Google redirect

Thanks Patndoris.
Downloaded DDS.SCR to the desktop, but windows is unable to execute as the dialog box states it needs to know what program created it. Unable to procede further with DDS steps of your instructions.
Ran Rootkit Unhooker as instructed although it never prompted for drive selection. I also did not receive the warning that rootkit unhooker detected a parasite within itself. Log is here:

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #1
==============================================
>Drivers
==============================================
0xB8428000 C:\windows\System32\DRIVERS\nv4_mini.sys 6557696 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 175.19 )
0xAB58D000 C:\windows\system32\DRIVERS\lvuvc.sys 6361088 bytes (Logitech Inc., Logitech USB Video Class Driver)
0xBF012000 C:\windows\System32\nv4_disp.dll 6111232 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 175.19 )
0x804D7000 C:\windows\system32\ntoskrnl.exe 2192768 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2192768 bytes
0x804D7000 RAW 2192768 bytes
0x804D7000 WMIxWDM 2192768 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\windows\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xB82B3000 C:\windows\system32\drivers\P16X.sys 1298432 bytes (Creative Technology Ltd., WDM Audio Miniport)
0xAB403000 C:\windows\system32\DRIVERS\lvrs.sys 761856 bytes (Logitech Inc., Logitech Kernel Audio Improvement Filter Driver)
0xB81A6000 C:\windows\system32\drivers\smwdm.sys 581632 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
0xF7B52000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xB1440000 C:\windows\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB592F000 C:\windows\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xB1DBE000 C:\windows\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA99A7000 C:\windows\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBF5E6000 C:\windows\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xB1D86000 C:\windows\system32\DRIVERS\tcpip6.sys 229376 bytes (Microsoft Corporation, IPv6 driver)
0xA98BE000 C:\windows\system32\drivers\RMCast.sys 204800 bytes (Microsoft Corporation, Reliable Multicast Transport)
0xB5A06000 C:\windows\System32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xF75A8000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xB58F7000 C:\windows\system32\DRIVERS\MarvinBus.sys 188416 bytes (Pinnacle Systems GmbH, Pinnacle Marvin Discrete Bus Enumerator)
0xA9A77000 C:\windows\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF7B25000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF7842000 dac2w2k.sys 180224 bytes (Mylex Corporation, Mylex Disk Array Controller Driver)
0xA7E75000 C:\windows\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xB14B0000 C:\windows\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB1D5E000 C:\windows\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF74B2000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xB1CCC000 C:\windows\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xB8248000 C:\windows\System32\DRIVERS\e100b325.sys 147456 bytes (Intel Corporation, Intel® PRO/100 Adapter NDIS 5.1 driver)
0xA80AB000 C:\windows\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xB826C000 C:\windows\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB83F0000 C:\windows\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB8290000 C:\windows\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xB1D3C000 C:\windows\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xB1CF2000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x806EF000 ACPI_HAL 131840 bytes
0x806EF000 C:\windows\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF7967000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF74D8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xBA7E6000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF786E000 adpu160m.sys 102400 bytes (Microsoft Corporation, Adaptec Ultra160 SCSI miniport)
0xA9B44000 C:\windows\system32\dla\tfsnudfa.sys 102400 bytes (Sonic Solutions, Drive Letter Access Component)
0xF7482000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xA9E1D000 C:\windows\System32\Drivers\dump_atapi.sys 98304 bytes
0xF749A000 C:\windows\System32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xF782A000 SI3112r.sys 98304 bytes (Silicon Image, Inc., Serial ATA RAID miniport driver)
0xA9B5D000 C:\windows\system32\dla\tfsnudf.sys 98304 bytes (Sonic Solutions, Drive Letter Access Component)
0xF7A23000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xA9968000 C:\windows\system32\drivers\mqac.sys 94208 bytes (Microsoft Corporation, Windows NT MQ Access Control Device Driver)
0xB5BA8000 C:\windows\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xF7A3A000 drvmcdb.sys 86016 bytes (Sonic Solutions, Device Driver)
0xA9B75000 C:\windows\system32\dla\tfsnifs.sys 86016 bytes (Sonic Solutions, Drive Letter Access Component)
0xA9719000 C:\windows\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB8234000 C:\windows\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xB8414000 C:\windows\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xB1E17000 C:\windows\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\windows\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7955000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF7597000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB5B97000 C:\windows\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xB13D0000 C:\windows\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF7412000 C:\windows\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF7537000 C:\windows\System32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)
0xF76E7000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xF7422000 C:\windows\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xB581B000 C:\windows\System32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)
0xF7452000 C:\windows\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF7402000 C:\windows\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xBA36C000 C:\windows\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xAC236000 C:\windows\system32\drivers\usbaudio.sys 61440 bytes (Microsoft Corporation, USB Audio Class Driver)
0xBA756000 C:\windows\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF76F7000 C:\windows\System32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xF7657000 aic78u2.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra2 SCSI miniport)
0xF7627000 aic78xx.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra SCSI miniport)
0xF76B7000 C:\windows\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xAF227000 C:\windows\System32\DRIVERS\hphid411.sys 53248 bytes (HP, IEEE-1284.4-1999 Driver (Windows 2000))
0xAC1C6000 C:\windows\System32\Drivers\hphs2k11.sys 53248 bytes (Hewlett-Packard, Printer Card Mass Storage Driver)
0xF7432000 C:\windows\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xB9EC3000 C:\windows\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF7617000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF7697000 ql12160.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF7687000 ql1280.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xB9EB3000 C:\windows\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF7567000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xF7557000 agpCPQ.sys 45056 bytes (Microsoft Corporation, CompatNT AGP Filter)
0xF7587000 alim1541.sys 45056 bytes (Microsoft Corporation, ALi M1541 NT AGP Filter)
0xF7577000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter)
0xB287E000 C:\windows\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF7887000 C:\windows\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF7607000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xBA3BC000 C:\windows\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF76D7000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter)
0xBA7C6000 C:\windows\system32\DRIVERS\BackupReader.sys 40960 bytes (Microsoft Corporation, Backup Reader Driver)
0xB9E73000 C:\windows\system32\drivers\drvnddm.sys 40960 bytes (Sonic Solutions, Device Driver Manager)
0xF75F7000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xB9E53000 C:\windows\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF7677000 ql1080.sys 40960 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF7647000 ql1240.sys 40960 bytes (Microsoft Corporation, QLogic ISP PCI Adapters)
0xF76C7000 sisagp.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter)
0xF7517000 C:\windows\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF76A7000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xB13F0000 C:\windows\System32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF7472000 C:\windows\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xB583B000 C:\windows\system32\drivers\ip6fw.sys 36864 bytes (Microsoft Corporation, IPv6 Windows Firewall Driver)
0xAD0BB000 C:\windows\system32\drivers\LVUSBSta.sys 36864 bytes (Logitech Inc., USB Statistic Driver)
0xB9E93000 C:\windows\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xB586B000 C:\windows\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA818A000 C:\windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF7637000 ql10wnt.sys 36864 bytes (Microsoft Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xB9797000 C:\windows\system32\dla\tfsncofs.sys 36864 bytes (Sonic Solutions, Drive Letter Access Component)
0xF7667000 ultra.sys 36864 bytes (Promise Technology, Inc., Promise Ultra66 Miniport Driver)
0xB582B000 C:\windows\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xB5A76000 C:\windows\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7737000 symc8xx.sys 32768 bytes (LSI Logic, Symbios 8XX SCSI Miniport Driver)
0xF7747000 sym_u3.sys 32768 bytes (LSI Logic, Symbios Ultra3 SCSI Miniport Driver)
0xBA001000 C:\windows\System32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF77B7000 C:\windows\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF771F000 asc.sys 28672 bytes (Advanced System Products, Inc., AdvanSys SCSI Controller Driver)
0xF77BF000 C:\windows\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xB77C6000 C:\windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF776F000 hpn.sys 28672 bytes (Microsoft Corporation, NetRAID-4M Miniport Driver)
0xF77CF000 C:\windows\System32\Drivers\MxlW2k.SYS 28672 bytes (MusicMatch, Inc., MusicMatch Access Layer KMD)
0xF7707000 C:\windows\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7767000 perc2.sys 28672 bytes (Microsoft Corporation, PERC 2 Miniport Driver)
