZ6k6m0= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,246 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aBtfKclg1biSHYy7MTobkfT/Kuks= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,246 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aCrCXRv1ajjn4utGUY8sCGKNDnrg= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,246 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aA8raDL7w9fznWibO5zX3bsHseck= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,246 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aAQ5rh0BgaPYG4AxfDoC/nA0PSZc= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,246 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:23.1204.150614.0 MSG:aDkxXrTpjspJB6f+/88V6NVmfpss= [AVG.MFA.APP] INFO 2011-02-15 23:55:58,346 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0876df7e-4ce9-40da-b5dd-63f1ec9a8b12:293.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,346 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0876df7e-4ce9-40da-b5dd-63f1ec9a8b12:297.1204.150614.0 MSG:aD/kLyVqmkH4enIasJvW57MH6myMZ8UGjMfza/gzh3jthZmGeekDNUBhX/2HR/aLz+EbVe5H1kjsWxwfnl5zP50r3QspvgMICLda2lTf7qvfP+f8MAvhHpALP9YQTmtQsIjlajW1KgHAQS +I86MSRyNhG80ztqooiauQy36uv0u9g90L8Z5PsVgKJuqQx/PDGlMiPOATzULYzruWqI77xN1JfQbBae6onQWf3dOzfm9rCKfdE1LmSDiT2E+aXkf7hTPxZ+XrJmkMSp ZmBKuOj4tz1uy9WpF6rF/32syip4w92RGmIfhDdag13+2H5743H0GLub9SknDMD3hruw86cqhSgHak3wZxDEqCkggb1o9Dd8ZkjB/Fvti7+yq0o5rMXb0Vpi3xIn0YQT/Ivzoao8Mtk9lHFq5o0d9YZ796sy+dX8UL9fajrUwLMv7Yg5r7Z7+SvJgL3Q6M34c3jC7r2Ck9EQK1fTJ l3LVf1df7AiPnFbu1IxauPKTTSSrmCg+P1QtVD/mvJnEMSoZmsCfuqw8f4uhoK4ErqHbT/hyC49wZ2Z3KfO0yDclFo/2b51ZrT11vCUMzluzQyxQTXv4/e/0r7Te5nm8QfKo2epBnZi8Tq9asrN/hNsC3SzrAm9rBbIjg23ioYwCRCDq8nupKY28N7/2zBpoUmMNIn6oqXk9AZxGj1bYHHWgCYmeUk+qml/fGrPgL6RaQCz8+vb47xDmF6Wq1rXYF/Elrue+LS1PDFc+Jg7YOvAzbDFteOns34X+R4/2OExU0PnpOVJOCluO2ugw4E91e6O+DXsG+67A8zWmOYb0SDcQJn237hnKHHwXXwYOG1nis+1Bb/l5DAs2f5WPtSuex+Ko2epDnomMzi8akvB6lMuCzjwq8zp9ciX2xwiXd5lGYUBqtu8ema3cp0913MqdM7 K5A= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,346 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aDZralSWSgH9h3dD9AY38KGu44cPXHbpBmNm5ig== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,346 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aALNbkW96pc2m7ABCjh+VEWOF/O8CTMf1ozmavw== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,346 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:183.1204.150614.0 MSG:aCIZsD+TafIeiVim49gwqQMDn8CD8to4Iew== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:194.1204.150614.0 MSG:aA8raG73tneuSLAqplleCArCqf7K61qYveKDUGol/Q0N+MZ8+5hzwJSKpjGyiiHqpbw== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:183.1204.150614.0 MSG:aD/kLyVqmkGwhqr6SBMaI2e/iuBYq4kXueQ== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:194.1204.150614.0 MSG:aBtfKZVsoBjPyFQKrP+SREU6M7DDGKx+qoOtisH6AWQIsMfl61962BRwfKDcLQ08yUQ== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:183.1204.150614.0 MSG:aBwx2NG2tC5hvx0Q6cTS11t8pmauCOUEHi9U= [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:185.1204.150614.0 MSG:aBUSkeamTf3ISyTGQ6y0BSRc5B7a9GIDDtUlrtKnS3qCFyYaR9A48Zap9O2VS6GKR1W9GGl/S/DWL6iWOGA== [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:188.1204.150614.0 MSG:aBORTM8h5so+f1gi2UC/DF6S7+8URykaokhtF7/3MH568WQVTjRZEV2jM [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:106.1204.150614.0 MSG:aA8raG73tnfvnNg6MuGK1P5z8XoeXxbJLHtqzYY17Vj0cLrEMxAizMzK+kH216x2fcj1zZnB5ymH 6BjrtEoW+jUb3vgS69uPkpl9uv+4z8WnG8SzdzJjsI2y4kBD1ayVOAUSSSJtk9GVyoI9u1MVu [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:108.