Rootkit errors diagnosis

Hey TomK No reason really, I just was running some Antivirus/Spyware checks and thought I would run a Rootkit scanner. Here are the logs as requested. Thanks Free . DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26 Run by [removed] at 16:00:25 on 2011-07-12 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.224.27 [GMT 10:00] . AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com.au/ uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm mURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: {0E91EFA2-AF48-4333-9965-5DD29DE31B56} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [MSC] c:\program files\microsoft security client\msseces.exe -hide -runkey mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1248238891750 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{EF4F9F77-2B63-4233-BB35-4DF722598121} : DhcpNameServer = 10.0.0.138 TCP: Interfaces\{F9B233E3-376B-4061-991D-839BE5962B34} : DhcpNameServer = [removed] [removed] [removed] SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Notification Packages = . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\hills\application data\mozilla\firefox\profiles\7ostmh8m.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo-FileServe FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/ FF - prefs.js: keyword.URL - hxxp://www.google.com.au/ FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll . —- FIREFOX POLICIES —- FF - user.js: keyword.URL - hxxp://www.google.com.au/ FF - user.js: keyword.enabled - 1 . ============= SERVICES / DRIVERS =============== . R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2011-7-8 28552] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264] R1 MpKsl502dc5e2;MpKsl502dc5e2;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f309dda4-4ed0-4a7e-8fe9-562e24e11f56}\MpKsl502dc5e2.sys [2011-7-12 28752] R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-4-11 22504] R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [2009-7-21 177280] S0 ncnvyc;ncnvyc;c:\windows\system32\drivers\pqnersy.sys –> c:\windows\system32\drivers\pqnersy.sys [?] S1 MpKsl0fb37875;MpKsl0fb37875;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb8ed481-7edf-406b-9f35-59ce2ba53447}\mpksl0fb37875.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb8ed481-7edf-406b-9f35-59ce2ba53447}\MpKsl0fb37875.sys [?] S1 MpKsl1d181bf8;MpKsl1d181bf8;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b2ed5ff7-d054-4783-a86d-760b190f89e4}\mpksl1d181bf8.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b2ed5ff7-d054-4783-a86d-760b190f89e4}\MpKsl1d181bf8.sys [?] S1 MpKsl21812df6;MpKsl21812df6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b2615e64-93d4-40d5-b8bc-c090a313dee2}\mpksl21812df6.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b2615e64-93d4-40d5-b8bc-c090a313dee2}\MpKsl21812df6.sys [?] S1 MpKsl25caf545;MpKsl25caf545;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{32bb4219-4d88-48e2-a5e5-936bde97230f}\mpksl25caf545.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{32bb4219-4d88-48e2-a5e5-936bde97230f}\MpKsl25caf545.sys [?] S1 MpKsl33b3a1ac;MpKsl33b3a1ac;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5bc72cd4-71eb-4ac8-8ff3-4d88eb0db0a4}\mpksl33b3a1ac.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5bc72cd4-71eb-4ac8-8ff3-4d88eb0db0a4}\MpKsl33b3a1ac.sys [?] S1 MpKsl4053706f;MpKsl4053706f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{7248df8a-4f44-464f-ba4b-5f98ec90a592}\mpksl4053706f.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{7248df8a-4f44-464f-ba4b-5f98ec90a592}\MpKsl4053706f.sys [?] S1 MpKsl4083cabc;MpKsl4083cabc;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c32b66c4-be68-4e67-8d4a-ce7af8eacc18}\mpksl4083cabc.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c32b66c4-be68-4e67-8d4a-ce7af8eacc18}\MpKsl4083cabc.sys [?] S1 MpKsl46e9b91d;MpKsl46e9b91d;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f0ddaae1-6c69-4b3e-bb6c-e424fdd4720a}\mpksl46e9b91d.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f0ddaae1-6c69-4b3e-bb6c-e424fdd4720a}\MpKsl46e9b91d.sys [?] S1 MpKsl493a3a28;MpKsl493a3a28;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f55d21bc-324a-41de-b81f-0a7eb91827fe}\mpksl493a3a28.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f55d21bc-324a-41de-b81f-0a7eb91827fe}\MpKsl493a3a28.sys [?] S1 MpKsl4ce43e45;MpKsl4ce43e45;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ea57b3d9-0282-4b83-8faa-f25fcaedf375}\mpksl4ce43e45.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ea57b3d9-0282-4b83-8faa-f25fcaedf375}\MpKsl4ce43e45.sys [?] S1 MpKsl512dd4b4;MpKsl512dd4b4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{fb0c375a-7721-4759-8e3f-59539922c84a}\mpksl512dd4b4.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{fb0c375a-7721-4759-8e3f-59539922c84a}\MpKsl512dd4b4.sys [?] S1 MpKsl53b0c832;MpKsl53b0c832;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{213f7a1d-e50d-4d06-a227-c59f23a15cf5}\mpksl53b0c832.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{213f7a1d-e50d-4d06-a227-c59f23a15cf5}\MpKsl53b0c832.sys [?] S1 MpKsl54faf401;MpKsl54faf401;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95ee9adc-abb9-4b41-a22a-00eee94b4dff}\mpksl54faf401.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95ee9adc-abb9-4b41-a22a-00eee94b4dff}\MpKsl54faf401.sys [?] S1 MpKsl559256ec;MpKsl559256ec;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{46afe2d0-a218-4dec-94de-0a0a103f6c19}\mpksl559256ec.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{46afe2d0-a218-4dec-94de-0a0a103f6c19}\MpKsl559256ec.sys [?] S1 MpKsl6476238b;MpKsl6476238b;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2af13516-a17c-4702-bc7c-6fcf83949039}\mpksl6476238b.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2af13516-a17c-4702-bc7c-6fcf83949039}\MpKsl6476238b.sys [?] S1 MpKsl6a3759a4;MpKsl6a3759a4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53e26349-05fb-44fe-8d8b-195c14019141}\mpksl6a3759a4.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53e26349-05fb-44fe-8d8b-195c14019141}\MpKsl6a3759a4.sys [?] S1 MpKsl6b90c65f;MpKsl6b90c65f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5dbbd9b5-af9b-4330-9643-342fe97ec9dc}\mpksl6b90c65f.