0xF773F000 sym_hi.sys 28672 bytes (LSI Logic, Symbios Hi-Perf SCSI Miniport Driver)
0xF7807000 C:\windows\system32\dla\tfsnboio.sys 28672 bytes (Sonic Solutions, Drive Letter Access Component)
0xB77F6000 C:\windows\System32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xF774F000 ABP480N5.SYS 24576 bytes (Microsoft Corporation, AdvanSys SCSI Controller Driver)
0xF7757000 asc3350p.sys 24576 bytes (Microsoft Corporation, AdvanSys SCSI Card Driver)
0xF77D7000 C:\windows\System32\Drivers\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xF77C7000 C:\windows\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA675000 C:\windows\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xB5A66000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xB5A6E000 C:\windows\system32\Drivers\SbcpHid.sys 24576 bytes (-, -)
0xB77CE000 C:\windows\system32\drivers\ssrtln.sys 24576 bytes (Sonic Solutions, Shared Driver Component)
0xF77AF000 C:\windows\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xB77BE000 C:\windows\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xB9FC9000 C:\windows\System32\drivers\BrPar.sys 20480 bytes (Brother Industries Ltd., Brother Parallel class Driver version 1.01)
0xF775F000 dpti2o.sys 20480 bytes (Microsoft Corporation, DPT SmartRAID miniport)
0xF77E7000 C:\windows\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xB1E42000 C:\windows\System32\drivers\hphius11.sys 20480 bytes (HP, 1284.4<->Usb Datalink Driver (Windows 2000))
0xF772F000 i2omp.sys 20480 bytes (Microsoft Corporation, I2O Miniport Driver)
0xB8AB1000 C:\windows\system32\DRIVERS\LVPr2Mon.sys 20480 bytes (-, -)
0xF7727000 mraid35x.sys 20480 bytes (American Megatrends Inc., MegaRAID RAID Controller Driver for Windows Whistler 32)
0xB5A7E000 C:\windows\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xBA64D000 C:\windows\System32\DRIVERS\omci.sys 20480 bytes (Dell Computer Corporation, OMCI Device Driver)
0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF777F000 ppa.sys 20480 bytes (Microsoft Corporation, PPA Protocol Driver)
0xBA655000 C:\windows\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF7777000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xBA665000 C:\windows\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF7717000 sparrow.sys 20480 bytes (Adaptec, Inc., Adaptec AIC-6x60 series SCSI miniport)
0xF781F000 C:\windows\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xA9F57000 C:\windows\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF789F000 aha154x.sys 16384 bytes (Microsoft Corporation, Adaptec AHA-154x series SCSI miniport)
0xF78AF000 asc3550.sys 16384 bytes (Advanced System Products, Inc., AdvanSys Ultra-Wide PCI SCSI Driver)
0xB2F44000 C:\windows\System32\Drivers\Aspi32.SYS 16384 bytes (Adaptec, ASPI for WIN32 Kernel Driver)
0xF78B7000 cbidf2k.sys 16384 bytes (Microsoft Corporation, CardBus/PCMCIA IDE Miniport Driver)
0xF789B000 cpqarray.sys 16384 bytes (Microsoft Corporation, Compaq Drive Array Controllers SCSI Miniport Driver)
0xF78A7000 dac960nt.sys 16384 bytes (Microsoft Corporation, Mylex Disk Array Controller Driver)
0xAC066000 C:\windows\System32\DRIVERS\hphipr11.sys 16384 bytes (HP, IEEE-1284.4-1999 Print Class Driver)
0xF78B3000 ini910u.sys 16384 bytes (Microsoft Corporation, INITIO ini910u SCSI miniport)
0xBA6EA000 C:\windows\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xBA6E2000 C:\windows\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB9D98000 C:\windows\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF78A3000 symc810.sys 16384 bytes (Symbios Logic Inc., Symbios Logic Inc. SCSI Miniport Driver)
0xB9D90000 C:\windows\system32\dla\tfsnopio.sys 16384 bytes (Sonic Solutions, Drive Letter Access Component)
0xF78AB000 amsint.sys 12288 bytes (Microsoft Corporation, AMD SCSI/NET Controller)
0xF7897000 C:\windows\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xBA6B5000 C:\windows\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xB9D9C000 C:\windows\System32\DRIVERS\gameenum.sys 12288 bytes (Microsoft Corporation, Game Port Enumerator)
0xB1C8A000 C:\windows\System32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xB5BCF000 C:\windows\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xA9A47000 C:\windows\System32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
0xAF4FA000 C:\windows\System32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xBA706000 C:\windows\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xB9D94000 C:\windows\system32\drivers\pfc.sys 12288 bytes (Padus, Inc., Padus® ASPI Shell)
0xB5BBF000 C:\windows\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xA9987000 C:\windows\system32\drivers\ScFBPNT2.SYS 12288 bytes
0xF78BB000 SiWinAcc.sys 12288 bytes (Silicon Image, Inc., Windows Accelerator Driver)
0xB9DA0000 C:\windows\system32\DRIVERS\tunmp.sys 12288 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0xF79F7000 C:\windows\system32\drivers\aeaudio.sys 8192 bytes (Andrea Electronics Corporation, Andrea Audio Stub Driver)
0xF798B000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver)
0xF79ED000 C:\windows\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7997000 cd20xrnt.sys 8192 bytes (Microsoft Corporation, IBM Portable CD-ROM Drive Miniport)
0xF798D000 cmdide.sys 8192 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver)
0xF7995000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xABDCB000 C:\windows\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF79EB000 C:\windows\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7993000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF7987000 C:\windows\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF79F3000 C:\windows\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF79EF000 C:\windows\system32\DRIVERS\msikbd2k.sys 8192 bytes (Netropa Corporation, Multimedia Keyboard Driver for Windows 2000)
0xB371E000 C:\windows\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF7999000 perc2hib.sys 8192 bytes (Microsoft Corporation, PERC 2 Hibernate Driver)
0xB9DFD000 C:\WINDOWS\System32\PfModNT.sys 8192 bytes (Creative Technology Ltd., PCI/ISA Device Info. Service)
0xF79F5000 C:\windows\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF79F1000 C:\windows\system32\drivers\sscdbhk5.sys 8192 bytes (Sonic Solutions, Shared Driver Component)
0xF79C3000 C:\windows\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xB781E000 C:\windows\system32\dla\tfsnpool.sys 8192 bytes (Sonic Solutions, Drive Letter Access Component)
0xF798F000 toside.sys 8192 bytes (Microsoft Corporation, Toshiba PCI IDE Controller)
0xF79D1000 C:\windows\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7991000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xF7989000 C:\windows\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7A6C000 C:\windows\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xB5B66000 C:\windows\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xB292C000 C:\windows\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7A4F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xB9BE9000 C:\windows\system32\dla\tfsndrct.sys 4096 bytes (Sonic Solutions, Drive Letter Access Component)
0xB9BEA000 C:\windows\system32\dla\tfsndres.sys 4096 bytes (Sonic Solutions, Drive Letter Access Component)
==============================================
>Stealth
==============================================
WARNING: Virus alike driver modification [hsfdpsp2.sys]
WARNING: Virus alike driver modification [atinrvxx.sys]
WARNING: Virus alike driver modification [wadv08nt.sys]
WARNING: Virus alike driver modification [ati1mdxx.sys]
WARNING: Virus alike driver modification [ACPIEC.SYS]
WARNING: Virus alike driver modification [CPQDAP01.SYS]
WARNING: Virus alike driver modification [wadv07nt.sys]
WARNING: Virus alike driver modification [wadv09nt.sys]
WARNING: Virus alike driver modification [wadv11nt.sys]
WARNING: Virus alike driver modification [NIKEDRV.SYS]
WARNING: Virus alike driver modification [RIO8DRV.SYS]
WARNING: Virus alike driver modification [RIODRV.SYS]
WARNING: Virus alike driver modification [ati1pdxx.sys]
WARNING: Virus alike driver modification [FSVGA.SYS]
WARNING: Virus alike driver modification [mtlmnt5.sys]
0x05360000 Hidden Image–>System.ServiceProcess.dll [ EPROCESS 0x8975C588 ] PID: 1892, 126976 bytes
WARNING: Virus alike driver modification [slnt7554.sys]
WARNING: Virus alike driver modification [mtlstrm.sys]
WARNING: Virus alike driver modification [slwdmsup.sys]
WARNING: Virus alike driver modification [recagent.sys]
WARNING: Virus alike driver modification [atinmdxx.sys]
WARNING: Virus alike driver modification [atinttxx.sys]
WARNING: Virus alike driver modification [atinpdxx.sys]
0x8A90BA58 Unknown page with executable code, 1448 bytes
WARNING: Virus alike driver modification [SMCLIB.SYS]
WARNING: Virus alike driver modification [s3gnbm.sys]
WARNING: Virus alike driver modification [ntmtlfax.sys]
WARNING: Virus alike driver modification [iqvw32.sys]
0x03950000 Hidden Image–>System.XML.dll [ EPROCESS 0x8975C588 ] PID: 1892, 2060288 bytes
WARNING: Virus alike driver modification [ati1ttxx.sys]
WARNING: Virus alike driver modification [TSBVCAP.SYS]
WARNING: Virus alike driver modification [hsfbs2s2.sys]
WARNING: Virus alike driver modification [geneuide.sys]
WARNING: Virus alike driver modification [watv06nt.sys]
WARNING: Virus alike driver modification [watv10nt.sys]
WARNING: Virus alike driver modification [CINEMST2.SYS]
WARNING: Virus alike driver modification [ati1snxx.sys]
0x04450000 Hidden Image–>System.EnterpriseServices.dll [ EPROCESS 0x8975C588 ] PID: 1892, 266240 bytes
0x04110000 Hidden Image–>System.Transactions.dll [ EPROCESS 0x8975C588 ] PID: 1892, 270336 bytes
0x00F80000 Hidden Image–>log4net.dll [ EPROCESS 0x8975C588 ] PID: 1892, 282624 bytes
WARNING: Virus alike driver modification [atinsnxx.sys]
WARNING: Virus alike driver modification [ati1xbxx.sys]
0x03DE0000 Hidden Image–>System.Data.dll [ EPROCESS 0x8975C588 ] PID: 1892, 2961408 bytes
WARNING: Virus alike driver modification [ati1raxx.sys]
0x049A0000 Hidden Image–>System.Runtime.Remoting.dll [ EPROCESS 0x8975C588 ] PID: 1892, 307200 bytes
WARNING: Virus alike driver modification [ATMEPVC.SYS]
WARNING: Virus alike driver modification [atinxbxx.sys]
0x03330000 Hidden Image–>System.dll [ EPROCESS 0x8975C588 ] PID: 1892, 3190784 bytes
WARNING: Virus alike driver modification [ati2mtaa.sys]
WARNING: Virus alike driver modification [RAWWAN.SYS]
0x8A90A288 Unknown page with executable code, 3448 bytes
WARNING: Virus alike driver modification [ati1xsxx.sys]