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:110.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:112.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:116.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,366 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:123.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,386 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:125.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:129.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:131.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:135.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:137.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:140.1204.150614.0 MSG:aCrCXUf5H5kSO2e/2Fr4ffsMn/KgFTB6TtV0ew8MrBDIIWruDSQC0TfS+d1LdklLE9bg= [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:144.1204.150614.0 MSG:* [AVG.MFA.APP] WARN 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:26.1204.150614.0 MSG:aBwx2NG2tC/Js0lY/dSPd3M4KpMDuCBR19qqFtO9b7LkxboX9YfsNwZlz4gwubTY2IXM= [AVG.MFA.APP] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:97115013-25F1-4a3f-B26C-58BE76596CB2:68.1204.150614.0 MSG:aDkxXujl+2oU6ldSo [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aD/kLyVqmkGwLmJ+1Bvyo5sXbsy4n/UGEKuvT5A== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aD/kLyVqmkGwLmJ+1DPqk8f3gujpM [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aDkxXujl+2oUerfL/ipsjcTrboJwY [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,396 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aCIZsD+TafIeIZAif/jAGaNLl8gya [AVG.MFA.DialogFactory] INFO 2011-02-15 23:55:58,456 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:39.1204.150614.0 MSG:aCyImhJV6lSi01bL47kZxwJqrU/c= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,476 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aCrCXUf5H5i6n/tzUGpVbXMAGw+8P [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,476 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aBORTM8h5soH2wx2qWCHfE5rv2Nxa [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,476 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aCrCXUf5H5jCRw+zKNJJcTcAGw+8P [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,476 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aAuF91dkT5ehL0vckzdT2gdAjUi4r [AVG.MFA.MSI] INFO 2011-02-15 23:55:58,476 IBM-F5A8855BD0A PID:2640 THID:2672 ID:b5747644-3748-4cc2-9f88-d790e64a1566:126.1204.150614.0 MSG:aDZralSWSgEF3wNboMJP8OSc= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,987 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aD/kLyVqmkHI9pa+rIv2j4P3gujpM [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,987 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aCIZsD+TafIeUYwmK2h0HeeL6xAjYsM4= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,987 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aBtfKZVsoBjPEICKZE/W8KGyR2BjiLV8= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:55:58,987 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aA8raG73tneukGSqbukavO5K3S5qe0OY= [AVG.MFA.Core] INFO 2011-02-15 23:55:58,987 IBM-F5A8855BD0A PID:2640 THID:2672 ID:442b5ed6-a79b-43e4-89a6-1556bb085ce4:41.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:55:58,987 IBM-F5A8855BD0A PID:2640 THID:2672 ID:f03b68db-7aaf-425f-956c-88f53ab45fe8:42.1204.150614.0 MSG:aALNbkW96paePyzNgiDLdJFifyrxjYpblmgTHyii7feYEKov+6t37D0kn/veZ+CTTNwc= [AVG.MFA.MSI] INFO 2011-02-15 23:56:00,069 IBM-F5A8855BD0A PID:2640 THID:2672 ID:f269371b-fb99-431c-9bca-2666798e5680:442.