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5dbbd9b5-af9b-4330-9643-342fe97ec9dc}\MpKsl6b90c65f.sys [?] S1 MpKsl6d015d6d;MpKsl6d015d6d;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5ffeb89f-3873-4d73-ae03-e16c9b999aa0}\mpksl6d015d6d.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5ffeb89f-3873-4d73-ae03-e16c9b999aa0}\MpKsl6d015d6d.sys [?] S1 MpKsl71926a0c;MpKsl71926a0c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb119949-977e-4161-ac27-28214fed85fe}\mpksl71926a0c.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bb119949-977e-4161-ac27-28214fed85fe}\MpKsl71926a0c.sys [?] S1 MpKsl7eef24e0;MpKsl7eef24e0;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6397dd5e-b2f2-4e75-802f-dc089bbfcb6f}\mpksl7eef24e0.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6397dd5e-b2f2-4e75-802f-dc089bbfcb6f}\MpKsl7eef24e0.sys [?] S1 MpKsl8a57a207;MpKsl8a57a207;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d21dae6c-d3f4-4d5e-b082-5658742802f5}\mpksl8a57a207.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d21dae6c-d3f4-4d5e-b082-5658742802f5}\MpKsl8a57a207.sys [?] S1 MpKsl93571654;MpKsl93571654;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f94dc3ce-fa93-4e3e-a3c0-dd4333470f1a}\mpksl93571654.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f94dc3ce-fa93-4e3e-a3c0-dd4333470f1a}\MpKsl93571654.sys [?] S1 MpKsl96adc073;MpKsl96adc073;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{213f7a1d-e50d-4d06-a227-c59f23a15cf5}\mpksl96adc073.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{213f7a1d-e50d-4d06-a227-c59f23a15cf5}\MpKsl96adc073.sys [?] S1 MpKsl98d60509;MpKsl98d60509;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5dbbd9b5-af9b-4330-9643-342fe97ec9dc}\mpksl98d60509.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5dbbd9b5-af9b-4330-9643-342fe97ec9dc}\MpKsl98d60509.sys [?] S1 MpKsl9fb5136b;MpKsl9fb5136b;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2af13516-a17c-4702-bc7c-6fcf83949039}\mpksl9fb5136b.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2af13516-a17c-4702-bc7c-6fcf83949039}\MpKsl9fb5136b.sys [?] S1 MpKsladef329c;MpKsladef329c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d5966e74-4f00-4c32-b3b7-5f1c6ccd234c}\mpksladef329c.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d5966e74-4f00-4c32-b3b7-5f1c6ccd234c}\MpKsladef329c.sys [?] S1 MpKslb15c7bd2;MpKslb15c7bd2;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{32bb4219-4d88-48e2-a5e5-936bde97230f}\mpkslb15c7bd2.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{32bb4219-4d88-48e2-a5e5-936bde97230f}\MpKslb15c7bd2.sys [?] S1 MpKslc72a02d3;MpKslc72a02d3;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f94dc3ce-fa93-4e3e-a3c0-dd4333470f1a}\mpkslc72a02d3.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f94dc3ce-fa93-4e3e-a3c0-dd4333470f1a}\MpKslc72a02d3.sys [?] S1 MpKslcc4e918a;MpKslcc4e918a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{46afe2d0-a218-4dec-94de-0a0a103f6c19}\mpkslcc4e918a.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{46afe2d0-a218-4dec-94de-0a0a103f6c19}\MpKslcc4e918a.sys [?] S1 MpKslcdf7b8d1;MpKslcdf7b8d1;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a4e6679-33f7-4cf8-81c7-b65d02b3dc30}\mpkslcdf7b8d1.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a4e6679-33f7-4cf8-81c7-b65d02b3dc30}\MpKslcdf7b8d1.sys [?] S1 MpKsleb30e3b0;MpKsleb30e3b0;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f0ddaae1-6c69-4b3e-bb6c-e424fdd4720a}\mpksleb30e3b0.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f0ddaae1-6c69-4b3e-bb6c-e424fdd4720a}\MpKsleb30e3b0.sys [?] S1 MpKslebbeb1ad;MpKslebbeb1ad;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6f298684-3aa3-4456-b7fd-23d4453a67b3}\mpkslebbeb1ad.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6f298684-3aa3-4456-b7fd-23d4453a67b3}\MpKslebbeb1ad.sys [?] S1 MpKslecf18eb9;MpKslecf18eb9;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{213f7a1d-e50d-4d06-a227-c59f23a15cf5}\mpkslecf18eb9.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{213f7a1d-e50d-4d06-a227-c59f23a15cf5}\MpKslecf18eb9.sys [?] S1 MpKslf2f10a77;MpKslf2f10a77;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2eee4fb2-39dd-4964-8023-946a65526b54}\mpkslf2f10a77.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2eee4fb2-39dd-4964-8023-946a65526b54}\MpKslf2f10a77.sys [?] S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\hills\locals~1\temp\sas_selfextract\sasdifsv.sys –> c:\docume~1\hills\locals~1\temp\sas_selfextract\SASDIFSV.SYS [?] S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\hills\locals~1\temp\sas_selfextract\saskutil.sys –> c:\docume~1\hills\locals~1\temp\sas_selfextract\SASKUTIL.SYS [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 alcan5ln;SpeedTouch™ USB ADSL RFC1483 Networking Driver (NDIS);c:\windows\system32\drivers\alcan5ln.sys [2009-7-22 36256] S3 CrucialSMBusScan;CrucialSMBusScan;\??\c:\docume~1\admini~1\locals~1\temp\crucialsmbusscan_xp32.sys –> c:\docume~1\admini~1\locals~1\temp\CrucialSMBusScan_XP32.sys [?] S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\lavasoft\ad-aware\kernexplorer.sys –> c:\program files\lavasoft\ad-aware\KernExplorer.sys [?] S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys –> c:\windows\system32\drivers\wg111v2.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-20 136176] S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-20 136176] S4 PuranDefrag;PuranDefrag;c:\windows\system32\PuranDefragS.exe [2010-12-24 229376] S4 SeagateDashboardService;Seagate Dashboard Service;c:\program files\seagate\seagate dashboard\SeagateDashboardService.exe [2010-7-7 14088] . =============== File Associations =============== . vbefile\shell\open2\command=%SystemRoot%\System32\CScript.exe "%1" %* vbsfile\shell\open2\command=%SystemRoot%\System32\CScript.exe "%1" %* jsefile\shell\open2\command=%SystemRoot%\System32\CScript.exe "%1" %* . =============== Created Last 30 ================ . 