WARNING: Virus alike driver modification [ATMUNI.SYS]
WARNING: Virus alike driver modification [ati1tuxx.sys]
0x8A90C158 Unknown page with executable code, 3752 bytes
WARNING: Virus alike driver modification [slntamr.sys]
0x05270000 Hidden Image–>Intuit.Spc.Map.WindowsFirewallUtilities.dll [ EPROCESS 0x8975C588 ] PID: 1892, 421888 bytes
0x03170000 Hidden Image–>System.configuration.dll [ EPROCESS 0x8975C588 ] PID: 1892, 438272 bytes
WARNING: Virus alike driver modification [mtxparhm.sys]
0x04180000 Hidden Image–>Intuit.Spc.Map.Reporter.dll [ EPROCESS 0x8975C588 ] PID: 1892, 479232 bytes
0x04BF0000 Hidden Image–>System.Windows.Forms.dll [ EPROCESS 0x8975C588 ] PID: 1892, 5033984 bytes
WARNING: Virus alike driver modification [TOSDVD.SYS]
WARNING: Virus alike driver modification [atinraxx.sys]
0xF7617000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes
WARNING: Virus alike driver modification [NWLNKSPX.SYS]
WARNING: Virus alike driver modification [ati1btxx.sys]
WARNING: Virus alike driver modification [atinbtxx.sys]
WARNING: Virus alike driver modification [VDMINDVD.SYS]
WARNING: Virus alike driver modification [ROOTMDM.SYS]
0x8A90EE41 Unknown thread object [ ETHREAD 0x8A5BA998 ] TID: 124, 600 bytes
0x8A910F55 Unknown thread object [ ETHREAD 0x8A5BA720 ] TID: 128, 600 bytes
0x8A90EB0C Unknown thread object [ ETHREAD 0x8A5BA4A8 ] , 600 bytes
WARNING: Virus alike driver modification [NWLNKNB.SYS]
WARNING: Virus alike driver modification [atinxsxx.sys]
0x051D0000 Hidden Image–>System.Drawing.dll [ EPROCESS 0x8975C588 ] PID: 1892, 634880 bytes
WARNING: Virus alike driver modification [ati1rvxx.sys]
WARNING: Virus alike driver modification [hsfcxts2.sys]
WARNING: Virus alike driver modification [atintuxx.sys]
WARNING: Virus alike driver modification [MCD.SYS]
0x03CF0000 Hidden Image–>System.Data.SQLite.DLL [ EPROCESS 0x8975C588 ] PID: 1892, 872448 bytes
WARNING: Virus alike driver modification [slnthal.sys]
0x8A910C29 Unknown page with executable code, 983 bytes

Thanks patndoris. You are correct, I do not currently have an antivirus installed. Our Norton recently expired (so i removed) and hadn't yet intalled Avast when this thing hit me! When I logged into the pc just now to continue with your latest instructions, an apparently bogus antivirus began a system scan, which I promptly terminated (by clicking X) but then several security alert/virus alerts messages appeared (eg rundll.exe is damaged, regedit is damaged). Then I ran rkill and the alert appeared that rkill is damaged. I left that warning on screen and then ran another copy (differnt name) and it successfully terminated something. I had previously installed dds.scr, so I just renamed to .exe and ran it successfully. dds.txt log is pasted below and attach.txt log is attached. Thanks! DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 19:14:53.96 on Mon 03/07/2011 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1279.651 [GMT -5:00] ============== Running Processes =============== C:\windows\system32\svchost -k DcomLaunch svchost.exe C:\windows\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\windows\system32\spoolsv.exe svchost.exe C:\windows\Nhksrv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\windows\system32\nvsvc32.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\windows\System32\svchost.exe -k imgsvc C:\WINDOWS\System32\MsPMSPSv.exe C:\windows\system32\SearchIndexer.exe C:\windows\system32\mqsvc.exe C:\Program Files\Windows Home Server\WHSConnector.exe C:\windows\system32\mqtgsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\windows\system32\ctfmon.exe C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\windows\System32\spool\drivers\w32x86\3\hpztsb07.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Nova Development\Scrapbook Factory Deluxe 4.0\ReminderApp.exe C:\windows\system32\RUNDLL32.EXE C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\windows\system32\rundll32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\windows\system32\ctfmon.exe C:\Program Files\Windows Home Server\WHSTrayApp.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\windows\explorer.exe C:\windows\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\windows\system32\SearchProtocolHost.exe C:\Documents and Settings\McDonald Main\Desktop\dds.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyServer = http=127.0.0.1:33554 uInternet Settings,ProxyOverride = mURLSearchHooks: H - No File BHO: rsion - No File BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - c:\program files\windows home server\WHSDeskBands.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - c:\program files\windows home server\WHSDeskBands.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File TB: {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - No File TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [uaxwntjy] c:\docume~1\mcdona~1\locals~1\temp\uxcjwykgi\bmnsfrejfdi.exe uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)" -"http://www.candystand.com/play-random-games?utm_source=adon_113647_12637_91452&utm_medium=cpc&utm_campaign=adon2011-6" mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe" mRun: [diagent] "c:\program files\creative\sblive\diagnostics\diagent.exe" startup mRun: [UpdReg] c:\windows\UpdReg.EXE mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe mRun: [ViewMgr] c:\program files\viewpoint\viewpoint manager\ViewMgr.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [ReminderApp] c:\program files\nova development\scrapbook factory deluxe 4.0\ReminderApp.exe mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [MsmqIntCert] regsvr32 /s mqrt.dll mRun: [USB2Check] RUNDLL32.EXE "c:\windows\system32\PCLECoInst.dll",CheckUSBController mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\docume~1\mcdona~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe StartupFolder: c:\docume~1\mcdona~1\startm~1\programs\startup\window~1.lnk - c:\windows\installer\{21e49794-7c13-4e84-8659-55bd378267d5}\WHSTrayApp.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\windows\installer\{21e49794-7c13-4e84-8659-55bd378267d5}\WHSTrayApp.exe mPolicies-explorer: = IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000 IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL Trusted Zone: intuit.com\ttlc Trusted Zone: nexusradio.com\www DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxps://www.4lightning.net/Citrix/ICAWEB/en/ica32/wficac.cab DPF: {3C648A72-C49A-48EF-9F90-68EF13293F97} - hxxp://www.priv.njmls.xmlsweb.com/XMLSearch/XMLCache.CAB DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1234849144687 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} - hxxp://web1.shutterfly.com/downloads/Uploader.cab DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ============= SERVICES / DRIVERS =============== R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\system32\drivers\ppa.sys [2004-7-23 17792] R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2004-8-27 97920] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2009-9-29 13088] R2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [2009-3-16 28672] R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2010-5-14 249136] R2 WHSConnector;Windows Home Server Connector Service;c:\program files\windows home server\WHSConnector.exe [2011-1-10 376688] R3 BackupReader;BackupReader;c:\windows\system32\drivers\BackupReader.sys [2008-10-28 44776] R3 Msikbd2k;DellTouch;c:\windows\system32\drivers\Msikbd2k.sys [2009-3-16 6942] S2 portD;ABS PortIO Service;c:\windows\system32\drivers\portd2k.sys [2004-5-29 7372] S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [2009-2-5 39704] =============== Created Last 30 ================ 2011-03-06 23:16 a-dshr– C:\cmdcons 2011-03-06 23:12 256,512 a——- c:\windows\PEV.exe 2011-03-06 23:12 161,792 a——- c:\windows\SWREG.exe 2011-03-06 23:12 98,816 a——- c:\windows\sed.exe 2011-03-06 23:12 89,088 a——- c:\windows\MBR.exe 2011-03-06 22:11 –d—– c:\program files\CCleaner 2011-03-05 18:31 –d—– c:\docume~1\alluse~1\applic~1\dMbFbJn05200 2011-03-05 00:56 2 a–shrot c:\windows\winstart.bat 2011-03-05 00:56 –d—– c:\program files\UnHackMe ==================== Find3M ==================== 2011-03-07 00:08 0 a——- c:\windows\system32\drivers\lvuvc.hs 2011-03-07 00:08 0 a——- c:\windows\system32\drivers\logiflt.iad 2011-01-21 09:44 8,462,336 ——– c:\windows\system32\dllcache\shell32.dll 2011-01-21 09:44 439,296 ——– c:\windows\system32\shimgvw.dll 2011-01-21 09:44 439,296 ——– c:\windows\system32\dllcache\shimgvw.dll 2011-01-07 09:09 290,048 a——- c:\windows\system32\atmfd.dll 2011-01-07 09:09 290,048 ——– c:\windows\system32\dllcache\atmfd.dll 2011-01-02 13:01 323,584 a——- c:\windows\system32\AUDIOGENIE2.DLL 2010-12-31 08:10 1,854,976 ——– c:\windows\system32\win32k.sys 2010-12-31 08:10 1,854,976 ——– c:\windows\system32\dllcache\win32k.sys 2010-12-30 12:32 128,848 ac–h— c:\windows\system32\mlfcache.dat 2010-12-22 07:34 301,568 a——- c:\windows\system32\kerberos.dll 2010-12-22 07:34 301,568 ——– c:\windows\system32\dllcache\kerberos.dll 2010-12-21 05:29 11,080,704 ——– c:\windows\system32\dllcache\ieframe.dll 2010-12-20 12:26 730,112 ——– c:\windows\system32\lsasrv.dll 2010-12-20 12:26 730,112 ——– c:\windows\system32\dllcache\lsasrv.dll 2010-12-20 07:55 173,568 ——– c:\windows\system32\dllcache\ie4uinit.exe 2010-12-09 10:15 718,336 ——– c:\windows\system32\ntdll.dll 2010-12-09 10:15 718,336 ——– c:\windows\system32\dllcache\ntdll.dll 2010-12-09 09:30 33,280 ——– c:\windows\system32\dllcache\csrsrv.dll 2010-12-09 09:30 33,280 ——– c:\windows\system32\csrsrv.dll 2010-12-09 08:42 2,148,864 ——– c:\windows\system32\dllcache\ntkrnlmp.exe 2010-12-09 08:38 2,192,768 ——– c:\windows\system32\ntoskrnl.exe 2010-12-09 08:38 2,192,768 ——– c:\windows\system32\dllcache\ntoskrnl.exe 2010-12-09 08:07 2,027,008 ——– c:\windows\system32\dllcache\ntkrpamp.exe 2010-12-09 08:07 2,069,376 ——– c:\windows\system32\ntkrnlpa.exe 2010-12-09 08:07 2,069,376 ——– c:\windows\system32\dllcache\ntkrnlpa.exe 2007-02-26 00:27 676 a—h— c:\documents and settings\mcdonald main\hpothb07.dat 2007-02-24 13:32 164 ac–h— c:\documents and settings\all users\hpothb07.dat 2005-11-15 22:34 487,424 a——- c:\documents and settings\mcdonald main\chatlnk.exe 2004-10-01 15:00 40,960 a——- c:\program files\Uninstall_CDS.exe ============= FINISH: 19:15:45.06 ===============

Did as you instructed, combofix detected rootkit activity and then asked to reboot the machine to complete the disinfection. After reboot, dialog box informed an update for ComboFix was avail, so I said ok to download.