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:01,581 IBM-F5A8855BD0A PID:2640 THID:2672 ID:f03b68db-7aaf-425f-956c-88f53ab45fe8:212.1204.150614.0 MSG:aAuF91dkT5ZQotYJkm4+o0KQ= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aDMnXyfcWhhtJdxu7MzmqDP26ke5kgkQ= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aCyImk5Zn/T7rgaO7qiIkg97JELWlhg== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aBwx2NG2tC5lF5XkeRDKV+eoMipKzaA== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aA8raG73tneq4DjeNo1GiLYWPbIuLhw== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aCrCXUf5H5i+n7sDXJ69XW+ch0vpYLA== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aA8raG73tnfW8AzCKsmumMJK5VYGfxZJjOvzT [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,611 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aBUSkeamTf2w85guzzxElezUqLYWYC7SG4B5g [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aA8raG73tnfW8AzCKsmumMJK5VYGfxZJjOvzT [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:122.1204.150614.0 MSG:aAuF91dkT5fB28tw53tz0iMo5Xipf+jpN1g== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aCIZsD+TafJmMeROb0jAOcuL02hPZpbpEOeUy [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aCrCXUf5H5iis48fXJ5peRNocz+t7f0mg3w== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aA8raG73tne2zAzCNo2SrMriycZqo1KRneA== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aA8raG73tne2zAzCNo2SrMriycZqo1KRneA== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aAQ5rkEN9AOdSuRocStHjwHRTEMSZr0gntQ== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aA8raG73tne2zAzCNo2SrMrKzdpie0rJ+MOKnSaldNg== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aDZralSWSgHlqwMv+NoT1J0OY49H+Bqp7g9Ka2Wb9Aw== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aCrCXUf5H5iis48fXJ5peRNAdyOlNeV+5l2tg5f4LdA== [AVG.MFA.APP] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:18.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:33.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:01,621 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:74.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:02,702 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:84.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:02,702 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:89.1204.150614.0 MSG:aDkxXrTpjspJB6f+/88V6NVnKo8s= [AVG.MFA.APP] INFO 2011-02-15 23:56:02,702 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:92.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:02,702 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:51.1204.150614.0 MSG:* [AVG.MFA.DialogFactory] INFO 2011-02-15 23:56:02,702 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:39.1204.150614.0 MSG:aBUSkbqqOF2Vnvx33mk90JWZ+WM0= [AVG.MFA.APP] INFO 2011-02-15 23:56:26,657 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:279.1204.150614.0 MSG:aCIZsFf7cdebXIAXfh25fLLGhp1uR4M55EsEmoxOk3i0txSWFI1p45A== [AVG.MFA.APP] INFO 2011-02-15 23:56:26,657 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:280.