2011-07-12 04:28:42 28752 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f309dda4-4ed0-4a7e-8fe9-562e24e11f56}\MpKsl502dc5e2.sys 2011-07-11 10:07:49 7074640 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{f309dda4-4ed0-4a7e-8fe9-562e24e11f56}\mpengine.dll 2011-07-10 12:47:38 388096 —-a-r- c:\documents and settings\hills\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2011-07-10 12:47:35 ——– d—–w- c:\program files\Trend Micro 2011-07-10 12:47:02 602112 -c—-w- c:\windows\system32\dllcache\msfeeds.dll 2011-07-10 12:47:01 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll 2011-07-10 12:47:00 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll 2011-07-10 12:46:55 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2011-07-10 12:46:55 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2011-07-10 12:46:51 1991680 -c—-w- c:\windows\system32\dllcache\iertutil.dll 2011-07-10 11:43:37 ——– d-sh–w- c:\documents and settings\hills\IECompatCache 2011-07-08 08:40:39 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys 2011-07-08 08:40:22 ——– d—–w- c:\program files\Panda Security 2011-07-07 12:26:40 ——– d—–w- c:\documents and settings\hills\application data\SUPERAntiSpyware.com 2011-07-07 12:26:40 ——– d—–w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com 2011-07-04 09:37:07 116224 -c–a-w- c:\windows\system32\dllcache\xrxwiadr.dll 2011-07-04 09:36:52 23040 -c–a-w- c:\windows\system32\dllcache\xrxwbtmp.dll 2011-07-04 09:36:46 18944 -c–a-w- c:\windows\system32\dllcache\xrxscnui.dll 2011-07-04 09:36:34 27648 -c–a-w- c:\windows\system32\dllcache\xrxftplt.exe 2011-07-04 09:36:14 4608 -c–a-w- c:\windows\system32\dllcache\xrxflnch.exe 2011-07-04 09:35:33 99865 -c–a-w- c:\windows\system32\dllcache\xlog.exe 2011-07-04 09:35:16 16970 -c–a-w- c:\windows\system32\dllcache\xem336n5.sys 2011-07-04 09:35:13 19455 -c–a-w- c:\windows\system32\dllcache\wvchntxx.sys 2011-07-04 09:35:08 19200 -c–a-w- c:\windows\system32\dllcache\wstcodec.sys 2011-07-04 09:35:07 12063 -c–a-w- c:\windows\system32\dllcache\wsiintxx.sys 2011-07-04 09:35:01 8192 -c–a-w- c:\windows\system32\dllcache\wshirda.dll 2011-07-04 09:34:37 8832 -c–a-w- c:\windows\system32\dllcache\wmiacpi.sys 2011-07-04 09:34:29 154624 -c–a-w- c:\windows\system32\dllcache\wlluc48.sys 2011-07-04 09:34:16 34890 -c–a-w- c:\windows\system32\dllcache\wlandrv2.sys 2011-07-04 09:34:03 771581 -c–a-w- c:\windows\system32\dllcache\winacisa.sys 2011-07-04 09:33:56 53760 -c–a-w- c:\windows\system32\dllcache\wiamsmud.dll 2011-07-04 09:33:44 87040 -c–a-w- c:\windows\system32\dllcache\wiafbdrv.dll 2011-07-04 09:33:43 31232 -c–a-w- c:\windows\system32\dllcache\weitekp9.sys 2011-07-04 09:33:42 41600 -c–a-w- c:\windows\system32\dllcache\weitekp9.dll 2011-07-04 09:33:28 701386 -c–a-w- c:\windows\system32\dllcache\wdhaalba.sys 2011-07-04 09:33:26 23615 -c–a-w- c:\windows\system32\dllcache\wch7xxnt.sys 2011-07-04 09:33:20 31744 -c–a-w- c:\windows\system32\dllcache\wceusbsh.sys 2011-07-04 09:33:08 35871 -c–a-w- c:\windows\system32\dllcache\wbfirdma.sys 2011-07-04 09:33:04 33599 -c–a-w- c:\windows\system32\dllcache\watv04nt.sys 2011-07-04 09:33:03 19551 -c–a-w- c:\windows\system32\dllcache\watv02nt.sys 2011-07-04 09:33:01 29311 -c–a-w- c:\windows\system32\dllcache\watv01nt.sys 2011-07-04 09:31:49 24576 -c–a-w- c:\windows\system32\dllcache\viairda.sys 2011-07-04 09:31:47 5376 -c–a-w- c:\windows\system32\dllcache\viaide.sys 2011-07-04 09:31:35 53760 -c–a-w- c:\windows\system32\dllcache\vfwwdm32.dll 2011-07-04 09:31:27 687999 -c–a-w- c:\windows\system32\dllcache\usrwdxjs.sys 2011-07-04 09:31:20 765884 -c–a-w- c:\windows\system32\dllcache\usrti.sys 2011-07-04 09:31:13 113762 -c–a-w- c:\windows\system32\dllcache\usrpda.sys 2011-07-04 09:31:07 7556 -c–a-w- c:\windows\system32\dllcache\usroslba.sys 2011-07-04 09:31:00 224802 -c–a-w- c:\windows\system32\dllcache\usr1807a.sys 2011-07-04 09:30:54 794399 -c–a-w- c:\windows\system32\dllcache\usr1806v.sys 2011-07-04 09:30:49 793598 -c–a-w- c:\windows\system32\dllcache\usr1806.sys 2011-07-04 09:30:34 794654 -c–a-w- c:\windows\system32\dllcache\usr1801.sys 2011-07-04 09:30:31 20608 -c–a-w- c:\windows\system32\dllcache\usbuhci.sys 2011-07-04 09:30:29 26112 -c–a-w- c:\windows\system32\dllcache\usbser.sys 2011-07-04 09:30:27 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys 2011-07-04 09:30:25 25856 -c–a-w- c:\windows\system32\dllcache\usbprint.sys 2011-07-04 09:30:23 32128 -c–a-w- c:\windows\system32\dllcache\usbccgp.sys 2011-07-04 09:30:21 60032 -c–a-w- c:\windows\system32\dllcache\usbaudio.sys 2011-07-04 09:30:16 32384 -c–a-w- c:\windows\system32\dllcache\usb101et.sys 2011-07-04 09:30:08 94720 -c–a-w- c:\windows\system32\dllcache\umaxud32.dll 2011-07-04 09:30:03 28160 -c–a-w- c:\windows\system32\dllcache\umaxu40.dll 2011-07-04 09:29:57 26624 -c–a-w- c:\windows\system32\dllcache\umaxu22.dll 2011-07-04 09:29:52 69632 -c–a-w- c:\windows\system32\dllcache\umaxu12.dll 2011-07-04 09:29:47 50688 -c–a-w- c:\windows\system32\dllcache\umaxscan.dll 2011-07-04 09:29:42 22912 -c–a-w- c:\windows\system32\dllcache\umaxpcls.sys 2011-07-04 09:29:37 50176 -c–a-w- c:\windows\system32\dllcache\umaxp60.dll 2011-07-04 09:29:31 47616 -c–a-w- c:\windows\system32\dllcache\umaxcam.dll 2011-07-04 09:29:26 211968 -c–a-w- c:\windows\system32\dllcache\um54scan.dll 2011-07-04 09:29:21 216064 -c–a-w- c:\windows\system32\dllcache\um34scan.dll 2011-07-04 09:29:15 36736 -c–a-w- c:\windows\system32\dllcache\ultra.sys 2011-07-04 09:29:07 14336 -c–a-w- c:\windows\system32\dllcache\tsprof.exe 2011-07-04 09:29:07 11520 -c–a-w- c:\windows\system32\dllcache\twotrack.sys 2011-07-04 09:28:59 166784 -c–a-w- c:\windows\system32\dllcache\tridxpm.sys 2011-07-04 09:28:54 525568 -c–a-w- c:\windows\system32\dllcache\tridxp.dll 2011-07-04 09:28:48 159232 -c–a-w- c:\windows\system32\dllcache\tridkbm.sys 2011-07-04 09:28:43 440576 -c–a-w- c:\windows\system32\dllcache\tridkb.dll 2011-07-04 09:28:38 222336 -c–a-w- c:\windows\system32\dllcache\trid3dm.sys 2011-07-04 09:28:32 315520 -c–a-w- c:\windows\system32\dllcache\trid3d.dll 2011-07-04 09:28:26 34375 -c–a-w- c:\windows\system32\dllcache\tpro4.sys 2011-07-04 09:28:15 42496 -c–a-w- c:\windows\system32\dllcache\tp4res.dll 2011-07-04 09:28:11 82944 -c–a-w- c:\windows\system32\dllcache\tp4mon.exe 2011-07-04 09:28:05 31744 -c–a-w- c:\windows\system32\dllcache\tp4.dll 