After update completed, combofix restarted and DOS window informed it was attempting to create a new system restore point, then it executed a full scan stages 1-50.

As ComboFix was completing and beginning to preparing the log report, several dialog boxes opened to say there was an application error and the program had to be terminated. Two dialog boxes appeared (1) AXTimer: ViewMgr.exe -Application Error and (2)tfswctrl.exe - Application Error and both read the same: "The instruction at "0x10078a90" referenced memory at "0x10078a90: The memory could not be "read". Click on OK to terminate the program".

A 3rd box appeared this time for (3) WHSTrayApp.exe - Application Error which read: "The instruction at "0x00000000" referenced memory at "0x00000000: The memory could not be "read". Click on OK to terminate the program". The I clicked "OK" for each and the boxes disappeared one by one.

Then a dialog box appeared for "NotifyAlert.exe - No debugger found" which read "Registered JIT debugger is not available. An attempt to launch a JIT debugger with the following command resulted in an error code of 0x2 (2). Please check computer settings. cordbg.exe !a 0xc84 Click on Retry to have the process wait while attaching a debugger manually. Click on Cancel to abort the JIT debu request." So I clicked Retry, but nothing appeared to happen.

Finally, only the log.txt remained open on-screen, Do you want me to sent that too? Below is the pasted ComboFix.txt log. Thanks!

ComboFix 11-03-07.02 - McDonald Main 03/07/2011 21:39:18.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1279.742 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\123.exe
Command switches used :: c:\documents and settings\McDonald Main\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\LogFiles
c:\windows\system32\LogFiles\HTTPERR\httperr1.log
.
Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((( Files Created from 2011-02-08 to 2011-03-08 )))))))))))))))))))))))))))))))
.
.
2011-03-07 03:11 . 2011-03-07 03:11 ——– d—–w- c:\program files\CCleaner
2011-03-07 01:40 . 2011-03-07 01:40 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2011-03-05 23:34 . 2001-10-04 19:13 3584 —-a-w- c:\program files\Common Files\Microsoft Shared\DAO\comcat.dll
2011-03-05 23:34 . 2001-10-04 18:16 1338880 —-a-w- c:\program files\Common Files\Microsoft Shared\DAO\shdocvw.dll
2011-03-05 23:34 . 1999-06-11 04:34 570128 —-a-w- c:\program files\Common Files\Microsoft Shared\DAO\DAO350.DLL
2011-03-05 23:31 . 2011-03-06 02:10 ——– d—–w- c:\documents and settings\All Users\Application Data\dMbFbJn05200
2011-03-05 05:56 . 2011-03-05 05:56 2 –shatr- c:\windows\winstart.bat
2011-03-05 05:56 . 2011-03-05 05:59 ——– d—–w- c:\program files\UnHackMe
2011-03-04 18:38 . 2011-03-04 18:38 ——– d—–w- c:\documents and settings\Guest\Local Settings\Application Data\Adobe
2011-03-04 18:12 . 2011-03-04 18:12 ——– d—–w- c:\documents and settings\Guest\Application Data\Windows Search
2011-03-04 02:53 . 2011-03-04 02:53 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-03-04 02:50 . 2011-03-04 02:50 ——– d—–w- c:\documents and settings\Administrator\Application Data\Windows Search
2011-03-04 02:39 . 2011-03-04 02:39 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2011-03-04 02:38 . 2011-03-04 02:38 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-03-03 05:17 . 2011-03-03 05:17 ——– d—–w- c:\documents and settings\Tyler\Application Data\Malwarebytes
2011-03-03 04:33 . 2011-03-03 04:33 ——– d—–w- c:\documents and settings\Tyler\Application Data\SUPERAntiSpyware.com
2011-03-03 04:14 . 2011-03-03 04:14 ——– d—–w- c:\documents and settings\Guest\Application Data\Malwarebytes
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2002-08-29 10:00 439296 ——w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2002-08-29 10:00 290048 —-a-w- c:\windows\system32\atmfd.dll
2011-01-02 18:01 . 2009-06-02 02:48 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2010-12-31 13:10 . 2002-08-29 10:00 1854976 ——w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2002-08-29 10:00 301568 —-a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:59 . 2004-01-21 20:16 916480 —-a-w- c:\windows\system32\wininet.dll
2010-12-20 23:59 . 2002-08-29 10:00 43520 ——w- c:\windows\system32\licmgr10.dll
2010-12-20 23:59 . 2002-08-29 10:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2010-12-20 23:09 . 2010-08-07 03:48 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 23:08 . 2010-08-07 03:48 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-12-20 17:26 . 2004-03-30 01:48 730112 ——w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-04 05:59 385024 ——w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2002-08-29 10:00 718336 ——w- c:\windows\system32\ntdll.dll
2010-12-09 14:30 . 2002-08-29 10:00 33280 ——w- c:\windows\system32\csrsrv.dll
2010-12-09 13:38 . 2002-08-29 10:00 2192768 ——w- c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07 . 2002-08-29 10:00 2069376 ——w- c:\windows\system32\ntkrnlpa.exe
2004-10-01 20:00 . 2006-08-08 04:08 40960 —-a-w- c:\program files\Uninstall_CDS.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-03-07_04.28.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-03-08 02:32 . 2011-03-08 02:32 16384 c:\windows\temp\Perflib_Perfdata_a8.dat
+ 2011-03-08 02:32 . 2011-03-08 02:32 16384 c:\windows\temp\Perflib_Perfdata_234.dat
+ 2004-04-19 20:05 . 2011-03-08 02:36 89992 c:\windows\SYSTEM32\PERFC009.DAT
- 2004-04-19 20:05 . 2011-03-07 03:14 89992 c:\windows\SYSTEM32\PERFC009.DAT
+ 2002-08-29 10:00 . 2008-04-13 18:41 52352 c:\windows\SYSTEM32\DLLCACHE\volsnap.sys
- 2011-03-03 04:17 . 2008-07-08 13:02 26488 c:\windows\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\spcustom.dll
- 2011-03-03 04:17 . 2008-07-08 13:02 17272 c:\windows\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\spmsg.dll
+ 2004-04-19 20:05 . 2011-03-08 02:36 494048 c:\windows\SYSTEM32\PERFH009.DAT
- 2004-04-19 20:05 . 2011-03-07 03:14 494048 c:\windows\SYSTEM32\PERFH009.DAT
+ 2002-09-03 18:42 . 2011-03-07 05:08 523320 c:\windows\SYSTEM32\FNTCACHE.DAT
- 2011-03-03 04:17 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\updspapi.dll
- 2011-03-03 04:17 . 2009-05-26 11:40 755576 c:\windows\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\update\update.exe
- 2011-03-03 04:17 . 2008-07-08 13:02 231288 c:\windows\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717\spuninst.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2003-08-27 204800]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2004-05-28 323584]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-22 188416]
"ViewMgr"="c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-12 106557]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"ReminderApp"="c:\program files\Nova Development\Scrapbook Factory Deluxe 4.0\ReminderApp.exe" [2007-06-08 161864]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2006-11-06 81920]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-12-20 2656528]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
.