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:56:26,657 IBM-F5A8855BD0A PID:2640 THID:2672 ID:77a6b7f2-a75e-4cfd-a68d-5b18de3134cc:59.1204.150614.0 MSG:* [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:26,677 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aAuF91dkT5fB28tw53tz0iMA4WShp/CxUnqwGb6R04Q== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:26,677 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aBUSkeamTf3Qz5gu03h4oeRM3BYmJGo6d6z0z8f6m [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:26,677 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aBUSkeamTf3Qz5gu03h4oeRM3BYmJGo6d6z0z8f6m [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:56:26,677 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aCrCXUf5H5iis48fXJ5peRNYKw/xdf0W/llZH9Otc [AVG.MFA.DialogFactory] INFO 2011-02-15 23:56:26,737 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:39.1204.150614.0 MSG:aBUSkbqqOF2Vnvx33mk90JWZ+Vs0= [AVG.MFA.MSI] INFO 2011-02-15 23:56:26,957 IBM-F5A8855BD0A PID:2640 THID:2672 ID:f269371b-fb99-431c-9bca-2666798e5680:501.1204.150614.0 MSG:* [AVG.MFA.APP] WARN 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0bafcdf6-d958-495a-9178-d86d23a7bd27:126.1204.150614.0 MSG:aBUSkb6+TCnMewCGCkE88dmZ/V9rKWtTV [AVG.MFA.APP] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:1494cdbc-c326-48aa-ac13-4fda7e5eea18:53.1204.150614.0 MSG:aAuF91dkT5fB28tw53tz0iMYvUj15+jZSn5EhfrEj6nwKx7NW1O1FriEhPTSKahP/E9RZQMpVuINhg9HC8d3OsCHVNO/jMqvEdPfTPsPS9qLiPls7aMM6ToKjMn7mKOZ7ftazPtvyQKAkMkBUgGZHukeQOhqQHOfXJ7zp8b/07Jgj7zTy6Dmrgg== [AVG.MFA.APP] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:0bafcdf6-d958-495a-9178-d86d23a7bd27:158.1204.150614.0 MSG:* [AVG.MFA.APP] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:1494cdbc-c326-48aa-ac13-4fda7e5eea18:58.1204.150614.0 MSG:aCyImk5Zn/TngjKS7qhctnO/iAbOg1YhmREIw8Np3STGAxhCzLsM6eT7JNvuhuuDtmCl9OrZu8nb9FaAEI30r/qwxcuCqVLEJroevrbBWIp/G9gGzocSFKU5kNvzEN0Vj0u02iAz0Xg== [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:122.1204.150614.0 MSG:aBtfKZVsoBinTICKdEtq1OWaV5Sn1Lxfh1aIy+EmmWDkbApE= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:297.1204.150614.0 MSG:aDkxXujl+2oMVsOn8t5QmaSzXoI9KoKE4fMDz5zP1 [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:254.1204.150614.0 MSG:aBwx2NG2tC4JO8mQMXAqR/vcwkLKxPUlE6ZfYicV/6Ix5TpE= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:186.1204.150614.0 MSG:aBwx2NG2tC4JO8mQMXAqR/vcwkLKxPUlE6ZfYicV/6Ix5TpE= [AVG.MFA.Core.Statemachine] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:7853AC64-5536-4768-ABEF-33720DA13AD5:190.1204.150614.0 MSG:aD/kLyVqmkHYAn56kKfis8cf7sQ8Z5k2lDOvTrD2v0R92eSE= [AVG.MFA.DialogFactory] INFO 2011-02-15 23:57:52,560 IBM-F5A8855BD0A PID:2640 THID:2672 ID:2A434B3A-07AE-43e6-B815-743CED0FB7F9:39.1204.150614.0 MSG:aAQ5rh0BgaPYG4AxfDoC/nA0NGJc= [AVG.MFA.APP] INFO 2011-02-15 23:59:05,225 IBM-F5A8855BD0A PID:2640 THID:440 ID:f01f0dbd-3fea-4fcf-bc8e-1705f9d44d8a:205.1204.150614.0 MSG:aDkxXujl+2pcLqevmoJQ+bAbBgYVNsasjfeH+vwDop9CUdurtXn677hOKFD5tfhccdrBs5/uBv4JBri17X770KTZCHrkMWIjrOOPb37GaLXcIwuWqVritJE7S0cUfk63H1ynR/kl09s4blgljVEckJ1awStCH3qebPY0YQ2ON6SEdXxGHCWWE60ql+8ysmyxsDumsgFqEqSN6rsS4H4KJ7 4Fr7PIfVfLEH5UtDGd4HRp8tguQltyln2OxM3EYqe0pI1E0jBlJg6Ievcjjp7kjZgzBtol0sbFqK9/UxBGXvq2wSdjFCD7cmjmrKWBjZxEMa9xqk4Tri9M5mm8ndfCmagt+DJUkQpOiGrXr7recJWs9xqiJAuT 4bSKivbB2rofJiGr5/lN//sw4kxghVXE0NkiUSJ37g/PKfKIUZHe5+DQxfQKGCVmDokbp+/OKhgtzDpf8pVGnvDZ+/+LmfuKH/K9qyfBIffzaG4IUcAFDPRJZvFvJpMWmkGGwPnIL7OkhFl4lmQpegbIelOjrpsh6eRXjpJ9LmZseV+H17 TGTmPSPduOiDEzJxxaKEyxSVD0nZpBJ1IfiirtyrDJldbLxOGIdCKpdHNfmTOG287+5K3Yd4paleqa6OG DQ6Ow3t4P020r5/lF3+toepxI5WFAvJ1a9W9O+/JC3RawveESQ8C4sTBeMUGyhgDyU1MacsDh3Bt301Q3ltCte8vT2DoGyxZRr4u1ydujbG4EUGUNeLyhGk E7FroyQm3KoNHRT/bJ6Hns3yTpNlLUTnejo5NJqZB/Isogft6cifven7Cym2+KDOf7rUGPrzR7IURtUTSg9U9FOyKvF44dvq31/V6vwfSxYFo8ET4mzFa2n/7GcPGwFyqKJTPS8ODLg8+0z8oj5lW3o8h9g/toMjxIoQhE9J2aQSdSZyLCKZbMOY1ev4Qk2QBXUXB7Z4UPotLb2wzZ5JcamiVGnrRx36rq7D4G90qNco