2011-07-04 09:28:04 3374640 -c–a-w- c:\windows\system32\dllcache\tourW.exe 2011-07-04 09:27:59 4992 -c–a-w- c:\windows\system32\dllcache\toside.sys 2011-07-04 09:27:53 230912 -c–a-w- c:\windows\system32\dllcache\tosdvd03.sys 2011-07-04 09:27:48 241664 -c–a-w- c:\windows\system32\dllcache\tosdvd02.sys 2011-07-04 09:27:43 28232 -c–a-w- c:\windows\system32\dllcache\tos4mo.sys 2011-07-04 09:27:35 123995 -c–a-w- c:\windows\system32\dllcache\tjisdn.sys 2011-07-04 09:27:32 185344 -c–a-w- c:\windows\system32\dllcache\thawbrkr.dll 2011-07-04 09:27:26 138528 -c–a-w- c:\windows\system32\dllcache\tgiulnt5.sys 2011-07-04 09:27:15 81408 -c–a-w- c:\windows\system32\dllcache\tgiul50.dll 2011-07-04 09:27:10 149376 -c–a-w- c:\windows\system32\dllcache\tffsport.sys 2011-07-04 09:27:09 19464 -c–a-w- c:\windows\system32\dllcache\tdspx.sys 2011-07-04 09:27:04 17129 -c–a-w- c:\windows\system32\dllcache\tdkcd31.sys 2011-07-04 09:25:56 3968 -c–a-w- c:\windows\system32\dllcache\swusbflt.sys 2011-07-04 09:25:52 10240 -c–a-w- c:\windows\system32\dllcache\swpidflt.dll 2011-07-04 09:25:47 10240 -c–a-w- c:\windows\system32\dllcache\swpdflt2.dll 2011-07-04 09:25:42 53760 -c–a-w- c:\windows\system32\dllcache\sw_wheel.dll 2011-07-04 09:25:31 41472 -c–a-w- c:\windows\system32\dllcache\sw_effct.dll 2011-07-04 09:25:25 15232 -c–a-w- c:\windows\system32\dllcache\streamip.sys 2011-07-04 09:25:19 155648 -c–a-w- c:\windows\system32\dllcache\stlnprop.dll 2011-07-04 09:25:15 53248 -c–a-w- c:\windows\system32\dllcache\stlncoin.dll 2011-07-04 09:25:10 285760 -c–a-w- c:\windows\system32\dllcache\stlnata.sys 2011-07-04 09:25:04 16896 -c–a-w- c:\windows\system32\dllcache\stcusb.sys 2011-07-04 09:25:04 16896 -c–a-w- c:\windows\system32\dllcache\status.dll 2011-07-04 09:24:54 48736 -c–a-w- c:\windows\system32\dllcache\srwlnd5.sys 2011-07-04 09:24:49 99328 -c–a-w- c:\windows\system32\dllcache\srusd.dll 2011-07-04 09:24:48 101376 -c–a-w- c:\windows\system32\dllcache\srusbusd.dll 2011-07-04 09:24:38 24660 -c–a-w- c:\windows\system32\dllcache\spxupchk.dll 2011-07-04 09:24:30 61824 -c–a-w- c:\windows\system32\dllcache\speed.sys 2011-07-04 09:24:26 106584 -c–a-w- c:\windows\system32\dllcache\spdports.dll 2011-07-04 09:24:21 19072 -c–a-w- c:\windows\system32\dllcache\sparrow.sys 2011-07-04 09:24:15 7552 -c–a-w- c:\windows\system32\dllcache\sonypvu1.sys 2011-07-04 09:24:11 37040 -c–a-w- c:\windows\system32\dllcache\sonypi.sys 2011-07-04 09:24:06 114688 -c–a-w- c:\windows\system32\dllcache\sonypi.dll 2011-07-04 09:24:01 20752 -c–a-w- c:\windows\system32\dllcache\sonync.sys 2011-07-04 09:22:56 24576 -c–a-w- c:\windows\system32\dllcache\smc8000n.sys 2011-07-04 09:21:59 91294 -c–a-w- c:\windows\system32\dllcache\skfpwin.sys 2011-07-04 09:21:54 94698 -c–a-w- c:\windows\system32\dllcache\sk98xwin.sys 2011-07-04 09:21:49 157696 -c–a-w- c:\windows\system32\dllcache\sisv256.dll 2011-07-04 09:21:39 50432 -c–a-w- c:\windows\system32\dllcache\sisv.sys 2011-07-04 09:21:35 32768 -c–a-w- c:\windows\system32\dllcache\sisnic.sys 2011-07-04 09:21:29 150144 -c–a-w- c:\windows\system32\dllcache\sis6306v.dll 2011-07-04 09:21:25 68608 -c–a-w- c:\windows\system32\dllcache\sis6306p.sys 2011-07-04 09:21:20 252032 -c–a-w- c:\windows\system32\dllcache\sis300iv.dll 2011-07-04 09:21:09 101760 -c–a-w- c:\windows\system32\dllcache\sis300ip.sys 2011-07-04 09:21:08 18944 -c–a-w- c:\windows\system32\dllcache\simptcp.dll 2011-07-04 09:19:57 17280 -c–a-w- c:\windows\system32\dllcache\scr111.sys 2011-07-04 09:19:52 16640 -c–a-w- c:\windows\system32\dllcache\scmstcs.sys 2011-07-04 09:19:46 23936 -c–a-w- c:\windows\system32\dllcache\sccmusbm.sys 2011-07-04 09:19:42 23936 -c–a-w- c:\windows\system32\dllcache\sccmn50m.sys 2011-07-04 09:19:38 43904 -c–a-w- c:\windows\system32\dllcache\sbp2port.sys 2011-07-04 09:19:33 495616 -c–a-w- c:\windows\system32\dllcache\sblfx.dll 2011-07-04 09:19:27 75392 -c–a-w- c:\windows\system32\dllcache\s3savmxm.sys 2011-07-04 09:19:22 245632 -c–a-w- c:\windows\system32\dllcache\s3savmx.dll 2011-07-04 09:19:17 77824 -c–a-w- c:\windows\system32\dllcache\s3sav4m.sys 2011-07-04 09:19:13 198400 -c–a-w- c:\windows\system32\dllcache\s3sav4.dll 2011-07-04 09:19:08 61504 -c–a-w- c:\windows\system32\dllcache\s3sav3dm.sys 2011-07-04 09:19:04 179264 -c–a-w- c:\windows\system32\dllcache\s3sav3d.dll 2011-07-04 09:17:57 19017 -c–a-w- c:\windows\system32\dllcache\rtl8029.sys 2011-07-04 09:17:52 30720 -c–a-w- c:\windows\system32\dllcache\rthwcls.sys 2011-07-04 09:17:46 9216 -c–a-w- c:\windows\system32\dllcache\rsmgrstr.dll 2011-07-04 09:17:34 3840 -c–a-w- c:\windows\system32\dllcache\rpfun.sys 2011-07-04 09:17:27 79104 -c–a-w- c:\windows\system32\dllcache\rocket.sys 2011-07-04 09:17:22 37563 -c–a-w- c:\windows\system32\dllcache\rlnet5.sys 2011-07-04 09:17:17 86097 -c–a-w- c:\windows\system32\dllcache\reslog32.dll 2011-07-04 09:17:14 23040 -c–a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe 2011-07-04 09:17:13 14848 -c–a-w- c:\windows\system32\dllcache\register.exe 2011-07-04 09:17:06 19584 -c–a-w- c:\windows\system32\dllcache\rasirda.sys 2011-07-04 09:15:58 128286 -c–a-w- c:\windows\system32\dllcache\ptserli.sys 2011-07-04 09:14:56 173696 -c–a-w- c:\windows\system32\dllcache\philcam2.sys 2011-07-04 09:13:52 26153 -c–a-w- c:\windows\system32\dllcache\pcmlm56.sys 2011-07-04 09:12:56 28032 -c–a-w- c:\windows\system32\dllcache\ovcd.sys 2011-07-04 09:12:52 48000 -c–a-w- c:\windows\system32\dllcache\ovcam2.sys 2011-07-04 09:12:47 25088 -c–a-w- c:\windows\system32\dllcache\ovca.sys 2011-07-04 09:12:42 54186 -c–a-w- c:\windows\system32\dllcache\otcsercb.sys 2011-07-04 09:12:38 43689 -c–a-w- c:\windows\system32\dllcache\otceth5.sys 2011-07-04 09:12:33 27209 -c–a-w- c:\windows\system32\dllcache\otc06x5.sys 2011-07-04 09:12:22 54528 -c–a-w- c:\windows\system32\dllcache\opl3sax.sys 2011-07-04 09:12:15 61696 -c–a-w- c:\windows\system32\dllcache\ohci1394.sys 2011-07-04 09:12:06 198144 -c–a-w- c:\windows\system32\dllcache\nv3.sys 2011-07-04 09:12:01 123776 -c–a-w- c:\windows\system32\dllcache\nv3.dll 2011-07-04 09:11:52 51552 -c–a-w- c:\windows\system32\dllcache\ntgrip.sys 2011-07-04 09:11:52 38912 -c–a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll 2011-07-04 09:11:45 9344 -c–a-w- c:\windows\system32\dllcache\ntapm.sys 2011-07-04 09:11:40 7552 -c–a-w- c:\windows\system32\dllcache\nsmmc.sys 2011-07-04 09:11:36 28672 -c–a-w- c:\windows\system32\dllcache\nscirda.sys 2011-07-04 09:11:31 87040 -c–a-w- c:\windows\system32\dllcache\nm6wdm.sys 2011-07-04 09:11:26 126080 -c–a-w- c:\windows\system32\dllcache\nm5a2wdm.sys 2011-07-04 09:11:12 53248 -c–a-w- c:\windows\system32\dllcache\nextlink.dll 2011-07-04 09:11:12 32840 -c–a-w- c:\windows\system32\dllcache\ngrpci.sys 2011-07-04 09:11:05 132695 -c–a-w- c:\windows\system32\dllcache\netwlan5.sys 2011-07-04 09:09:57 52255 -c–a-w- c:\windows\system32\dllcache\n1000nt5.sys 2011-07-04 09:09:53 75520 -c–a-w- c:\windows\system32\dllcache\mxport.sys 2011-07-04 09:09:49 7168 -c–a-w- c:\windows\system32\dllcache\mxport.dll 2011-07-04 09:09:44 19968 -c–a-w- c:\windows\system32\dllcache\mxnic.sys 2011-07-04 09:09:40 19968 -c–a-w- c:\windows\system32\dllcache\mxicfg.dll 2011-07-04 09:09:36 21888 -c–a-w- c:\windows\system32\dllcache\mxcard.sys 2011-07-04 09:09:35 229439 -c–a-w- c:\windows\system32\dllcache\multibox.dll 2011-07-04 09:09:24 103296 -c–a-w- c:\windows\system32\dllcache\mtxvideo.sys 2011-07-04 09:09:14 5504 -c–a-w- c:\windows\system32\dllcache\mstee.sys 2011-07-04 09:09:12 49024 -c–a-w- c:\windows\system32\dllcache\mstape.sys 2011-07-04 09:08:59 12416 -c–a-w- c:\windows\system32\dllcache\msriffwv.sys 2011-07-04 09:08:36 2944 -c–a-w- c:\windows\system32\dllcache\msmpu401.sys 2011-07-04 09:08:32 22016 -c–a-w- c:\windows\system32\dllcache\msircomm.sys 2011-07-04 09:08:30 98304 -c–a-w- c:\windows\system32\dllcache\msir3jp.dll 2011-07-04 09:08:17 35200 -c–a-w- c:\windows\system32\dllcache\msgame.sys 2011-07-04 09:08:12 6016 -c–a-w- c:\windows\system32\dllcache\msfsio.sys 2011-07-04 09:08:09 51200 -c–a-w- c:\windows\system32\dllcache\msdv.sys 2011-07-04 09:06:58 48768 -c–a-w- c:\windows\system32\dllcache\maestro.sys 2011-07-04 09:05:58 15744 -c–a-w- c:\windows\system32\dllcache\lit220p.sys 2011-07-04 09:04:59 6144 -c–a-w- c:\windows\system32\dllcache\kbd101c.dll 2011-07-04 09:03:59 57398 -c–a-w- c:\windows\system32\dllcache\imjpdadm.exe 2011-07-04 09:02:58 100936 -c–a-w- c:\windows\system32\dllcache\ibmtok.sys 2011-07-04 09:01:56 542879 -c–a-w- c:\windows\system32\dllcache\hsf_msft.sys 2011-07-04 09:00:58 31232 -c–a-w- c:\windows\system32\dllcache\hpgt42tk.dll 2011-07-04 08:59:59 59136 -c–a-w- c:\windows\system32\dllcache\gckernel.sys 2011-07-04 08:58:58 22090 -c–a-w- c:\windows\system32\dllcache\fem556n5.sys 2011-07-04 08:57:58 37120 -c–a-w- c:\windows\system32\dllcache\es1370mp.sys 2011-07-04 08:56:58 24653 -c–a-w- c:\windows\system32\dllcache\el574nd4.sys 2011-07-04 08:55:59 31305 -c–a-w- c:\windows\system32\dllcache\disrvpp.dll 2011-07-04 08:54:59 179584 -c–a-w- c:\windows\system32\dllcache\dac2w2k.sys 2011-07-04 08:53:59 20736 -c–a-w- c:\windows\system32\dllcache\cmbp0wdm.sys 2011-07-04 08:52:37 13824 -c–a-w- c:\windows\system32\dllcache\bulltlp3.sys 2011-07-04 08:51:59 37568 -c–a-w- c:\windows\system32\dllcache\avmwan.sys 2011-07-04 08:50:59 10880 -c–a-w- c:\windows\system32\dllcache\admjoy.sys 2011-07-04 08:49:42 7680 -c–a-w- c:\windows\system32\dllcache\inetmgr.exe 2011-07-04 08:49:42 19968 -c–a-w- c:\windows\system32\dllcache\inetsloc.dll 2011-07-04 08:49:41 169984 -c–a-w- c:\windows\system32\dllcache\iisui.dll 2011-07-04 08:49:38 5632 -c–a-w- c:\windows\system32\dllcache\iisrstap.dll 2011-07-04 08:49:38 14336 -c–a-w- c:\windows\system32\dllcache\iisreset.exe 2011-07-04 08:49:36 6144 -c–a-w- c:\windows\system32\dllcache\ftpsapi2.dll 2011-07-03 04:40:57 ——– d—–w- c:\windows\system32\wbem\repository\FS 2011-07-03 04:40:57 ——– d—–w- c:\windows\system32\wbem\Repository 2011-07-03 04:36:49 ——– d—–w- c:\windows\system32\wbem\repository.old\FS 2011-07-03 04:36:49 ——– d—–w- c:\windows\system32\wbem\repository.old 2011-07-03 02:11:57 73728 —-a-w- c:\windows\system32\javacpl.cpl 2011-06-30 01:56:08 ——– d—–w- c:\windows\system32\FxsTmp 2011-06-29 03:01:50 2106216 —-a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll 2011-06-29 03:01:49 1998168 —-a-w- c:\program files\mozilla firefox\d3dx9_43.dll 2011-06-21 15:51:30 110592 —-a-w- c:\windows\system32\ccrpbds6.dll 2011-06-21 15:50:59 212992 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\ILog.dll 2011-06-21 14:08:09 608448 —-a-w- c:\windows\system32\COMCTL32.OCX . ==================== Find3M ==================== . 2011-07-09 10:15:28 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-07-03 02:10:53 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-06-19 06:13:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-05-21 10:11:04 22 –sha-w- c:\documents and settings\hills\application data\Sys2662.Config.Repository.bin 2011-05-21 09:28:01 1060864 —-a-w- c:\windows\system32\mfc71.dll 2011-05-21 09:27:58 348160 —-a-w- c:\windows\system32\msvcr71.dll 2011-05-21 09:27:58 1700352 —-a-w- c:\windows\system32\gdiplus.dll 2011-05-17 09:13:59 436792 —-a-w- c:\windows\system32\drivers\sptd.sys 2011-05-02 23:05:10 3661824 —-a-w- c:\windows\system32\ffdshow.ax 2011-05-02 22:30:50 1144147 —-a-w- c:\windows\system32\ffmpegmt.dll 2011-05-02 22:27:54 3935545 —-a-w- c:\windows\system32\ffmpeg.dll 2011-05-02 20:23:46 324096 —-a-w- c:\windows\system32\TomsMoComp_ff.dll 2011-05-02 20:19:34 100352 —-a-w- c:\windows\system32\ff_wmv9.dll 2011-05-02 20:19:20 80896 —-a-w- c:\windows\system32\ff_vfw.dll 2011-05-02 15:31:52 692736 —-a-w- c:\windows\system32\inetcomm.dll 2011-04-29 17:25:27 151552 —-a-w- c:\windows\system32\schannel.dll 2011-04-29 16:19:43 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-04-26 11:22:28 20800 —-a-w- c:\windows\system32\cnat.exe 2011-04-25 16:11:12 916480 —-a-w- c:\windows\system32\wininet.dll 2011-04-25 16:11:11 43520 —-a-w- c:\windows\system32\licmgr10.dll 2011-04-25 16:11:11 1469440 ——w- c:\windows\system32\inetcpl.cpl 2011-04-25 12:01:22 385024 —-a-w- c:\windows\system32\html.iec 2011-04-21 13:37:43 105472 —-a-w- c:\windows\system32\drivers\mup.sys 2011-04-20 13:07:38 19072 —-a-w- c:\windows\system32\drivers\PS2.sys . ============= FINISH: 16:02:02.09 ===============

Hey TomK,

Have posted the Combo Fix log below.

Cheers

Free


ComboFix 11-07-12.09 - Hills 13/07/2011 19:11:07.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.224.62 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Hills\WINDOWS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 )))))))))))))))))))))))))))))))
.
.
2011-07-13 07:41 . 2011-06-06 22:55 7074640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-07-13 07:12 . 2011-06-06 22:55 7074640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1A39E423-4D41-4A78-B3E1-C31269F55650}\mpengine.dll
2011-07-12 07:10 . 2011-07-12 07:11 ——– d—–w- c:\program files\Microsoft Security Client
2011-07-12 06:47 . 2011-07-12 06:47 ——– d–h–w- c:\windows\system32\GroupPolicy
2011-07-10 12:47 . 2011-07-10 12:47 388096 —-a-r- c:\documents and settings\Hills\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-07-10 12:47 . 2011-07-10 12:47 ——– d—–w- c:\program files\Trend Micro
2011-07-10 11:43 . 2011-07-10 11:43 ——– d-sh–w- c:\documents and settings\Hills\IECompatCache
2011-07-09 10:41 . 2011-07-09 10:41 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2011-07-08 08:40 . 2009-06-30 00:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2011-07-08 08:40 . 2011-07-09 03:01 ——– d—–w- c:\program files\Panda Security
2011-07-04 09:23 . 2001-08-17 12:36 7168 -c–a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-07-04 09:23 . 2001-08-17 12:36 12288 -c–a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll
2011-07-04 09:20 . 2001-08-17 12:36 26112 -c–a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2011-07-04 09:20 . 2001-08-17 12:36 57856 -c–a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-07-04 09:17 . 2001-08-17 12:36 23040 -c–a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2011-07-04 09:11 . 2001-08-17 12:36 38912 -c–a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2011-07-04 09:07 . 2001-08-17 12:36 65536 -c–a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll
2011-07-04 09:02 . 2001-08-18 23:00 10096640 -c–a-w- c:\windows\system32\dllcache\hwxcht.dll
2011-07-04 09:02 . 2001-08-17 03:28 488383 -c–a-w- c:\windows\system32\dllcache\hsf_v124.sys
2011-07-04 09:02 . 2001-08-17 03:28 50751 -c–a-w- c:\windows\system32\dllcache\hsf_tone.sys
2011-07-04 09:02 . 2001-08-17 03:28 73279 -c–a-w- c:\windows\system32\dllcache\hsf_spkp.sys
2011-07-04 09:02 . 2001-08-17 03:28 44863 -c–a-w- c:\windows\system32\dllcache\hsf_soar.sys
2011-07-04 09:02 . 2001-08-17 03:28 57471 -c–a-w- c:\windows\system32\dllcache\hsf_samp.sys
2011-07-04 09:00 . 2001-08-17 12:36 31232 -c–a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-07-04 08:59 . 2008-04-13 18:45 59136 -c–a-w- c:\windows\system32\dllcache\gckernel.sys
2011-07-04 08:58 . 2001-08-17 02:10 22090 -c–a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-07-04 08:57 . 2001-08-17 02:19 37120 -c–a-w- c:\windows\system32\dllcache\es1370mp.sys
2011-07-04 08:56 . 2001-08-17 02:10 24653 -c–a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-07-04 08:55 . 2001-08-17 12:36 31305 -c–a-w- c:\windows\system32\dllcache\disrvpp.dll
2011-07-04 08:54 . 2001-08-17 03:52 179584 -c–a-w- c:\windows\system32\dllcache\dac2w2k.sys
2011-07-04 08:53 . 2001-08-17 03:51 20736 -c–a-w- c:\windows\system32\dllcache\cmbp0wdm.sys
2011-07-04 08:52 . 2001-08-17 03:51 13824 -c–a-w- c:\windows\system32\dllcache\bulltlp3.sys
2011-07-04 08:51 . 2001-08-17 02:13 37568 -c–a-w- c:\windows\system32\dllcache\avmwan.sys
2011-07-04 08:50 . 2004-08-03 12:32 10880 -c–a-w- c:\windows\system32\dllcache\admjoy.sys
2011-07-04 08:49 . 2001-08-18 23:00 6144 -c–a-w- c:\windows\system32\dllcache\ftpsapi2.dll
2011-07-03 04:40 . 2011-07-03 04:40 ——– d—–w- c:\windows\system32\wbem\Repository\FS
2011-07-03 04:40 . 2011-07-03 04:40 ——– d—–w- c:\windows\system32\wbem\Repository
2011-07-03 04:36 . 2011-07-03 04:36 ——– d—–w- c:\windows\system32\wbem\repository.old
2011-07-03 02:12 . 2011-07-03 02:12 ——– d—–w- c:\program files\Common Files\Java
2011-07-03 02:11 . 2011-07-03 02:10 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-07-03 02:10 . 2011-07-03 02:10 ——– d—–w- c:\program files\Java
2011-06-30 01:56 . 2011-06-30 01:56 ——– d—–w- c:\windows\system32\FxsTmp
2011-06-29 03:01 . 2011-06-29 03:01 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-29 03:01 . 2011-06-29 03:01 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-21 15:51 . 2001-11-28 23:57 110592 —-a-w- c:\windows\system32\ccrpbds6.dll
2011-06-21 15:50 . 2000-01-03 21:39 212992 —-a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll
2011-06-21 14:08 . 2000-05-22 06:58 608448 —-a-w- c:\windows\system32\COMCTL32.OCX
2011-06-19 03:18 . 2011-06-19 03:22 ——– d—–w- c:\program files\Common Files\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-09 10:15 . 2010-04-01 02:50 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-04 11:32 . 2011-06-09 04:27 165232 —ha-w- c:\documents and settings\Hills\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll
2011-07-03 02:10 . 2010-05-07 02:29 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-06-19 06:13 . 2011-05-18 06:33 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2007-07-27 12:00 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-05-21 10:11 . 2011-05-21 10:11 22 –sha-w- c:\documents and settings\Hills\Application Data\Sys2662.Config.Repository.bin
2011-05-21 09:28 . 2011-05-21 09:27 1060864 —-a-w- c:\windows\system32\mfc71.dll
2011-05-21 09:27 . 2011-05-21 09:27 348160 —-a-w- c:\windows\system32\msvcr71.dll
2011-05-21 09:27 . 2011-05-21 09:27 1700352 —-a-w- c:\windows\system32\gdiplus.dll
2011-05-17 09:13 . 2011-05-17 09:13 436792 —-a-w- c:\windows\system32\drivers\sptd.sys
2011-05-02 23:05 . 2011-05-02 23:05 3661824 —-a-w- c:\windows\system32\ffdshow.ax
2011-05-02 22:30 . 2011-05-02 22:30 1144147 —-a-w- c:\windows\system32\ffmpegmt.dll
2011-05-02 22:27 . 2011-05-02 22:27 3935545 —-a-w- c:\windows\system32\ffmpeg.dll
2011-05-02 20:23 . 2011-05-02 20:23 324096 —-a-w- c:\windows\system32\TomsMoComp_ff.dll
2011-05-02 20:19 . 2011-05-02 20:19 100352 —-a-w- c:\windows\system32\ff_wmv9.dll
2011-05-02 20:19 . 2011-05-02 20:19 80896 —-a-w- c:\windows\system32\ff_vfw.dll
2011-05-02 15:31 . 2009-07-20 23:30 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2007-07-27 12:00 151552 —-a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2007-07-27 12:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:22 . 2011-05-21 09:45 20800 —-a-w- c:\windows\system32\cnat.exe
2011-04-26 11:07 . 2007-07-27 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2007-07-27 12:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2011-04-25 16:11 . 2007-07-27 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2007-07-27 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2007-07-27 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2007-07-27 12:00 385024 —-a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2007-07-27 12:00 105472 —-a-w- c:\windows\system32\drivers\mup.sys
2011-04-20 13:07 . 2011-04-20 13:07 19072 —-a-w- c:\windows\system32\drivers\PS2.sys
2011-04-18 03:18 . 2011-04-18 03:18 165648 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2011-06-29 03:01 . 2011-03-24 14:05 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2011-03-16 325000]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Hills^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\360Amigo
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"SeagateDashboardService"=2 (0x2)
"idsvc"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"SeaPort"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"MsMpSvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
.
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/07/2011 6:40 PM 28552]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17/05/2011 7:13 PM 436792]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [11/04/2011 2:01 PM 22504]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [21/07/2009 9:45 AM 177280]
S0 ncnvyc;ncnvyc;c:\windows\system32\drivers\pqnersy.sys –> c:\windows\system32\drivers\pqnersy.sys [?]
S1 MpKsl0fb37875;MpKsl0fb37875;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB8ED481-7EDF-406B-9F35-59CE2BA53447}\MpKsl0fb37875.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB8ED481-7EDF-406B-9F35-59CE2BA53447}\MpKsl0fb37875.sys [?]
S1 MpKsl1d181bf8;MpKsl1d181bf8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B2ED5FF7-D054-4783-A86D-760B190F89E4}\MpKsl1d181bf8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B2ED5FF7-D054-4783-A86D-760B190F89E4}\MpKsl1d181bf8.sys [?]
S1 MpKsl21812df6;MpKsl21812df6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B2615E64-93D4-40D5-B8BC-C090A313DEE2}\MpKsl21812df6.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B2615E64-93D4-40D5-B8BC-C090A313DEE2}\MpKsl21812df6.sys [?]
S1 MpKsl25caf545;MpKsl25caf545;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{32BB4219-4D88-48E2-A5E5-936BDE97230F}\MpKsl25caf545.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{32BB4219-4D88-48E2-A5E5-936BDE97230F}\MpKsl25caf545.sys [?]
S1 MpKsl33b3a1ac;MpKsl33b3a1ac;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5BC72CD4-71EB-4AC8-8FF3-4D88EB0DB0A4}\MpKsl33b3a1ac.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5BC72CD4-71EB-4AC8-8FF3-4D88EB0DB0A4}\MpKsl33b3a1ac.sys [?]
S1 MpKsl4053706f;MpKsl4053706f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7248DF8A-4F44-464F-BA4B-5F98EC90A592}\MpKsl4053706f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7248DF8A-4F44-464F-BA4B-5F98EC90A592}\MpKsl4053706f.sys [?]
S1 MpKsl4083cabc;MpKsl4083cabc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C32B66C4-BE68-4E67-8D4A-CE7AF8EACC18}\MpKsl4083cabc.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C32B66C4-BE68-4E67-8D4A-CE7AF8EACC18}\MpKsl4083cabc.sys [?]
S1 MpKsl46e9b91d;MpKsl46e9b91d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F0DDAAE1-6C69-4B3E-BB6C-E424FDD4720A}\MpKsl46e9b91d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F0DDAAE1-6C69-4B3E-BB6C-E424FDD4720A}\MpKsl46e9b91d.sys [?]
S1 MpKsl493a3a28;MpKsl493a3a28;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F55D21BC-324A-41DE-B81F-0A7EB91827FE}\MpKsl493a3a28.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F55D21BC-324A-41DE-B81F-0A7EB91827FE}\MpKsl493a3a28.sys [?]
S1 MpKsl4ce43e45;MpKsl4ce43e45;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EA57B3D9-0282-4B83-8FAA-F25FCAEDF375}\MpKsl4ce43e45.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EA57B3D9-0282-4B83-8FAA-F25FCAEDF375}\MpKsl4ce43e45.sys [?]
S1 MpKsl512dd4b4;MpKsl512dd4b4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FB0C375A-7721-4759-8E3F-59539922C84A}\MpKsl512dd4b4.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FB0C375A-7721-4759-8E3F-59539922C84A}\MpKsl512dd4b4.sys [?]
S1 MpKsl53b0c832;MpKsl53b0c832;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{213F7A1D-E50D-4D06-A227-C59F23A15CF5}\MpKsl53b0c832.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{213F7A1D-E50D-4D06-A227-C59F23A15CF5}\MpKsl53b0c832.sys [?]
S1 MpKsl54faf401;MpKsl54faf401;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95EE9ADC-ABB9-4B41-A22A-00EEE94B4DFF}\MpKsl54faf401.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{95EE9ADC-ABB9-4B41-A22A-00EEE94B4DFF}\MpKsl54faf401.sys [?]
S1 MpKsl559256ec;MpKsl559256ec;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{46AFE2D0-A218-4DEC-94DE-0A0A103F6C19}\MpKsl559256ec.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{46AFE2D0-A218-4DEC-94DE-0A0A103F6C19}\MpKsl559256ec.sys [?]
S1 MpKsl6476238b;MpKsl6476238b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2AF13516-A17C-4702-BC7C-6FCF83949039}\MpKsl6476238b.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2AF13516-A17C-4702-BC7C-6FCF83949039}\MpKsl6476238b.sys [?]
S1 MpKsl6a3759a4;MpKsl6a3759a4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53E26349-05FB-44FE-8D8B-195C14019141}\MpKsl6a3759a4.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53E26349-05FB-44FE-8D8B-195C14019141}\MpKsl6a3759a4.sys [?]
S1 MpKsl6b90c65f;MpKsl6b90c65f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5DBBD9B5-AF9B-4330-9643-342FE97EC9DC}\MpKsl6b90c65f.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5DBBD9B5-AF9B-4330-9643-342FE97EC9DC}\MpKsl6b90c65f.sys [?]
S1 MpKsl6d015d6d;MpKsl6d015d6d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5FFEB89F-3873-4D73-AE03-E16C9B999AA0}\MpKsl6d015d6d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5FFEB89F-3873-4D73-AE03-E16C9B999AA0}\MpKsl6d015d6d.sys [?]
S1 MpKsl71926a0c;MpKsl71926a0c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB119949-977E-4161-AC27-28214FED85FE}\MpKsl71926a0c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BB119949-977E-4161-AC27-28214FED85FE}\MpKsl71926a0c.sys [?]
S1 MpKsl7eef24e0;MpKsl7eef24e0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6397DD5E-B2F2-4E75-802F-DC089BBFCB6F}\MpKsl7eef24e0.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6397DD5E-B2F2-4E75-802F-DC089BBFCB6F}\MpKsl7eef24e0.sys [?]
S1 MpKsl8a57a207;MpKsl8a57a207;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D21DAE6C-D3F4-4D5E-B082-5658742802F5}\MpKsl8a57a207.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D21DAE6C-D3F4-4D5E-B082-5658742802F5}\MpKsl8a57a207.sys [?]
S1 MpKsl93571654;MpKsl93571654;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F94DC3CE-FA93-4E3E-A3C0-DD4333470F1A}\MpKsl93571654.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F94DC3CE-FA93-4E3E-A3C0-DD4333470F1A}\MpKsl93571654.sys [?]
S1 MpKsl96adc073;MpKsl96adc073;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{213F7A1D-E50D-4D06-A227-C59F23A15CF5}\MpKsl96adc073.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{213F7A1D-E50D-4D06-A227-C59F23A15CF5}\MpKsl96adc073.sys [?]
S1 MpKsl98d60509;MpKsl98d60509;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5DBBD9B5-AF9B-4330-9643-342FE97EC9DC}\MpKsl98d60509.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5DBBD9B5-AF9B-4330-9643-342FE97EC9DC}\MpKsl98d60509.sys [?]
S1 MpKsl9fb5136b;MpKsl9fb5136b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2AF13516-A17C-4702-BC7C-6FCF83949039}\MpKsl9fb5136b.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2AF13516-A17C-4702-BC7C-6FCF83949039}\MpKsl9fb5136b.sys [?]
S1 MpKsladef329c;MpKsladef329c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D5966E74-4F00-4C32-B3B7-5F1C6CCD234C}\MpKsladef329c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D5966E74-4F00-4C32-B3B7-5F1C6CCD234C}\MpKsladef329c.sys [?]
S1 MpKslb15c7bd2;MpKslb15c7bd2;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{32BB4219-4D88-48E2-A5E5-936BDE97230F}\MpKslb15c7bd2.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{32BB4219-4D88-48E2-A5E5-936BDE97230F}\MpKslb15c7bd2.sys [?]
S1 MpKslc72a02d3;MpKslc72a02d3;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F94DC3CE-FA93-4E3E-A3C0-DD4333470F1A}\MpKslc72a02d3.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F94DC3CE-FA93-4E3E-A3C0-DD4333470F1A}\MpKslc72a02d3.sys [?]
S1 MpKslcc4e918a;MpKslcc4e918a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{46AFE2D0-A218-4DEC-94DE-0A0A103F6C19}\MpKslcc4e918a.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{46AFE2D0-A218-4DEC-94DE-0A0A103F6C19}\MpKslcc4e918a.sys [?]
S1 MpKslcdf7b8d1;MpKslcdf7b8d1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A4E6679-33F7-4CF8-81C7-B65D02B3DC30}\MpKslcdf7b8d1.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A4E6679-33F7-4CF8-81C7-B65D02B3DC30}\MpKslcdf7b8d1.sys [?]
S1 MpKsleb30e3b0;MpKsleb30e3b0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F0DDAAE1-6C69-4B3E-BB6C-E424FDD4720A}\MpKsleb30e3b0.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F0DDAAE1-6C69-4B3E-BB6C-E424FDD4720A}\MpKsleb30e3b0.sys [?]
S1 MpKslebbeb1ad;MpKslebbeb1ad;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6F298684-3AA3-4456-B7FD-23D4453A67B3}\MpKslebbeb1ad.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6F298684-3AA3-4456-B7FD-23D4453A67B3}\MpKslebbeb1ad.sys [?]
S1 MpKslecf18eb9;MpKslecf18eb9;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{213F7A1D-E50D-4D06-A227-C59F23A15CF5}\MpKslecf18eb9.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{213F7A1D-E50D-4D06-A227-C59F23A15CF5}\MpKslecf18eb9.sys [?]
S1 MpKslf2f10a77;MpKslf2f10a77;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEE4FB2-39DD-4964-8023-946A65526B54}\MpKslf2f10a77.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2EEE4FB2-39DD-4964-8023-946A65526B54}\MpKslf2f10a77.sys [?]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\Hills\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS –> c:\docume~1\Hills\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\Hills\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS –> c:\docume~1\Hills\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 1:16 PM 130384]
S3 alcan5ln;SpeedTouch™ USB ADSL RFC1483 Networking Driver (NDIS);c:\windows\system32\drivers\alcan5ln.sys [22/07/2009 10:13 AM 36256]
S3 CrucialSMBusScan;CrucialSMBusScan;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\CrucialSMBusScan_XP32.sys –> c:\docume~1\ADMINI~1\LOCALS~1\Temp\CrucialSMBusScan_XP32.sys [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys –> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys –> c:\windows\system32\DRIVERS\wg111v2.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 1:16 PM 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/07/2010 9:00 PM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/07/2010 9:00 PM 136176]
S4 PuranDefrag;PuranDefrag;c:\windows\system32\PuranDefragS.exe [24/12/2010 2:44 PM 229376]
S4 SeagateDashboardService;Seagate Dashboard Service;c:\program files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [7/07/2010 5:32 AM 14088]
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-13 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2011-04-26 07:24]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 10:59]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 10:59]
.
2011-07-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 05:39]
.
2011-07-13 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 05:39]
.
2011-07-13 c:\windows\Tasks\User_Feed_Synchronization-{10E034B1-B71A-4087-9E07-C1D0A21684BB}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:31]
.
2011-07-13 c:\windows\Tasks\User_Feed_Synchronization-{52F6F575-AC44-42F4-8EBB-0811180128D0}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 18:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com.au/
uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\documents and settings\Hills\Application Data\Mozilla\Firefox\Profiles\7ostmh8m.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo-FileServe
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
FF - prefs.js: keyword.URL - hxxp://www.google.com.au/
FF - prefs.js: network.proxy.type - 0
FF - user.js: keyword.URL - hxxp://www.google.com.au/
FF - user.js: keyword.enabled - 1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-SiS7012 - c:\progra~1\SiS7012\Uninst\uninst2k.exe PCI\VEN_1039&DEV_7012
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-13 19:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1440)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-07-13 19:50:02 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-13 09:49
.
Pre-Run: 9,932,787,712 bytes free
Post-Run: 9,834,328,064 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - BD5897ADD9451C5AC31FF6811217CD5E