c:\documents and settings\McDonald Main\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-3-6 66864]
Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2009-10-1 603504]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2009-10-1 603504]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\WINDOWS\\SYSTEM32\\mqsvc.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"\\\\HPSERVER\\SOFTWARE\\Tversity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\SYSTEM32\DRIVERS\ppa.sys [7/23/2004 11:44 PM 17792]
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\SYSTEM32\DRIVERS\SI3112r.sys [8/27/2004 3:18 PM 97920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]
R2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [3/16/2009 11:34 PM 28672]
R2 WHSConnector;Windows Home Server Connector Service;c:\program files\Windows Home Server\WHSConnector.exe [1/10/2011 12:28 PM 376688]
R3 BackupReader;BackupReader;c:\windows\SYSTEM32\DRIVERS\BackupReader.sys [10/28/2008 2:12 AM 44776]
R3 Msikbd2k;DellTouch;c:\windows\SYSTEM32\DRIVERS\Msikbd2k.sys [3/16/2009 11:34 PM 6942]
S2 portD;ABS PortIO Service;c:\windows\SYSTEM32\DRIVERS\portd2k.sys [5/29/2004 9:59 PM 7372]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\SYSTEM32\DRIVERS\rcblan.sys [2/5/2009 9:50 PM 39704]
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-06 c:\windows\Tasks\HP Usg Login.job
- c:\program files\hp photosmart 11\printer\Hphusg04.exe [2002-11-22 19:50]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride =
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
Trusted Zone: nexusradio.com\www
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {3C648A72-C49A-48EF-9F90-68EF13293F97} - hxxp://www.priv.njmls.xmlsweb.com/XMLSearch/XMLCache.CAB
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-07 21:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DwlClient = c:\program files\Common Files\Dell\EUSW\Support.exe?l?e?s?\?D?e?l?l?\?E?U?S?W?\?S?u?p?p?o?r?t?.?e?x?e???x???x???????????????????x???????????x???x???????????x???????????x???x???????????????????????????x??????????????w????????????j??w????x???x??????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
@DACL=(02 0000)
@="Wireless"
"ProcessGroupPolicy"="ProcessWIRELESSPolicy"
"DllName"=expand:"gptext.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
@DACL=(02 0000)
@="Folder Redirection"
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"DllName"=expand:"fdeploy.dll"
"NoMachinePolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"NoGPOListChanges"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=multi:"(Folder Redirection,Application)\00\00"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}]
@DACL=(02 0000)
"Status"=dword:00000000
"RsopStatus"=dword:00000000
"LastPolicyTime"=dword:00ef0b41
"PrevSlowLink"=dword:00000000
"PrevRsopLogging"=dword:00000001
"ForceRefreshFG"=dword:00000000
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
@DACL=(02 0000)
@="Microsoft Disk Quota"
"NoMachinePolicy"=dword:00000000
"NoUserPolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"RequiresSuccessfulRegistry"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000000
"DllName"=expand:"dskquota.dll"
"ProcessGroupPolicy"="ProcessGroupPolicy"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
@DACL=(02 0000)
@="QoS Packet Scheduler"
"ProcessGroupPolicy"="ProcessPSCHEDPolicy"
"DllName"=expand:"gptext.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
@DACL=(02 0000)
@="Scripts"
"ProcessGroupPolicy"="ProcessScriptsGroupPolicy"
"ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx"
"GenerateGroupPolicy"="GenerateScriptsGroupPolicy"
"DllName"=expand:"gptext.dll"
"NoSlowLink"=dword:00000001
"NoGPOListChanges"=dword:00000001
"NotifyLinkTransition"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
@DACL=(02 0000)
@="Internet Explorer Zonemapping"
"DllName"="c:\\windows\\system32\\iedkcs32.dll"
"ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap"
"NoGPOListChanges"=dword:00000001
"RequiresSucessfulRegistry"=dword:00000001
"DisplayName"="@c:\\windows\\system32\\iedkcs32.dll.mui,-3051"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}]
@DACL=(02 0000)
@="Windows Search Group Policy Extension"
"DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll"
"EnableAsynchronousProcessing"=dword:00000001
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000001
"NoMachinePolicy"=dword:00000000
"NoSlowLink"=dword:00000000
"NoUserPolicy"=dword:00000000
"PerUserLocalSettings"=dword:00000000
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}]
@DACL=(02 0000)
@="Internet Explorer User Accelerators"
"DisplayName"="@c:\\windows\\system32\\iedkcs32.dll.mui,-3051"
"DllName"="c:\\windows\\system32\\iedkcs32.dll"
"NoGPOListChanges"=dword:00000001
"ProcessGroupPolicy"="ProcessGroupPolicyForActivities"
"ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
@DACL=(02 0000)
"ProcessGroupPolicy"="SceProcessSecurityPolicyGPO"
"GenerateGroupPolicy"="SceGenerateGroupPolicy"
"ExtensionRsopPlanningDebugLevel"=dword:00000001
"ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx"
"ExtensionDebugLevel"=dword:00000001
"DllName"=expand:"scecli.dll"
@="Security"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000001
"MaxNoGPOListChangesInterval"=dword:000003c0
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
@DACL=(02 0000)
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"ProcessGroupPolicy"="ProcessGroupPolicy"
"DllName"="c:\\windows\\system32\\iedkcs32.dll"
@="Internet Explorer Branding"
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000001
"NoMachinePolicy"=dword:00000001
"DisplayName"="@c:\\windows\\system32\\iedkcs32.dll.mui,-3014"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
@DACL=(02 0000)
"ProcessGroupPolicy"="SceProcessEFSRecoveryGPO"
"DllName"=expand:"scecli.dll"
@="EFS recovery"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"RequiresSuccessfulRegistry"=dword:00000001
"Status"=dword:00000000
"RsopStatus"=dword:80070032
"LastPolicyTime"=dword:00ef0b41
"PrevSlowLink"=dword:00000000
"PrevRsopLogging"=dword:00000001
"ForceRefreshFG"=dword:00000000
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}]
@DACL=(02 0000)
@="802.3 Group Policy"
"DisplayName"=expand:"@dot3gpclnt.dll,-100"
"ProcessGroupPolicyEx"="ProcessLANPolicyEx"
"GenerateGroupPolicy"="GenerateLANPolicy"
"DllName"=expand:"dot3gpclnt.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
@DACL=(02 0000)
@="Microsoft Offline Files"
"DllName"=expand:"%SystemRoot%\\System32\\cscui.dll"
"EnableAsynchronousProcessing"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000000
"NoMachinePolicy"=dword:00000000
"NoSlowLink"=dword:00000000
"NoUserPolicy"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
@DACL=(02 0000)
@="Software Installation"
"DllName"=expand:"appmgmts.dll"
"ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"NoBackgroundPolicy"=dword:00000000
"RequiresSucessfulRegistry"=dword:00000000
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}]
@DACL=(02 0000)
@="Internet Explorer Machine Accelerators"
"DisplayName"="@c:\\windows\\system32\\iedkcs32.dll.mui,-3051"
"DllName"="c:\\windows\\system32\\iedkcs32.dll"
"NoGPOListChanges"=dword:00000001
"ProcessGroupPolicy"="ProcessGroupPolicyForActivities"
"ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
@DACL=(02 0000)
@="IP Security"
"ProcessGroupPolicy"="ProcessIPSECPolicy"
"DllName"=expand:"gptext.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
@DACL=(02 0000)
"DllName"="c:\\Program Files\\SUPERAntiSpyware\\SASWINLO.DLL"
"Logon"="SABWINLOLogon"
"Logoff"="SABWINLOLogoff"
"Startup"="SABWINLOStartup"
"Shutdown"="SABWINLOShutdown"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=expand:"crypt32.dll"
"Logoff"="ChainWlxLogoffEvent"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=expand:"cryptnet.dll"
"Logoff"="CryptnetWlxLogoffEvent"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
@DACL=(02 0000)
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
@DACL=(02 0000)
"Asynchronous"=dword:00000001
"DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll"
"Startup"="WlDimsStartup"
"Shutdown"="WlDimsShutdown"
"Logon"="WlDimsLogon"
"Logoff"="WlDimsLogoff"
"StartShell"="WlDimsStartShell"
"Lock"="WlDimsLock"
"Unlock"="WlDimsUnlock"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
@DACL=(02 0000)
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"DllName"=expand:"wlnotify.dll"
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
@DACL=(02 0000)
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=expand:"sclgntfy.dll"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
@DACL=(02 0000)
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"DllName"=expand:"wlnotify.dll"
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
@DACL=(02 0000)
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
@DACL=(02 0000)
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000
.
Completion time: 2011-03-07 21:53:55
ComboFix-quarantined-files.txt 2011-03-08 02:53
ComboFix2.txt 2011-03-07 04:30
.
Pre-Run: 18,239,315,968 bytes free
Post-Run: 18,221,453,312 bytes free
.
- - End Of File - - 38777E1637ACB9687F8D3D251531934D

The log you posted is fine. Let's give TDSS Killer another try now. If it won't run on it's own, then please run RKill and try again.


Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Can you please also let me know if you are still getting redirects?