MlvRsGfV6FDDnxnbAlyoW3h5+HwsFqWcC5y76Uech5HvT5QnJo1nsTuraA5YC/GqYlytbgne/3gv3Kuh8yJfur6TUP63BLbMndtey44X5xfzr7C459uun1EU6nhNDFKA7UsQIz2Lqri/bCpC3UZw6yPXqChOHyzw+M3s6fNoFjJ/ktyx8QVgQIxTXMuLE+DbMW4wqqRbpczZEK8+TE6SU3ZEVCttxK38+qtlCRmDJL3kEOZqT585+LsIryY5 bN35PFMZ/rEFqkfIUgCcCdWvFzBh96nmz3oIWt7jtwbNkEVpwxBhes6j8D3+8NkaBrGuZByh4ERe//i8Qe7ieWFbeLtRi7Ykia2AyJWTSA2CrdTzK/Cn79WmQFWYJqkbSNRPZoEYI+xPbDr6pOUPm1U7P+we7urIn/26fYw8prugjne+ktn8sYdlS0MXVNhDlmUSNOW8LOObLc+dkK0+jN/aRGdDHCtkDqd5vuiqSZqDtyZgUy95WUioraycePOrdQquKoKJLXEFYENMXxsCAtYnkqOi9Wnsm+9PHsL oekQDGQgmwJczpctntHqsbYLQS/AqYhapvUrbt7UyxOglPDIWNvYaXbp7hWKFShDAj0nZ6Jz8Ljes9BDkhRSeInAFBNoJqwhEdCqB5TUxpO HJXVH7KqBT7WmLi/M+/4OgbLQlHb9sXt66MkYihQfXlMtOUuSUZ22zY6tSY4veEbz0RQMbDKlKH+jlzXk+/OOpgNVG8C1wnudmxZQ38LVCpy919sp8eNyQNL4CIkBY3VwFhVto3vkj/yMukXjbWtKkMYUD18fmUNprpc5lcLYirsMUlSfuZByh4EHYPz3rAWXvL25ZfHSbFrL2hWWXwR/bBUaZr125Zz0j8MzoiFaZZTFLzBdXqIoabCVPZ66v7+JB1Yg/7eDT/qDElfD1McRhL7SoljZ3gIi59Q3tTgdQ1AxdWG0f/Cc5/7OfKIQRH+N5zIvAzyIA0upkkbot7zwiTZIOuaVnlCk5ht78Mn3Lu/CzLVf39p6Ps34L7xGYHYNAhZy3Gj4muaC01DtE01+8KwZbR0zxF4btIUHpcrciqU4ahmBiqp5mIEZV8P G1gvvuLq6Sf/wWGH6xVqgGCFUTB0afLZm4Zz28s58ohBEf43nMi8DP6UpYKmVNYzKspyJNkg65pWeUKTmB0Dcw9Yagr6 9mmXAzHZD6ccKyCMoU1AuLxejX8Gm3bqtda4tZVOu5iEjYCOgPV6PplWL4sathj5kBcP4kEOZmx5C4ejy bYCe7Ylv6KJDb9b7M7YDIkEREj5evF3SidekrmGqNSppoekQDGQgmwJczoUercrosbgraw3OsYNNrYc5f uq6sj+uttOvSf/wTz3I7S61NB9hcA8Xc8wK3Lb8kLdQrDJnGI7BHAtkP6cqfq+DK+TY87+4GUw53aqcEYCKBFfS1cELgqn PsFDJ2m0u+t4dlRQsQ1wpJ1a8aemaw6yOLoovdliu8zItQAPUEVCthTKJ9eCz2x9MK/aIqn7p+Stu3tTLE6CU8MhM/vpNLvDNDJoNA1RaJW0es1PUiNitn3KnYCdKodoxO2wmrilJlLMYreLr/sU2eTnOpodes60Hc+fvvwDop8SJevjyWn3v21qHHykRbCQvXphUx7ntgpJs/ghkU6/mAR5dAIUET4GiErbpr4eUPmQ14oOte7W8Nk7j5uEorofQlHz79lBm6OksoScoQ0woNETMC5Dkge3PMu5 pa0qN5zI7WBOdJEjd4wel1/2skT9mHf+ui3aw9RZE1Pv+E6CU5JN6+ctGY/6VKac9Hk1DESlFlU/DvuemjHO3MnkL7KVzbwNB210YnKopvOPmsIFyMyDBtphxsa0zd/e6sj+uqeWTauTxWFr12w6HHSFUWw0ySZRU06+M8oJ8jSlyRpn6MzoDPbokaY6xErfi3LeQOjhY07m/S7G4E3394qwRt5/plW3Z+kxnyNwflkx8TUMSL0+Bfs+k1O2tea0pclue/Tg8RiOdCFzd5wel1PumhQ5qB8rruVG9piRm8uvuCryS9LVt6O8CIufULoMcPV5NIClToVvUooyAxFyaM nRDsPAzK15QiANIwIUerfPmrZI5WSjDqcxqp60lYc/G8jO+kuOHbeTwUTPfyQ6HLQB3fgU6XpBG3J7erJJivy9eRZT7LitMHIUISN3mB6XSxo+QPGAFkquDTbm pO27v0ssPt43lik3071ouqtQGsx8kX0w1OkadB9y2lg==
Post #10
Hi, the tools you supplied didn't work…. but seemed to run with success. I am running xp sp 2 or 3. I tried again via uninstall programs the error is msi action failed, avg watchdog could not be stopped. there is also an avg linkscanner still on my toolbar which i have disabled but combofix still can't run. Thanks
Post #14
Hi Combofix log below, I clicked the mouse by accident after around 10 mins, it then prompted preparing log file don't try and use any programs etc… Not sure if this ended it or it was almost complete.

ComboFix 11-02-15.01 - kev 16/02/2011 0:59.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.687 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Desktop\Continue Betfred Poker setup.lnk
c:\windows\system32\Nagasoft

.
((((((((((((((((((((((((( Files Created from 2011-01-16 to 2011-02-16 )))))))))))))))))))))))))))))))
.

2011-02-15 17:19 . 2011-02-15 17:19 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-02-15 17:18 . 2011-02-15 17:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro
2011-02-14 00:12 . 2011-02-14 00:12 472808 —-a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-02-14 00:12 . 2011-02-14 00:12 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-02-14 00:12 . 2011-02-14 00:12 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-02-14 00:11 . 2011-02-14 00:11 0 —-a-w- c:\windows\system32\REN150.tmp
2011-02-14 00:11 . 2011-02-14 00:11 0 —-a-w- c:\windows\system32\REN14F.tmp
2011-02-14 00:11 . 2011-02-14 00:11 0 —-a-w- c:\windows\system32\REN14E.tmp
2011-02-13 23:56 . 2011-02-13 23:56 ——– d—–w- c:\program files\Sun
2011-02-13 03:00 . 2011-02-13 03:00 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2011-02-01 21:10 . 2011-02-01 21:10 ——– d—–w- c:\program files\Veetle
2011-01-21 14:44 . 2011-01-21 14:44 439296 ——w- c:\windows\system32\dllcache\shimgvw.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 1980-01-01 08:00 439296 —-a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 1980-01-01 08:00 290048 —-a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10 . 2008-11-08 19:03 1854976 —-a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2008-03-18 20:31 301568 —-a-w- c:\windows\system32\kerberos.dll
2010-12-20 22:15 . 2006-06-23 11:33 667136 —-a-w- c:\windows\system32\wininet.dll
2010-12-20 22:15 . 1980-01-01 08:00 61952 —-a-w- c:\windows\system32\tdc.ocx
2010-12-20 22:15 . 2004-08-04 07:56 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-12-20 18:09 . 2009-02-23 21:33 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2009-02-23 21:33 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-12-20 17:26 . 2008-11-08 19:03 730112 —-a-w- c:\windows\system32\lsasrv.dll
2010-12-20 15:30 . 2004-08-04 05:59 369664 —-a-w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2008-11-08 19:03 718336 —-a-w- c:\windows\system32\ntdll.dll
2010-12-09 14:30 . 2008-11-08 19:03 33280 —-a-w- c:\windows\system32\csrsrv.dll
2010-12-09 13:38 . 2008-11-08 19:03 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07 . 2008-11-08 19:03 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-02 17:31 . 2010-12-02 17:31 184320 —-a-w- c:\windows\TPBATHLP.EXE
2010-11-29 17:38 . 2010-11-29 17:38 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 17:38 . 2010-11-29 17:38 69632 —-a-w- c:\windows\system32\QuickTime.qts
2010-11-25 17:33 . 2009-01-06 20:14 7304 —-a-w- c:\windows\TMP0001.TMP
2010-11-18 18:12 . 2002-09-27 01:14 81920 —-a-w- c:\windows\system32\isign32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2002-10-18 87751]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-04-30 05:00 315392 —-a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 00:12 110592 —-a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMMGAG]
2003-01-17 09:32 64000 —-a-w- c:\progra~1\ThinkPad\UTILIT~1\PWRMONIT.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMMLREF]
2003-01-17 09:32 20480 —-a-w- c:\program files\ThinkPad\Utilities\BMMLREF.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2003-01-10 11:50 106551 —-a-w- c:\windows\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX210 Series]
2008-11-05 05:00 199680 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIFDE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX210 Series (Copy 1)]
2008-11-05 05:00 199680 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIFDE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EXSHOW95.EXE]
2001-09-07 16:18 45056 —-a-w- c:\windows\system32\exshow95.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP]
2002-12-24 10:01 204800 —-a-w- c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-11-23 17:16 136176 —-atw- c:\documents and settings\kev\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ibmmessages]