Ok, TDSSKiller opened!! Yay! Scanned and 227 objects were scanned and no infections were found! …and i guess that means that no suspicious files were found either? No reboot was required. I simply clicked "Close" after running the report log, pasted here. Thanks! 2011/03/07 22:25:03.0609 3584 TDSS rootkit removing tool 2.4.20.0 Mar 2 2011 10:44:30 2011/03/07 22:25:03.0921 3584 ================================================================================ 2011/03/07 22:25:03.0921 3584 SystemInfo: 2011/03/07 22:25:03.0921 3584 2011/03/07 22:25:03.0921 3584 OS Version: 5.1.2600 ServicePack: 3.0 2011/03/07 22:25:03.0921 3584 Product type: Workstation 2011/03/07 22:25:03.0921 3584 ComputerName: OFFICEMAIN 2011/03/07 22:25:03.0937 3584 UserName: McDonald Main 2011/03/07 22:25:03.0937 3584 Windows directory: C:\windows 2011/03/07 22:25:03.0937 3584 System windows directory: C:\windows 2011/03/07 22:25:03.0937 3584 Processor architecture: Intel x86 2011/03/07 22:25:03.0937 3584 Number of processors: 1 2011/03/07 22:25:03.0937 3584 Page size: 0x1000 2011/03/07 22:25:03.0937 3584 Boot type: Normal boot 2011/03/07 22:25:03.0937 3584 ================================================================================ 2011/03/07 22:25:04.0859 3584 Initialize success 2011/03/07 22:26:42.0937 0284 ================================================================================ 2011/03/07 22:26:42.0937 0284 Scan started 2011/03/07 22:26:42.0937 0284 Mode: Manual; 2011/03/07 22:26:42.0937 0284 ================================================================================ 2011/03/07 22:26:43.0765 0284 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\windows\system32\DRIVERS\61883.sys 2011/03/07 22:26:43.0859 0284 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\windows\system32\DRIVERS\ABP480N5.SYS 2011/03/07 22:26:43.0937 0284 ACPI (8fd99680a539792a30e97944fdaecf17) C:\windows\system32\DRIVERS\ACPI.sys 2011/03/07 22:26:44.0000 0284 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\windows\system32\drivers\ACPIEC.sys 2011/03/07 22:26:44.0046 0284 adpu160m (9a11864873da202c996558b2106b0bbc) C:\windows\system32\DRIVERS\adpu160m.sys 2011/03/07 22:26:44.0078 0284 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\windows\system32\drivers\aeaudio.sys 2011/03/07 22:26:44.0156 0284 aec (8bed39e3c35d6a489438b8141717a557) C:\windows\system32\drivers\aec.sys 2011/03/07 22:26:44.0203 0284 AFD (7e775010ef291da96ad17ca4b17137d7) C:\windows\System32\drivers\afd.sys 2011/03/07 22:26:44.0265 0284 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\windows\system32\DRIVERS\agp440.sys 2011/03/07 22:26:44.0296 0284 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\windows\system32\DRIVERS\agpCPQ.sys 2011/03/07 22:26:44.0328 0284 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\windows\system32\DRIVERS\aha154x.sys 2011/03/07 22:26:44.0359 0284 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\windows\system32\DRIVERS\aic78u2.sys 2011/03/07 22:26:44.0406 0284 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\windows\system32\DRIVERS\aic78xx.sys 2011/03/07 22:26:44.0453 0284 AliIde (1140ab9938809700b46bb88e46d72a96) C:\windows\system32\DRIVERS\aliide.sys 2011/03/07 22:26:44.0484 0284 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\windows\system32\DRIVERS\alim1541.sys 2011/03/07 22:26:44.0515 0284 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\windows\system32\DRIVERS\amdagp.sys 2011/03/07 22:26:44.0546 0284 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\windows\system32\DRIVERS\amsint.sys 2011/03/07 22:26:44.0625 0284 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\windows\system32\DRIVERS\arp1394.sys 2011/03/07 22:26:44.0656 0284 asc (62d318e9a0c8fc9b780008e724283707) C:\windows\system32\DRIVERS\asc.sys 2011/03/07 22:26:44.0703 0284 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\windows\system32\DRIVERS\asc3350p.sys 2011/03/07 22:26:44.0734 0284 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\windows\system32\DRIVERS\asc3550.sys 2011/03/07 22:26:44.0812 0284 Aspi32 (5b01af89d16d562825c4db4530f20cbb) C:\windows\system32\drivers\Aspi32.sys 2011/03/07 22:26:44.0875 0284 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\windows\system32\DRIVERS\asyncmac.sys 2011/03/07 22:26:44.0921 0284 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\windows\system32\DRIVERS\atapi.sys 2011/03/07 22:26:45.0031 0284 ati2mtag (8759322ffc1a50569c1e5528ee8026b7) C:\windows\system32\DRIVERS\ati2mtag.sys 2011/03/07 22:26:45.0078 0284 Atmarpc (9916c1225104ba14794209cfa8012159) C:\windows\system32\DRIVERS\atmarpc.sys 2011/03/07 22:26:45.0171 0284 audstub (d9f724aa26c010a217c97606b160ed68) C:\windows\system32\DRIVERS\audstub.sys 2011/03/07 22:26:45.0234 0284 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\windows\system32\DRIVERS\avc.sys 2011/03/07 22:26:45.0281 0284 BackupReader (22f769c67cb88ef32a985132041a6169) C:\windows\system32\DRIVERS\BackupReader.sys 2011/03/07 22:26:45.0359 0284 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\windows\system32\drivers\Beep.sys 2011/03/07 22:26:45.0437 0284 BrPar (2fe6d5be0629f706197b30c0aa05de30) C:\windows\System32\drivers\BrPar.sys 2011/03/07 22:26:45.0703 0284 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\windows\system32\DRIVERS\cbidf2k.sys 2011/03/07 22:26:45.0734 0284 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\windows\system32\drivers\cbidf2k.sys 2011/03/07 22:26:45.0781 0284 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\windows\system32\DRIVERS\CCDECODE.sys 2011/03/07 22:26:45.0812 0284 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\windows\system32\DRIVERS\cd20xrnt.sys 2011/03/07 22:26:45.0843 0284 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\windows\system32\drivers\Cdaudio.sys 2011/03/07 22:26:45.0890 0284 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\windows\system32\drivers\Cdfs.sys 2011/03/07 22:26:45.0921 0284 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\windows\system32\DRIVERS\cdrom.sys 2011/03/07 22:26:46.0015 0284 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\windows\system32\DRIVERS\cmdide.sys 2011/03/07 22:26:46.0078 0284 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\windows\system32\DRIVERS\cpqarray.sys 2011/03/07 22:26:46.0140 0284 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\windows\system32\DRIVERS\dac2w2k.sys 2011/03/07 22:26:46.0171 0284 dac960nt (683789caa3864eb46125ae86ff677d34) C:\windows\system32\DRIVERS\dac960nt.sys 2011/03/07 22:26:46.0234 0284 DCamUSBEMPIA (5118ea8a2f55fa4d4295516500b78229) C:\windows\system32\DRIVERS\emDevice.sys 2011/03/07 22:26:46.0281 0284 Disk (044452051f3e02e7963599fc8f4f3e25) C:\windows\system32\DRIVERS\disk.sys 2011/03/07 22:26:46.0343 0284 dmboot (d992fe1274bde0f84ad826acae022a41) C:\windows\system32\drivers\dmboot.sys 2011/03/07 22:26:46.0437 0284 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\windows\system32\drivers\dmio.sys 2011/03/07 22:26:46.0468 0284 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\windows\system32\drivers\dmload.sys 2011/03/07 22:26:46.0515 0284 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\windows\system32\drivers\DMusic.sys 2011/03/07 22:26:46.0593 0284 Dot4 HPH11 (a93ae4414505a8095ec4820c4312b5df) C:\windows\system32\DRIVERS\hphid411.sys 2011/03/07 22:26:46.0640 0284 Dot4Print HPH11 (4f8681519ea48757148895811f2aa051) C:\windows\system32\DRIVERS\hphipr11.sys 2011/03/07 22:26:46.0687 0284 Dot4Storage HPH11 (df0a7516e9f803c1c64796b81605495c) C:\windows\system32\Drivers\hphs2k11.sys 2011/03/07 22:26:46.0718 0284 Dot4Usb HPH11 (c6608b2afb2567f0fa6b4bd8837f1660) C:\windows\system32\drivers\hphius11.sys 2011/03/07 22:26:46.0750 0284 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\windows\system32\DRIVERS\dpti2o.sys 2011/03/07 22:26:46.0812 0284 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\windows\system32\drivers\drmkaud.sys 2011/03/07 22:26:46.0828 0284 drvmcdb (7f056a52bcba3102d2d37a4a2646c807) C:\windows\system32\drivers\drvmcdb.sys 2011/03/07 22:26:46.0859 0284 drvnddm (d3c1e501ed42e77574b3095309dd4075) C:\windows\system32\drivers\drvnddm.sys 2011/03/07 22:26:46.0906 0284 E100B (98b46b331404a951cabad8b4877e1276) C:\windows\system32\DRIVERS\e100b325.sys 2011/03/07 22:26:46.0968 0284 EL90X (653394706ff5634f4b5180b8294badb1) C:\windows\system32\DRIVERS\el90xnd5.sys 2011/03/07 22:26:47.0015 0284 EL90XBC (6e883bf518296a40959131c2304af714) C:\windows\system32\DRIVERS\el90xbc5.sys 2011/03/07 22:26:47.0062 0284 emAudio (200da4f1964c11b3c19a07f937394624) C:\windows\system32\drivers\emAudio.sys 2011/03/07 22:26:47.0140 0284 Fastfat (38d332a6d56af32635675f132548343e) C:\windows\system32\drivers\Fastfat.sys 2011/03/07 22:26:47.0187 0284 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\windows\system32\DRIVERS\fdc.sys 2011/03/07 22:26:47.0265 0284 FilterService (1edc0df2da14e04504dd3bac21aa32cd) C:\windows\system32\DRIVERS\lvuvcflt.sys 2011/03/07 22:26:47.0312 0284 FiltUSBEMPIA (6f87e4706f59463b74bc4fad0f67338f) C:\windows\system32\DRIVERS\emFilter.sys 2011/03/07 22:26:47.0375 0284 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\windows\system32\drivers\Fips.sys 2011/03/07 22:26:47.0453 0284 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\windows\system32\DRIVERS\flpydisk.sys 2011/03/07 22:26:47.0515 0284 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\windows\system32\drivers\fltmgr.sys 2011/03/07 22:26:47.0562 0284 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\windows\system32\drivers\Fs_Rec.sys 2011/03/07 22:26:47.0593 0284 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\windows\system32\DRIVERS\ftdisk.sys 2011/03/07 22:26:47.0640 0284 gameenum (065639773d8b03f33577f6cdaea21063) C:\windows\system32\DRIVERS\gameenum.sys 2011/03/07 22:26:47.0671 0284 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\windows\system32\Drivers\GEARAspiWDM.sys 2011/03/07 22:26:47.0750 0284 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\windows\system32\DRIVERS\msgpc.sys 2011/03/07 22:26:47.0828 0284 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\windows\system32\DRIVERS\hidusb.sys 2011/03/07 22:26:47.0859 0284 hpn (b028377dea0546a5fcfba928a8aefae0) C:\windows\system32\DRIVERS\hpn.sys 2011/03/07 22:26:47.0921 0284 HSFHWBS2 (5380253d2751f2b5d95941c09e7e42ac) C:\windows\system32\DRIVERS\HSFHWBS2.sys 2011/03/07 22:26:48.0015 0284 HSF_DP (e9a4c20ab168be8bd78486afebba5836) C:\windows\system32\DRIVERS\HSF_DP.sys 2011/03/07 22:26:48.0078 0284 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\windows\system32\Drivers\HTTP.sys 2011/03/07 22:26:48.0156 0284 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\windows\system32\drivers\i2omgmt.sys 2011/03/07 22:26:48.0218 0284 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\windows\system32\DRIVERS\i2omp.sys 2011/03/07 22:26:48.0265 0284 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\windows\system32\DRIVERS\i8042prt.sys 2011/03/07 22:26:48.0328 0284 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\windows\system32\DRIVERS\i81xnt5.sys 2011/03/07 22:26:48.0375 0284 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\windows\system32\DRIVERS\wADV01nt.sys 2011/03/07 22:26:48.0406 0284 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\windows\system32\DRIVERS\wADV02NT.sys 2011/03/07 22:26:48.0437 0284 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\windows\system32\DRIVERS\wADV05NT.sys 2011/03/07 22:26:48.0500 0284 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\windows\system32\DRIVERS\wSiINTxx.sys 2011/03/07 22:26:48.0546 0284 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\windows\system32\DRIVERS\wVchNTxx.sys 2011/03/07 22:26:48.0593 0284 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\windows\system32\DRIVERS\wATV01nt.sys 2011/03/07 22:26:48.0625 0284 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\windows\system32\DRIVERS\wATV02NT.sys 2011/03/07 22:26:48.0703 0284 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\windows\system32\DRIVERS\wATV04nt.sys 2011/03/07 22:26:48.0750 0284 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\windows\system32\DRIVERS\wCh7xxNT.sys 2011/03/07 22:26:48.0812 0284 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\windows\system32\DRIVERS\imapi.sys 2011/03/07 22:26:48.0859 0284 ini910u (4a40e045faee58631fd8d91afc620719) C:\windows\system32\DRIVERS\ini910u.sys 2011/03/07 22:26:48.0906 0284 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\windows\system32\DRIVERS\intelide.sys 2011/03/07 22:26:48.0968 0284 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\windows\system32\DRIVERS\intelppm.sys 2011/03/07 22:26:49.0046 0284 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\windows\system32\drivers\ip6fw.sys 2011/03/07 22:26:49.0109 0284 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\windows\system32\DRIVERS\ipfltdrv.sys 2011/03/07 22:26:49.0140 0284 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\windows\system32\DRIVERS\ipinip.sys 2011/03/07 22:26:49.0203 0284 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\windows\system32\DRIVERS\ipnat.sys 2011/03/07 22:26:49.0281 0284 IPSec (23c74d75e36e7158768dd63d92789a91) C:\windows\system32\DRIVERS\ipsec.sys 2011/03/07 22:26:49.0328 0284 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\windows\system32\DRIVERS\irenum.sys 2011/03/07 22:26:49.0390 0284 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\windows\system32\DRIVERS\isapnp.sys 2011/03/07 22:26:49.0453 0284 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\windows\system32\DRIVERS\kbdclass.sys 2011/03/07 22:26:49.0515 0284 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\windows\system32\DRIVERS\kbdhid.sys 2011/03/07 22:26:49.0593 0284 kmixer (692bcf44383d056aed41b045a323d378) C:\windows\system32\drivers\kmixer.sys 2011/03/07 22:26:49.0656 0284 KSecDD (b467646c54cc746128904e1654c750c1) C:\windows\system32\drivers\KSecDD.sys 2011/03/07 22:26:49.0875 0284 lvpopflt (e1158b0cb852db0573922c92e6e564de) C:\windows\system32\DRIVERS\lvpopflt.sys 2011/03/07 22:26:49.0953 0284 LVPr2Mon (f96cfb47903854f228baaf3e2d41a0a3) C:\windows\system32\DRIVERS\LVPr2Mon.sys 2011/03/07 22:26:50.0031 0284 LVRS (e22fd7852e74f04cceb6b8a684a51f3e) C:\windows\system32\DRIVERS\lvrs.sys 2011/03/07 22:26:50.0109 0284 LVUSBSta (5f987fc1aad215ec2c60cf07719b1cce) C:\windows\system32\drivers\LVUSBSta.sys 2011/03/07 22:26:50.0406 0284 LVUVC (e89df2b88ee659954de79827ddf46dc9) C:\windows\system32\DRIVERS\lvuvc.sys 2011/03/07 22:26:50.0484 0284 MarvinBus (a3e700d78eec390f1208098cdca5c6b6) C:\windows\system32\DRIVERS\MarvinBus.sys 2011/03/07 22:26:50.0531 0284 mdmxsdk (eeaea6514ba7c9d273b5e87c4e1aab30) C:\windows\system32\DRIVERS\mdmxsdk.sys 2011/03/07 22:26:50.0578 0284 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\windows\system32\drivers\mnmdd.sys 2011/03/07 22:26:50.0640 0284 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\windows\system32\drivers\Modem.sys 2011/03/07 22:26:50.0687 0284 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\windows\system32\DRIVERS\mouclass.sys 2011/03/07 22:26:50.0750 0284 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\windows\system32\DRIVERS\mouhid.sys 2011/03/07 22:26:50.0828 0284 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\windows\system32\drivers\MountMgr.sys 2011/03/07 22:26:50.0875 0284 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\windows\system32\DRIVERS\MPE.sys 2011/03/07 22:26:50.0937 0284 MQAC (eee50bf24caeedb515a8f3b22756d3bb) C:\windows\system32\drivers\mqac.sys 2011/03/07 22:26:51.0015 0284 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\windows\system32\DRIVERS\mraid35x.sys 2011/03/07 22:26:51.0093 0284 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\windows\system32\DRIVERS\mrxdav.sys 2011/03/07 22:26:51.0156 0284 MRxSmb (f3aefb11abc521122b67095044169e98) C:\windows\system32\DRIVERS\mrxsmb.sys 2011/03/07 22:26:51.0265 0284 MSDV (1477849772712bac69c144dcf2c9ce81) C:\windows\system32\DRIVERS\msdv.sys 2011/03/07 22:26:51.0343 0284 Msfs (c941ea2454ba8350021d774daf0f1027) C:\windows\system32\drivers\Msfs.sys 2011/03/07 22:26:51.0390 0284 Msikbd2k (877ffd0fb093b80f5ed6ba64d7921881) C:\windows\system32\DRIVERS\msikbd2k.sys 2011/03/07 22:26:51.0453 0284 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\windows\system32\drivers\MSKSSRV.sys 2011/03/07 22:26:51.0500 0284 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\windows\system32\drivers\MSPCLOCK.sys 2011/03/07 22:26:51.0531 0284 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\windows\system32\drivers\MSPQM.sys 2011/03/07 22:26:51.0578 0284 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\windows\system32\DRIVERS\mssmbios.sys 2011/03/07 22:26:51.0625 0284 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\windows\system32\drivers\MSTEE.sys 2011/03/07 22:26:51.0687 0284 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\windows\system32\drivers\Mup.sys 2011/03/07 22:26:51.0750 0284 MxlW2k (e91fc8b52d21e38317dc61a3c7ccfa4b) C:\windows\system32\drivers\MxlW2k.sys 2011/03/07 22:26:51.0812 0284 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\windows\system32\DRIVERS\NABTSFEC.sys 2011/03/07 22:26:51.0859 0284 NDIS (1df7f42665c94b825322fae71721130d) C:\windows\system32\drivers\NDIS.sys 2011/03/07 22:26:51.0906 0284 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\windows\system32\DRIVERS\NdisIP.sys 2011/03/07 22:26:51.0953 0284 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\windows\system32\DRIVERS\ndistapi.sys 2011/03/07 22:26:52.0015 0284 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\windows\system32\DRIVERS\ndisuio.sys 2011/03/07 22:26:52.0093 0284 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\windows\system32\DRIVERS\ndiswan.sys 2011/03/07 22:26:52.0140 0284 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\windows\system32\drivers\NDProxy.sys 2011/03/07 22:26:52.0171 0284 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\windows\system32\DRIVERS\netbios.sys 2011/03/07 22:26:52.0203 0284 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\windows\system32\DRIVERS\netbt.sys 2011/03/07 22:26:52.0281 0284 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\windows\system32\DRIVERS\nic1394.sys 2011/03/07 22:26:52.0328 0284 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\windows\system32\drivers\Npfs.sys 2011/03/07 22:26:52.0390 0284 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\windows\system32\drivers\Ntfs.sys 2011/03/07 22:26:52.0468 0284 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\windows\system32\drivers\Null.sys 2011/03/07 22:26:52.0734 0284 nv (9f4384aa43548ddd438f7b7825d11699) C:\windows\system32\DRIVERS\nv4_mini.sys 2011/03/07 22:26:52.0968 0284 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\windows\system32\DRIVERS\nwlnkflt.sys 2011/03/07 22:26:53.0000 0284 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\windows\system32\DRIVERS\nwlnkfwd.sys 2011/03/07 22:26:53.0078 0284 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\windows\system32\DRIVERS\ohci1394.sys 2011/03/07 22:26:53.0109 0284 omci (53d5f1278d9edb21689bbbcecc09108d) C:\windows\system32\DRIVERS\omci.sys 2011/03/07 22:26:53.0187 0284 P16X (13026e137486d916a0677d276144ea7f) C:\windows\system32\drivers\P16X.sys 2011/03/07 22:26:53.0234 0284 P3 (c90018bafdc7098619a4a95b046b30f3) C:\windows\system32\DRIVERS\p3.sys 2011/03/07 22:26:53.0328 0284 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\windows\system32\DRIVERS\parport.sys 2011/03/07 22:26:53.0375 0284 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\windows\system32\drivers\PartMgr.sys 2011/03/07 22:26:53.0421 0284 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\windows\system32\drivers\ParVdm.sys 2011/03/07 22:26:53.0453 0284 PCI (a219903ccf74233761d92bef471a07b1) C:\windows\system32\DRIVERS\pci.sys 2011/03/07 22:26:53.0531 0284 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\windows\system32\DRIVERS\pciide.sys 2011/03/07 22:26:53.0578 0284 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\windows\system32\drivers\Pcmcia.sys 2011/03/07 22:26:53.0750 0284 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\windows\system32\DRIVERS\perc2.sys 2011/03/07 22:26:53.0781 0284 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\windows\system32\DRIVERS\perc2hib.sys 2011/03/07 22:26:53.0875 0284 pfc (957b82ec80ad7ead64e5e47df6b0dc40) C:\windows\system32\drivers\pfc.sys 2011/03/07 22:26:53.0937 0284 PfModNT (2f5532f9b0f903b26847da674b4f55b2) C:\WINDOWS\System32\PfModNT.sys 2011/03/07 22:26:54.0000 0284 portD (7b87e62bf60b51a2119faca7bd6310c3) C:\windows\system32\DRIVERS\portd2k.sys 2011/03/07 22:26:54.0078 0284 ppa (411923a60e1fc2b136c77e6d50fc69bd) C:\windows\system32\DRIVERS\ppa.sys 2011/03/07 22:26:54.0140 0284 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\windows\system32\DRIVERS\raspptp.sys 2011/03/07 22:26:54.0187 0284 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\windows\system32\DRIVERS\processr.sys 2011/03/07 22:26:54.0250 0284 PSched (09298ec810b07e5d582cb3a3f9255424) C:\windows\system32\DRIVERS\psched.sys 2011/03/07 22:26:54.0296 0284 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\windows\system32\DRIVERS\ptilink.sys 2011/03/07 22:26:54.0359 0284 PxHelp20 (7e1eacdecba39e0b2a35306426f0decc) C:\windows\system32\DRIVERS\PxHelp20.sys 2011/03/07 22:26:54.0421 0284 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\windows\system32\DRIVERS\ql1080.sys 2011/03/07 22:26:54.0484 0284 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\windows\system32\DRIVERS\ql10wnt.sys 2011/03/07 22:26:54.0531 0284 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\windows\system32\DRIVERS\ql12160.sys 2011/03/07 22:26:54.0593 0284 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\windows\system32\DRIVERS\ql1240.sys 2011/03/07 22:26:54.0656 0284 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\windows\system32\DRIVERS\ql1280.sys 2011/03/07 22:26:54.0703 0284 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\windows\system32\DRIVERS\rasacd.sys 2011/03/07 22:26:54.0796 0284 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\windows\system32\DRIVERS\rasl2tp.sys 2011/03/07 22:26:54.0859 0284 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\windows\system32\DRIVERS\raspppoe.sys 2011/03/07 22:26:54.0890 0284 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\windows\system32\DRIVERS\raspti.sys 2011/03/07 22:26:54.0953 0284 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\windows\system32\DRIVERS\rdbss.sys 2011/03/07 22:26:55.0000 0284 RDPCDD (4912d5b403614ce99c28420f75353332) C:\windows\system32\DRIVERS\RDPCDD.sys 2011/03/07 22:26:55.0093 0284 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\windows\system32\DRIVERS\rdpdr.sys 2011/03/07 22:26:55.0156 0284 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\windows\system32\drivers\RDPWD.sys 2011/03/07 22:26:55.0234 0284 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\windows\system32\DRIVERS\redbook.sys 2011/03/07 22:26:55.0296 0284 RemoteControl-USBLAN (7553d60b85ac53bd4486c418a0fbfcdf) C:\windows\system32\DRIVERS\rcblan.sys 2011/03/07 22:26:55.0359 0284 RMCAST (96f7a9a7bf0c9c0440a967440065d33c) C:\windows\system32\drivers\RMCast.sys 2011/03/07 22:26:55.0500 0284 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 2011/03/07 22:26:55.0531 0284 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 2011/03/07 22:26:55.0687 0284 SbcpHid (30d94039a729571146eb9d736ec1aadd) C:\windows\system32\Drivers\SbcpHid.sys 2011/03/07 22:26:55.0734 0284 ScanUSBEMPIA (f5a633609777c212ec5ff19927fc5955) C:\windows\system32\DRIVERS\emScan.sys 2011/03/07 22:26:55.0781 0284 ScFBPNT2 (50b724c9d03111245df270bc3f49f04d) C:\windows\system32\drivers\ScFBPNT2.SYS 2011/03/07 22:26:55.0859 0284 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\DRIVERS\secdrv.sys 2011/03/07 22:26:55.0937 0284 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\windows\system32\DRIVERS\serenum.sys 2011/03/07 22:26:56.0000 0284 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\windows\system32\DRIVERS\serial.sys 2011/03/07 22:26:56.0093 0284 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\windows\system32\DRIVERS\sfloppy.sys 2011/03/07 22:26:56.0156 0284 SI3112r (0917eb303a2bc3e122f2777daef1a63c) C:\windows\system32\DRIVERS\SI3112r.sys 2011/03/07 22:26:56.0203 0284 SiFilter (78b1a1523265e5dbcced0c814ac719de) C:\windows\system32\DRIVERS\SiWinAcc.sys 2011/03/07 22:26:56.0296 0284 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\windows\system32\DRIVERS\sisagp.sys 2011/03/07 22:26:56.0359 0284 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\windows\system32\DRIVERS\SLIP.sys 2011/03/07 22:26:56.0437 0284 smwdm (5018a9db5eb62e3edb3110f82f556285) C:\windows\system32\drivers\smwdm.sys 2011/03/07 22:26:56.0484 0284 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\windows\system32\DRIVERS\sparrow.sys 2011/03/07 22:26:56.0546 0284 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\windows\system32\drivers\splitter.sys 2011/03/07 22:26:56.0625 0284 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\windows\system32\DRIVERS\sr.sys 2011/03/07 22:26:56.0703 0284 Srv (0f6aefad3641a657e18081f52d0c15af) C:\windows\system32\DRIVERS\srv.sys 2011/03/07 22:26:56.0765 0284 sscdbhk5 (328e8bb94ec58480f60458fb4b8437a7) C:\windows\system32\drivers\sscdbhk5.sys 2011/03/07 22:26:56.0812 0284 ssrtln (7ec8b427cee5c0cdac066320b93f1355) C:\windows\system32\drivers\ssrtln.sys 2011/03/07 22:26:56.0875 0284 streamip (77813007ba6265c4b6098187e6ed79d2) C:\windows\system32\DRIVERS\StreamIP.sys 2011/03/07 22:26:56.0921 0284 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\windows\system32\DRIVERS\swenum.sys 2011/03/07 22:26:56.0984 0284 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\windows\system32\drivers\swmidi.sys 2011/03/07 22:26:57.0062 0284 symc810 (1ff3217614018630d0a6758630fc698c) C:\windows\system32\DRIVERS\symc810.sys 2011/03/07 22:26:57.0125 0284 symc8xx (070e001d95cf725186ef8b20335f933c) C:\windows\system32\DRIVERS\symc8xx.sys 2011/03/07 22:26:57.0156 0284 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\windows\system32\DRIVERS\sym_hi.sys 2011/03/07 22:26:57.0203 0284 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\windows\system32\DRIVERS\sym_u3.sys 2011/03/07 22:26:57.0265 0284 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\windows\system32\drivers\sysaudio.sys 2011/03/07 22:26:57.0359 0284 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\windows\system32\DRIVERS\tcpip.sys 2011/03/07 22:26:57.0406 0284 Tcpip6 (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\windows\system32\DRIVERS\tcpip6.sys 2011/03/07 22:26:57.0437 0284 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\windows\system32\drivers\TDPIPE.sys 2011/03/07 22:26:57.0468 0284 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\windows\system32\drivers\TDTCP.sys 2011/03/07 22:26:57.0531 0284 TermDD (88155247177638048422893737429d9e) C:\windows\system32\DRIVERS\termdd.sys 2011/03/07 22:26:57.0625 0284 tfsnboio (c229bf90443be8d3bd2b65d7f3ac0f35) C:\windows\system32\dla\tfsnboio.sys 2011/03/07 22:26:57.0656 0284 tfsncofs (79ee9fcd7728e54ab8fbc30962f0416f) C:\windows\system32\dla\tfsncofs.sys 2011/03/07 22:26:57.0687 0284 tfsndrct (9efb37e7de17d783a059b653f7e8afad) C:\windows\system32\dla\tfsndrct.sys 2011/03/07 22:26:57.0718 0284 tfsndres (130254995ebedcb34d62e8d78ec9dbd0) C:\windows\system32\dla\tfsndres.sys 2011/03/07 22:26:57.0765 0284 tfsnifs (9b40e1e4aeed849812a2e43a388a7e77) C:\windows\system32\dla\tfsnifs.sys 2011/03/07 22:26:57.0796 0284 tfsnopio (818047ad850b312705aa17ca96b9427d) C:\windows\system32\dla\tfsnopio.sys 2011/03/07 22:26:57.0828 0284 tfsnpool (4603e813bcc6dd465cd8d2afd37fa90d) C:\windows\system32\dla\tfsnpool.sys 2011/03/07 22:26:57.0875 0284 tfsnudf (6fc2cd904a9a55acfdfc780a611a75ed) C:\windows\system32\dla\tfsnudf.sys 2011/03/07 22:26:57.0906 0284 tfsnudfa (d4afa4d00f8db3fd1c15b3fe49c3a96c) C:\windows\system32\dla\tfsnudfa.sys 2011/03/07 22:26:58.0015 0284 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\windows\system32\DRIVERS\toside.sys 2011/03/07 22:26:58.0093 0284 tunmp (8f861eda21c05857eb8197300a92501c) C:\windows\system32\DRIVERS\tunmp.sys 2011/03/07 22:26:58.0171 0284 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\windows\system32\drivers\Udfs.sys 2011/03/07 22:26:58.0218 0284 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\windows\system32\DRIVERS\ultra.sys 2011/03/07 22:26:58.0296 0284 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\windows\system32\DRIVERS\update.sys 2011/03/07 22:26:58.0375 0284 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\windows\system32\Drivers\usbaapl.sys 2011/03/07 22:26:58.0437 0284 usbaudio (e919708db44ed8543a7c017953148330) C:\windows\system32\drivers\usbaudio.sys 2011/03/07 22:26:58.0484 0284 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\windows\system32\DRIVERS\usbccgp.sys 2011/03/07 22:26:58.0546 0284 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\windows\system32\DRIVERS\usbehci.sys 2011/03/07 22:26:58.0609 0284 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\windows\system32\DRIVERS\usbhub.sys 2011/03/07 22:26:58.0687 0284 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\windows\system32\DRIVERS\usbscan.sys 2011/03/07 22:26:58.0734 0284 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\windows\system32\DRIVERS\usbser.sys 2011/03/07 22:26:58.0781 0284 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\windows\system32\DRIVERS\USBSTOR.SYS 2011/03/07 22:26:58.0843 0284 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\windows\system32\DRIVERS\usbuhci.sys 2011/03/07 22:26:58.0906 0284 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\windows\system32\Drivers\usbvideo.sys 2011/03/07 22:26:58.0968 0284 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\windows\System32\drivers\vga.sys 2011/03/07 22:26:59.0046 0284 viaagp (754292ce5848b3738281b4f3607eaef4) C:\windows\system32\DRIVERS\viaagp.sys 2011/03/07 22:26:59.0109 0284 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\windows\system32\DRIVERS\viaide.sys 2011/03/07 22:26:59.0187 0284 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\windows\system32\drivers\VolSnap.sys 2011/03/07 22:26:59.0250 0284 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\windows\system32\DRIVERS\wanarp.sys 2011/03/07 22:26:59.0359 0284 wdmaud (6768acf64b18196494413695f0c3a00f) C:\windows\system32\drivers\wdmaud.sys 2011/03/07 22:26:59.0468 0284 winachsf (2e5bc3ddf1c44c84c3093e1148a0354e) C:\windows\system32\DRIVERS\HSF_CNXT.sys 2011/03/07 22:26:59.0578 0284 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\windows\System32\drivers\ws2ifsl.sys 2011/03/07 22:26:59.0656 0284 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\windows\system32\DRIVERS\WSTCODEC.SYS 2011/03/07 22:26:59.0718 0284 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\windows\system32\DRIVERS\WudfPf.sys 2011/03/07 22:26:59.0765 0284 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\windows\system32\DRIVERS\wudfrd.sys 2011/03/07 22:27:00.0593 0284 ================================================================================ 2011/03/07 22:27:00.0593 0284 Scan finished 2011/03/07 22:27:00.0593 0284 ================================================================================