2003-01-07 22:52 495616 —-a-w- c:\program files\IBM\Messages By IBM\ibmmessages.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 17:16 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-21 21:27 4351216 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2007-12-27 22:30 155648 ——w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QCWLICON]
2003-03-27 10:06 53248 —-a-w- c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 17:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3TRAY2]
2001-10-12 06:32 69632 —-a-w- c:\windows\system32\S3Tray2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
2002-06-18 08:01 155648 —-a-w- c:\program files\VERITAS Software\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2010-04-22 23:16 128296 —-a-w- c:\program files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TP4EX]
2002-09-04 09:05 53248 —-a-w- c:\windows\system32\TP4EX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY]
2003-01-25 01:37 94208 —-a-w- c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPKMAPMN]
2003-02-17 08:30 32835 —-a-w- c:\program files\ThinkPad\Utilities\TpKmapMn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"aawservice"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\William Hill Poker\\UA.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Messenger\\MsMsgs.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [27/12/2007 05:36 15360]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys –> c:\windows\system32\DRIVERS\ggflt.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2011-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2011-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-627446036-2653871946-2631661031-1004Core.job
- c:\documents and settings\kev\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-23 17:16]

2011-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-627446036-2653871946-2631661031-1004UA.job
- c:\documents and settings\kev\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-23 17:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Connection Wizard,ShellNext = hxxp:///
uInternet Settings,ProxyOverride = *.local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\kev\Application Data\Mozilla\Firefox\Profiles\h2r5ca2b.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4d5b1ae4&v=6.011.025.001&i=27&tp=ab&iy=&ychte=uk&lng=en-GB&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: British English Dictionary: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSConfigStartUp-AVG_TRAY - c:\program files\AVG\AVG10\avgtray.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-16 01:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-627446036-2653871946-2631661031-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*`%T%,%]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-627446036-2653871946-2631661031-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*`%T%,%\OpenWithList]
@Class="Shell"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-02-16 01:11:38
ComboFix-quarantined-files.txt 2011-02-16 01:11

Pre-Run: 16,900,857,856 bytes free
Post-Run: 17,615,839,232 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

Current=6 Default=6 Failed=4 LastKnownGood=2 Sets=1,2,4,6
- - End Of File - - 9321280EE40BDE69A600F0E25087A459
Post #15
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

KillAll::

File::
c:\windows\system32\REN150.tmp
c:\windows\system32\REN14F.tmp
C:\windows\system32\REN14E.tmp

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste


Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI