What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

becoolsearch / basic-search.net virus

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This issue just began yesterday. Not sure as to the the cause as I had been away for a couple of days prior and hadn't been on this machine. Anyhow, here's the deal… When i attempt to follow any link in both google and yahoo search results it redirects my browser (IE8) to some unrelated site. In the process it shows that it passed through becoolserch.net (yesterday) or basic-search.net (today). Please help me remove this POS virus from my machine. Also, any idea where this infection may have come from? Thx in advance.
Post #2
Hi,

:welcome:

My name is NoodleTech. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not delete anything unless instructed to.
  • DO NOT use tools such as ComboFix without supervision.
  • Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
===================================================

Infections can come from anywhere. It is hard to say. I might be able to get a better idea of the cause after we run so scans, so let's get to it!

===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments,  attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Scan With RootKitUnHooker

  • Please choose one link and download Rootkit Unhooker and save it to your desktop.
    Link 1
    Link 2
    Link 3
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

===================================================

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
===================================================

In your next post, please include the following:
  • DDS log
  • RootkitUnhooker log
  • MBRCheck log
Post #3
Hey Noodletech, Thx for the help. Sorry for the delay in responding. Here's everything you requested. Thx. . DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by [removed] at 21:16:36 on 2011-07-11 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3572.2360 [GMT -4:00] . AV: McAfee® Security-as-a-Service Anti-virus *Enabled/Updated* {8C354827-2F54-4E28-90DC-AD391E77808C} . ============== Running Processes =============== . C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\drivers\audio\r267815\payload\wdm\stacsv.exe C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe svchost.exe C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe C:\Program Files\Intel\ASF Agent\ASFAgent.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe C:\WINDOWS\system32\mfevtps.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\Program Files\Xobni\XobniService.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\WINDOWS\Explorer.EXE C:\Program Files\WIDCOMM\Bluetooth Software\BtTray.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\DellTPad\Apoint.exe C:\Program Files\IDT\WDM\sttray.exe C:\WINDOWS\system32\AESTFltr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\DellTPad\ApMsgFwd.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\OA001Mon.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe C:\Program Files\Logitech\SetPointP\SetPoint.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe C:\Program Files\Yahoo!\Common\YMailAdvisor.exe C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE c:\program files\real\realplayer\update\realsched.exe C:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Backcountry.com.Toolbar.ShowToolbarBHO: {69abb8e4-3a44-461c-93bc-c3bb6bdf2df3} - mscoree.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110216093015.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile: {d5233fcd-d258-4903-89b8-fb1568e7413d} - mscoree.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: Steepandcheap IE Alert: {f98ba7f6-48d8-4ce7-a8d0-39d13fd6f14f} - mscoree.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" mRun: [Apoint] c:\program files\delltpad\Apoint.exe mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg mRun: [nwiz] nwiz.exe /installquiet mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start mRun: [OA001Mon] c:\windows\OA001Mon.exe mRun: [IAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12 mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe mRun: [SecureUpgrade] c:\program files\wave systems corp\SecureUpgrade.exe mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe" mRun: [DellControlPoint] "c:\program files\dell\dell controlpoint\Dell.ControlPoint.exe" mRun: [DCPstrApp] c:\program files\dell\dell controlpoint\security manager\SecurityDeviceInfoSetRegistryString.exe mRun: [DellConnectionManager] "c:\program files\dell\dell controlpoint\connection manager\Dell.UCM.exe" mRun: [] mRun: [MVS Splash] "c:\program files\mcafee\managed virusscan\desktopui\XTray.exe" mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Act.Outlook.Service] "c:\program files\act\act for windows\Act.Outlook.Service.exe" mRun: [Act! Preloader] "c:\program files\act\act for windows\ActSage.exe" -preload mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe" mRun: [YMailAdvisor] "c:\program files\yahoo!\common\YMailAdvisor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon mRun: [Dell Webcam Central] "c:\program files\dell webcam\dell webcam central\WebcamDell.exe" /mode2 mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot mRun: [cleanddm] c:\documents and settings\jzipkin\application data\cleanddm.exe mRunOnce: [rpbrowserrecordplugin.dll OCX] regsvr32.exe /s "c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellco~1.lnk - c:\program files\dell\dell controlpoint\system manager\DCPSysMgr.exe mPolicies-explorer: NoWelcomeScreen = 1 (0x1) IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth; Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL Trusted Zone: //about.htm/ Trusted Zone: //Exclude.htm/ Trusted Zone: //LanguageSelection.htm/ Trusted Zone: //Message.htm/ Trusted Zone: //MyAgttryCmd.htm/ Trusted Zone: //MyAgttryNag.htm/ Trusted Zone: //MyNotification.htm/ Trusted Zone: //NOCLessUpdate.htm/ Trusted Zone: //quarantine.htm/ Trusted Zone: //ScanNow.htm/ Trusted Zone: //strings.vbs/ Trusted Zone: //Template.htm/ Trusted Zone: //Update.htm/ Trusted Zone: //VirFound.htm/ Trusted Zone: mcafee.com\* Trusted Zone: mcafeeasap.com\betavscan Trusted Zone: mcafeeasap.com\vs Trusted Zone: mcafeeasap.com\www DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1307550125529 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://trimble.webex.com/client/T27L10NSP21/nbr/ieatgpc.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = [removed] [removed] TCP: Interfaces\{BA6AD22C-B751-41C5-A5CD-DA10FCADE06C} : DhcpNameServer = [removed] [removed] Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll Handler: myrm - {4D034FC3-013F-4b95-B544-44D49ABE3E76} - c:\program files\mcafee\managed virusscan\agent\MyRmProt5.0.0.811.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Authentication Packages = msv1_0 wvauth Hosts: 184.107.64.188 www.google.com Hosts: 184.107.64.189 search.yahoo.com Hosts: 184.107.64.189 www.bing.com . ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-7-22 436728] R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-8-12 88544] R2 ASFAgent;ASF Agent;c:\program files\intel\asf agent\ASFAgent.exe [2007-4-19 133968] R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-9-4 406808] R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2008-11-11 808296] R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2008-11-11 20840] R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2008-11-11 451872] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [2010-7-22 13336] R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-7-26 10448] R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\mcafee\siteadvisor enterprise\McSACore.exe [2010-10-15 324928] R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-11-16 159320] R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-11-16 145936] R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408] R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-7-22 291064] R2 RumorServer;McAfee Peer Distribution Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-7-22 291064] R2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2008-10-1 90112] R2 XobniService;XobniService;c:\program files\xobni\XobniService.exe [2010-5-20 55016] R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2010-7-21 113664] R3 CCIDFILTER;Broadcom Smart Card Reader Filter Driver;c:\windows\system32\drivers\ccidflt.sys [2010-7-22 12840] R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2010-7-21 32808] R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2010-7-21 240344] R3 MfeAVFK;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-7-22 171296] R3 MfeBOPK;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-7-22 58456] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-12 85152] R3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [2010-7-21 134144] R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [2010-7-21 133632] R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [2010-7-21 281472] S2 ACT! Scheduler;ACT! Scheduler;c:\program files\act\act for windows\Act.Scheduler.exe [2009-2-24 81920] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-26 136176] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-26 136176] S3 MfeRKDK;McAfee Inc. MfeRKDK;c:\windows\system32\drivers\mferkdk.sys [2010-7-22 34248] S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2009-12-18 20480] S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2009-12-18 174720] S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2010-4-14 32408] S3 TrmbTS;TrmbTS;c:\windows\system32\drivers\TrmbTS.sys [2010-8-26 29184] S3 TRMUSB5K;Trimble USB GPS Driver;c:\windows\system32\drivers\TRMUSB5K.SYS [2010-8-26 9881] S3 USA19H;USA19H;c:\windows\system32\drivers\USA19H2k.sys [2010-8-13 704000] S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\USA19H2kp.sys [2010-8-13 24192] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-22 47128] S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336] S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2010-9-17 370008] . =============== Created Last 30 ================ . 2011-07-08 17:09:14 ——– d—–w- c:\documents and settings\jzipkin\local settings\application data\Trimble Access Installation Manager 2011-07-01 15:17:45 17920 –sh–w- c:\documents and settings\jzipkin\application data\cleanddm.dll 2011-06-29 15:26:03 306688 —-a-w- c:\windows\IsUninst.exe 2011-06-29 15:23:43 ——– d—–w- c:\program files\common files\xing shared 2011-06-29 15:20:31 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . ==================== Find3M ==================== . 2011-07-12 01:13:48 1994 –sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys 2011-06-29 15:23:02 348160 —-a-w- c:\windows\system32\msvcr71.dll 2011-06-29 15:23:01 499712 —-a-w- c:\windows\system32\msvcp71.dll . ============= FINISH: 21:17:36.34 =============== RkU Version: 3.8.389.593, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >Drivers ============================================== 0xB73A7000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 8003584 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 188.40 ) 0xBD012000 C:\WINDOWS\System32\nv4_disp.dll 5922816 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 188.40 ) 0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2154496 bytes 0x804D7000 RAW 2154496 bytes 0x804D7000 WMIxWDM 2154496 bytes 0xBF800000 Win32k 1867776 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1867776 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xB56A2000 C:\WINDOWS\System32\Drivers\dump_iaStor.sys 1789952 bytes 0xB7D50000 iaStor.sys 1789952 bytes (Intel Corporation, Intel Rapid Storage Technology driver - x86) 0xB5BE8000 C:\WINDOWS\system32\drivers\sthda.sys 1593344 bytes (IDT, Inc., IDT PC Audio) 0xB71CF000 C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 1290240 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver) 0xB6F6B000 C:\WINDOWS\system32\DRIVERS\btkrnl.sys 987136 bytes (Broadcom Corporation., Bluetooth Bus Enumerator) 0xB7C11000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0x8CCDA000 C:\WINDOWS\system32\drivers\btaudio.sys 528384 bytes (Broadcom Corporation., Bluetooth Audio Device) 0xB70CF000 C:\WINDOWS\System32\Drivers\wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime) 0xB5985000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xB7CB5000 mfehidk.sys 430080 bytes (McAfee, Inc., McAfee Link Driver) 0xB6DF2000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xB5ACC000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xB38E2000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xBD5B8000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xB5878000 C:\WINDOWS\system32\DRIVERS\OA001Vid.sys 282624 bytes (Creative Technology Ltd., Video Capture Device Driver) 0xB7168000 C:\WINDOWS\system32\DRIVERS\Apfiltr.sys 270336 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver) 0xB26AB000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xB7356000 C:\WINDOWS\system32\DRIVERS\e1y5132.sys 249856 bytes (Intel Corporation, Intel® Gigabit Network Connection NDIS 5.1 deserialized driver) 0xB6DB5000 C:\WINDOWS\system32\DRIVERS\NWADIenum.sys 249856 bytes (Novatel Wireless Inc, NWADI Interface Bus Enumerator) 0xB6EF0000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xB7F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xB3EB1000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xB7BE4000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0x8B4FD000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xB59F5000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xB4239000 C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys 167936 bytes (Wave Systems Corp., WavX Document Manager Filter Driver) 0xB730A000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xB70A7000 C:\WINDOWS\system32\drivers\mfeavfk.sys 163840 bytes (McAfee, Inc., Anti-Virus File System Filter Driver) 0xB5A42000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xB5B58000 C:\WINDOWS\system32\Drivers\OA001Afx.sys 163840 bytes (Creative Technology Ltd., Advanced Audio FX Driver) 0xB7F05000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xB5A6A000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0x8C46F000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xB5B9C000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xB7332000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xB705C000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xB6F48000 C:\WINDOWS\system32\drivers\windrvr6.sys 143360 bytes (Jungo, WinDriver Device Driver 6.03) 0xB5A20000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0xB5857000 C:\WINDOWS\system32\DRIVERS\OA001Ufd.sys 135168 bytes (Creative Technology Ltd., Video Class Upper Filter Driver) 0x806E5000 ACPI_HAL 134528 bytes 0x806E5000 C:\WINDOWS\system32\hal.dll 134528 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xB7D30000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xB7F2B000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0x8B430000 C:\WINDOWS\system32\DRIVERS\btwdndis.sys 122880 bytes (Broadcom Corporation., Bluetooth LAN Access Server Driver) 0xB7F4A000 pcmcia.sys 122880 bytes (Microsoft Corporation, PCMCIA Bus Driver) 0xB5B80000 C:\WINDOWS\system32\drivers\AESTAud.sys 114688 bytes (Andrea Electronics Corporation, Andrea Audio Driver) 0x8B56D000 C:\WINDOWS\system32\drivers\mfeapfk.sys 110592 bytes (McAfee, Inc., Access Protection Filter Driver) 0xB7BCA000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xB7C9E000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xB6F31000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xB401C000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0x8F232000 C:\WINDOWS\system32\drivers\mferkdet.sys 81920 bytes (McAfee, Inc., McAfee Code Analysis Driver) 0xB5A90000 C:\WINDOWS\system32\drivers\mfetdi2k.sys 81920 bytes (McAfee, Inc., Anti-Virus Mini-Firewall Driver) 0xB71BB000 C:\WINDOWS\system32\DRIVERS\sdbus.sys 81920 bytes (Microsoft Corporation, SecureDigital Bus Driver) 0xB7393000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xB5B25000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBD000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xB7D1E000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xB7F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xB6F20000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xB71AA000 C:\WINDOWS\system32\DRIVERS\rimmptsk.sys 69632 bytes (REDC, RICOH SD/MMC Driver) 0xB8188000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xB8208000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xB81C8000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager) 0xB8108000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xB82D8000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client) 0xB82A8000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xB8218000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xB436A000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xB8298000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xB8118000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xB81E8000 C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader) 0x8BA7B000 C:\WINDOWS\system32\DRIVERS\btwhid.sys 53248 bytes (Broadcom Corporation., Bluetooth Virtual HID Minidriver) 0xB80E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xB81D8000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0x8CD5B000 C:\WINDOWS\system32\drivers\mfebopk.sys 53248 bytes (McAfee, Inc., Buffer Overflow Protection Driver) 0xB8238000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xB80C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xB82C8000 C:\WINDOWS\system32\drivers\mfetdik.sys 49152 bytes (McAfee, Inc., Anti-Virus Mini-Firewall Driver) 0xB8258000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xA9789000 C:\WINDOWS\system32\DRIVERS\usbccid.sys 49152 bytes (Microsoft Corporation, USB CCID Driver) 0xAF809000 C:\WINDOWS\System32\Drivers\cvusbdrv.sys 45056 bytes (Broadcom Corporation, Broadcom Credential Vault USB Driver) 0xB82F8000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xB81F8000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xB80B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xB80F8000 PBADRV.sys 45056 bytes (Dell Inc, PBA Support Driver) 0xB8248000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x8D02E000 C:\WINDOWS\System32\Drivers\btwusb.sys 40960 bytes (Broadcom Corporation., Driver for Bluetooth USB Devices) 0xB80A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xB8288000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xB8278000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0x8D2FD000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver) 0xB80D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xB8158000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xB8228000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xB8268000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xB82E8000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xB82B8000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xB83F8000 C:\WINDOWS\system32\DRIVERS\btport.sys 32768 bytes (Broadcom Corporation., Bluetooth BTPORT Driver for Windows 2000) 0x8E97F000 C:\WINDOWS\system32\DRIVERS\btwmodem.sys 32768 bytes (Broadcom Corporation., Bluetooth BTPORT Driver for Windows 2000) 0xB0691000 C:\WINDOWS\system32\DRIVERS\ccidflt.sys 32768 bytes (Broadcom Corporation, ccidflt.sys) 0xB8430000 C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys 32768 bytes (Logitech, Inc., Logitech HID Filter Driver.) 0xB8458000 C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys 32768 bytes (Logitech, Inc., Logitech Mouse Filter Driver.) 0x8E96F000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver) 0xB8348000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xB8470000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xB8380000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xB8490000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xB06B9000 C:\DOCUME~1\jzipkin\LOCALS~1\Temp\mbr.sys 28672 bytes 0xB8418000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xB8408000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xB8350000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xB84A0000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xB84B0000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xB8328000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xB8468000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xB8478000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xB8440000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xB8400000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xB233E000 C:\WINDOWS\system32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver) 0xB84C0000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver) 0xB8580000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0xB5AB8000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xB715C000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xB569E000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xB5AC4000 C:\WINDOWS\system32\DRIVERS\SMCLIB.SYS 16384 bytes (Microsoft Corporation, Smard Card Driver Library) 0xB84C4000 ACPIEC.sys 12288 bytes (Microsoft Corporation, ACPI Embedded Controller Driver) 0xB84B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xB84BC000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0xB5BCC000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xB7B9E000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xB7148000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter) 0xB5AB0000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xB8590000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xB7B9A000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0x8B6C7000 C:\WINDOWS\system32\DRIVERS\sffdisk.sys 12288 bytes (Microsoft Corporation, Small Form Factor Disk Driver) 0xAC10E000 C:\WINDOWS\system32\DRIVERS\sffp_sd.sys 12288 bytes (Microsoft Corporation, Small Form Factor SD Protocol Driver) 0xB8588000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI) 0xB85EC000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xB85E8000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xB85A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xB85F0000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xB85F4000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xB85D4000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xB85E0000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xB85AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xB86F3000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xB871B000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xB87B3000 C:\WINDOWS\System32\Drivers\LBeepKE.sys 4096 bytes (Logitech, Inc., Logitech Consumer Control Filter Driver.) 0xB875D000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xB8670000 C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 4096 bytes (Microsoft Corporation, ACPI Operation Registration Driver) ============================================== >Stealth ============================================== 0x00000038 LDT (IN GDT of Core 1) Modification, Base+0x170, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x86830000 LDT (IN GDT of Core 1) Modification, Base+0xCC0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x86830000 LDT (IN GDT of Core 1) Modification, Base+0xD00, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x80557A90 LDT (IN GDT of Core 1) Modification, Base+0x130, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1] 0x86A18080 LDT (IN GDT of Core 1) Modification, Base+0x400, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x0E611308 LDT (IN GDT of Core 1) Modification, Base+0x620, DPL_USER, Rpl : 0, Type: CallGate32, Core [1] 0x866D0000 LDT (IN GDT of Core 1) Modification, Base+0x868, DPL_USER, Rpl : 0, Type: CallGate32, Core [1] 0x863C6F50 LDT (IN GDT of Core 1) Modification, Base+0xDA0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x861319D8 LDT (IN GDT of Core 1) Modification, Base+0xFC0, DPL_USER, Rpl : 3, Type: CallGate32, Core [1] 0x8C200001 LDT (IN GDT of Core 1) Modification, Base+0x2C0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x86830000 LDT (IN GDT of Core 1) Modification, Base+0xCB0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x86830001 LDT (IN GDT of Core 1) Modification, Base+0xCC0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x865BD338 LDT (IN GDT of Core 1) Modification, Base+0xA10, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x863404D8 LDT (IN GDT of Core 1) Modification, Base+0xBA8, DPL_USER, Rpl : 3, Type: CallGate32, Core [1] 0x0BEB0002 LDT (IN GDT of Core 1) Modification, Base+0x310, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x44A30005 LDT (IN GDT of Core 1) Modification, Base+0x320, DPL_USER, Rpl : 0, Type: CallGate32, Core [1] 0x86A58320 LDT (IN GDT of Core 1) Modification, Base+0xB40, DPL_SYSTEM, Rpl : 2, Type: CallGate32, Core [1] 0x8CFA0001 LDT (IN GDT of Core 1) Modification, Base+0xC10, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x865D85E0 LDT (IN GDT of Core 1) Modification, Base+0xFF0, DPL_USER, Rpl : 2, Type: CallGate32, Core [1] 0x01CB2AD8 LDT (IN GDT of Core 1) Modification, Base+0x430, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0x01CB2AD8 LDT (IN GDT of Core 1) Modification, Base+0x438, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0x01CB2AD8 LDT (IN GDT of Core 1) Modification, Base+0x440, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0x86830000 LDT (IN GDT of Core 1) Modification, Base+0xC60, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x86830000 LDT (IN GDT of Core 1) Modification, Base+0xC70, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x86353CB8 LDT (IN GDT of Core 1) Modification, Base+0x1E0, DPL_USER, Rpl : 1, Type: CallGate32, Core [1] 0x0E614288 LDT (IN GDT of Core 1) Modification, Base+0x3E0, DPL_USER, Rpl : 2, Type: CallGate32, Core [1] 0x860E1F70 LDT (IN GDT of Core 1) Modification, Base+0x680, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [1] 0x86DD0000 LDT (IN GDT of Core 1) Modification, Base+0x860, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x1B76D634 LDT (IN GDT of Core 1) Modification, Base+0x040, DPL_USER, Rpl : 1, Type: CallGate32, Core [1] 0xB6B0420F LDT (IN GDT of Core 1) Modification, Base+0x048, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1] 0xDCAA2A84 LDT (IN GDT of Core 1) Modification, Base+0x230, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [1] 0x869F0005 LDT (IN GDT of Core 1) Modification, Base+0xA40, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x8683ACA0 LDT (IN GDT of Core 1) Modification, Base+0xCA8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x8683AD28 LDT (IN GDT of Core 1) Modification, Base+0xCF0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x86832B90 LDT (IN GDT of Core 1) Modification, Base+0xD30, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0x0000AF8C LDT (IN GDT of Core 1) Modification, Base+0xF98, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [1] 0xE5F98ED2 LDT (IN GDT of Core 1) Modification, Base+0x718, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x86A0FAA8 LDT (IN GDT of Core 1) Modification, Base+0xD80, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x8683CCD8 LDT (IN GDT of Core 1) Modification, Base+0xCE0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x8683CCE0 LDT (IN GDT of Core 1) Modification, Base+0xCE8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x86830000 LDT (IN GDT of Core 1) Modification, Base+0xE48, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x6565616D LDT (IN GDT of Core 1) Modification, Base+0x160, DPL_USER, Rpl : 2, Type: CallGate32, Core [1] 0x2052454E LDT (IN GDT of Core 1) Modification, Base+0x248, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x2052454E LDT (IN GDT of Core 1) Modification, Base+0x3B8, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x38363933 LDT (IN GDT of Core 1) Modification, Base+0x4C0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0x00008C10 LDT (IN GDT of Core 1) Modification, Base+0xDF8, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x00000038 LDT (IN GDT of Core 2) Modification, Base+0x170, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] 0x86830000 LDT (IN GDT of Core 2) Modification, Base+0xCC0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x86830000 LDT (IN GDT of Core 2) Modification, Base+0xD00, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x80557A90 LDT (IN GDT of Core 2) Modification, Base+0x130, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [2] 0x86A18080 LDT (IN GDT of Core 2) Modification, Base+0x400, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] 0x0E611308 LDT (IN GDT of Core 2) Modification, Base+0x620, DPL_USER, Rpl : 0, Type: CallGate32, Core [2] 0x866D0000 LDT (IN GDT of Core 2) Modification, Base+0x868, DPL_USER, Rpl : 0, Type: CallGate32, Core [2] 0x863C6F50 LDT (IN GDT of Core 2) Modification, Base+0xDA0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x861319D8 LDT (IN GDT of Core 2) Modification, Base+0xFC0, DPL_USER, Rpl : 3, Type: CallGate32, Core [2] 0x8C200001 LDT (IN GDT of Core 2) Modification, Base+0x2C0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x86830000 LDT (IN GDT of Core 2) Modification, Base+0xCB0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x86830001 LDT (IN GDT of Core 2) Modification, Base+0xCC0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x865BD338 LDT (IN GDT of Core 2) Modification, Base+0xA10, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x863404D8 LDT (IN GDT of Core 2) Modification, Base+0xBA8, DPL_USER, Rpl : 3, Type: CallGate32, Core [2] 0x0BEB0002 LDT (IN GDT of Core 2) Modification, Base+0x310, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] 0x44A30005 LDT (IN GDT of Core 2) Modification, Base+0x320, DPL_USER, Rpl : 0, Type: CallGate32, Core [2] 0x86A58320 LDT (IN GDT of Core 2) Modification, Base+0xB40, DPL_SYSTEM, Rpl : 2, Type: CallGate32, Core [2] 0x8CFA0001 LDT (IN GDT of Core 2) Modification, Base+0xC10, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x865D85E0 LDT (IN GDT of Core 2) Modification, Base+0xFF0, DPL_USER, Rpl : 2, Type: CallGate32, Core [2] 0x01CB2AD8 LDT (IN GDT of Core 2) Modification, Base+0x430, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [2] 0x01CB2AD8 LDT (IN GDT of Core 2) Modification, Base+0x438, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [2] 0x01CB2AD8 LDT (IN GDT of Core 2) Modification, Base+0x440, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [2] 0x86830000 LDT (IN GDT of Core 2) Modification, Base+0xC60, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] 0x86830000 LDT (IN GDT of Core 2) Modification, Base+0xC70, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] 0x86353CB8 LDT (IN GDT of Core 2) Modification, Base+0x1E0, DPL_USER, Rpl : 1, Type: CallGate32, Core [2] 0x0E614288 LDT (IN GDT of Core 2) Modification, Base+0x3E0, DPL_USER, Rpl : 2, Type: CallGate32, Core [2] 0x860E1F70 LDT (IN GDT of Core 2) Modification, Base+0x680, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [2] 0x86DD0000 LDT (IN GDT of Core 2) Modification, Base+0x860, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] 0x1B76D634 LDT (IN GDT of Core 2) Modification, Base+0x040, DPL_USER, Rpl : 1, Type: CallGate32, Core [2] 0xB6B0420F LDT (IN GDT of Core 2) Modification, Base+0x048, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [2] 0xDCAA2A84 LDT (IN GDT of Core 2) Modification, Base+0x230, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [2] 0x869F0005 LDT (IN GDT of Core 2) Modification, Base+0xA40, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x8683ACA0 LDT (IN GDT of Core 2) Modification, Base+0xCA8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x8683AD28 LDT (IN GDT of Core 2) Modification, Base+0xCF0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x86832B90 LDT (IN GDT of Core 2) Modification, Base+0xD30, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [2] 0x0000AF8C LDT (IN GDT of Core 2) Modification, Base+0xF98, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [2] 0xE5F98ED2 LDT (IN GDT of Core 2) Modification, Base+0x718, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x86A0FAA8 LDT (IN GDT of Core 2) Modification, Base+0xD80, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x8683CCD8 LDT (IN GDT of Core 2) Modification, Base+0xCE0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x8683CCE0 LDT (IN GDT of Core 2) Modification, Base+0xCE8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [2] 0x86830000 LDT (IN GDT of Core 2) Modification, Base+0xE48, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x6565616D LDT (IN GDT of Core 2) Modification, Base+0x160, DPL_USER, Rpl : 2, Type: CallGate32, Core [2] 0x2052454E LDT (IN GDT of Core 2) Modification, Base+0x248, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x2052454E LDT (IN GDT of Core 2) Modification, Base+0x3B8, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [2] 0x38363933 LDT (IN GDT of Core 2) Modification, Base+0x4C0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [2] 0x00008C10 LDT (IN GDT of Core 2) Modification, Base+0xDF8, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [2] MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x03f0800c Kernel Drivers (total 154): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E5000 \WINDOWS\system32\hal.dll 0xB85A8000 \WINDOWS\system32\KDCOM.DLL 0xB84B8000 \WINDOWS\system32\BOOTVID.dll 0xB7F79000 ACPI.sys 0xB85AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xB7F68000 pci.sys 0xB80A8000 isapnp.sys 0xB84BC000 compbatt.sys 0xB84C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS 0xB7F4A000 pcmcia.sys 0xB80B8000 MountMgr.sys 0xB7F2B000 ftdisk.sys 0xB7F05000 dmio.sys 0xB8328000 PartMgr.sys 0xB84C4000 ACPIEC.sys 0xB8670000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 0xB80C8000 VolSnap.sys 0xB7D50000 iaStor.sys 0xB80D8000 disk.sys 0xB80E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xB7D30000 fltMgr.sys 0xB7D1E000 sr.sys 0xB7CB5000 mfehidk.sys 0xB7C9E000 KSecDD.sys 0xB7C11000 Ntfs.sys 0xB7BE4000 NDIS.sys 0xB80F8000 PBADRV.sys 0xB8108000 ohci1394.sys 0xB8118000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xB7BCA000 Mup.sys 0xB73A7000 \SystemRoot\system32\DRIVERS\nv4_mini.sys 0xB7393000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xB7356000 \SystemRoot\system32\DRIVERS\e1y5132.sys 0xB8350000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xB7332000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xB8380000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xB730A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xB71CF000 \SystemRoot\system32\DRIVERS\bcmwl5.sys 0xB81C8000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xB71BB000 \SystemRoot\system32\DRIVERS\sdbus.sys 0xB71AA000 \SystemRoot\system32\DRIVERS\rimmptsk.sys 0xB81D8000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xB7168000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0xB81E8000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS 0xB70CF000 \SystemRoot\System32\Drivers\wdf01000.sys 0xB70A7000 \SystemRoot\system32\drivers\mfeavfk.sys 0xB8408000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xB8418000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xB81F8000 \SystemRoot\system32\DRIVERS\imapi.sys 0xB8208000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xB8218000 \SystemRoot\system32\DRIVERS\redbook.sys 0xB705C000 \SystemRoot\system32\DRIVERS\ks.sys 0xB8580000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0xB8588000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0xB8228000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xB6F6B000 \SystemRoot\system32\DRIVERS\btkrnl.sys 0xB6F48000 \SystemRoot\system32\drivers\windrvr6.sys 0xB86F3000 \SystemRoot\system32\DRIVERS\audstub.sys 0xB8238000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xB8590000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xB6F31000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xB8248000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xB8258000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xB8440000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xB6F20000 \SystemRoot\system32\DRIVERS\psched.sys 0xB8268000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xB8468000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xB8478000 \SystemRoot\system32\DRIVERS\raspti.sys 0xB6EF0000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xB8278000 \SystemRoot\system32\DRIVERS\termdd.sys 0xB85D4000 \SystemRoot\system32\DRIVERS\swenum.sys 0xB6DF2000 \SystemRoot\system32\DRIVERS\update.sys 0xB715C000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xB6DB5000 \SystemRoot\system32\DRIVERS\NWADIenum.sys 0xB83F8000 \SystemRoot\system32\DRIVERS\btport.sys 0xB8288000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xB8298000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xB85E0000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xB5BE8000 \SystemRoot\system32\drivers\sthda.sys 0xB5B9C000 \SystemRoot\system32\drivers\portcls.sys 0xB82A8000 \SystemRoot\system32\drivers\drmk.sys 0xB5B80000 \SystemRoot\system32\drivers\AESTAud.sys 0xB5B58000 \??\C:\WINDOWS\system32\Drivers\OA001Afx.sys 0xB7148000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xB85E8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xB875D000 \SystemRoot\System32\Drivers\Null.SYS 0xB85EC000 \SystemRoot\System32\Drivers\Beep.SYS 0xB8490000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xB84A0000 \SystemRoot\System32\drivers\vga.sys 0xB85F0000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xB85F4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xB84B0000 \SystemRoot\System32\Drivers\Msfs.SYS 0xB8348000 \SystemRoot\System32\Drivers\Npfs.SYS 0xB7B9A000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xB5B25000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xB5ACC000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xB5A90000 \SystemRoot\system32\drivers\mfetdi2k.sys 0xB5A6A000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xB82B8000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xB82C8000 \SystemRoot\system32\drivers\mfetdik.sys 0xB82D8000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xB5A42000 \SystemRoot\system32\DRIVERS\netbt.sys 0xB5A20000 \SystemRoot\System32\drivers\afd.sys 0xB82E8000 \SystemRoot\system32\DRIVERS\netbios.sys 0xB59F5000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xB5985000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xB82F8000 \SystemRoot\System32\Drivers\Fips.SYS 0xB8470000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xB7B9E000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xB8158000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xB5AC4000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS 0xB8188000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xB5878000 \SystemRoot\system32\DRIVERS\OA001Vid.sys 0xB5857000 \SystemRoot\system32\DRIVERS\OA001Ufd.sys 0xB5AB8000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xB5AB0000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xB8430000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys 0xB8458000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys 0xB56A2000 \SystemRoot\System32\Drivers\dump_iaStor.sys 0xBF800000 \SystemRoot\System32\win32k.sys 0xB5BCC000 \SystemRoot\System32\drivers\Dxapi.sys 0xB8400000 \SystemRoot\System32\watchdog.sys 0xBD000000 \SystemRoot\System32\drivers\dxg.sys 0xB871B000 \SystemRoot\System32\drivers\dxgthk.sys 0xBD012000 \SystemRoot\System32\nv4_disp.dll 0xBD5B8000 \SystemRoot\System32\ATMFD.DLL 0xB4239000 \SystemRoot\system32\DRIVERS\WavxDMgr.sys 0xB569E000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xB401C000 \SystemRoot\system32\drivers\wdmaud.sys 0xB436A000 \SystemRoot\system32\drivers\sysaudio.sys 0xB3EB1000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB87B3000 \SystemRoot\System32\Drivers\LBeepKE.sys 0xB38E2000 \SystemRoot\system32\DRIVERS\srv.sys 0xB26AB000 \SystemRoot\System32\Drivers\HTTP.sys 0xB233E000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0x8C46F000 \SystemRoot\System32\Drivers\Fastfat.SYS 0x8F232000 \SystemRoot\system32\drivers\mferkdet.sys 0xAC10E000 \SystemRoot\system32\DRIVERS\sffp_sd.sys 0x8B6C7000 \SystemRoot\system32\DRIVERS\sffdisk.sys 0xB06B9000 \??\C:\DOCUME~1\jzipkin\LOCALS~1\Temp\mbr.sys 0x8CD4B000 \SystemRoot\System32\Drivers\cvusbdrv.sys 0x8C3D7000 \SystemRoot\system32\DRIVERS\usbccid.sys 0xB8360000 \SystemRoot\system32\DRIVERS\ccidflt.sys 0x8BDDF000 \SystemRoot\system32\drivers\mfeapfk.sys 0x8BD52000 \SystemRoot\system32\drivers\kmixer.sys 0x8E927000 \SystemRoot\system32\drivers\mfebopk.sys 0x8E80C000 \SystemRoot\System32\Drivers\btwusb.sys 0x8B78B000 \SystemRoot\system32\DRIVERS\btwdndis.sys 0xB0689000 \SystemRoot\system32\DRIVERS\btwmodem.sys 0xB84A8000 \SystemRoot\System32\Drivers\Modem.SYS 0x8ECE1000 \SystemRoot\system32\drivers\btaudio.sys 0x8B62A000 \SystemRoot\system32\DRIVERS\btwhid.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 84): 0 System Idle Process 4 System 912 C:\WINDOWS\system32\smss.exe 976 csrss.exe 1008 C:\WINDOWS\system32\winlogon.exe 1056 C:\WINDOWS\system32\services.exe 1068 C:\WINDOWS\system32\lsass.exe 1256 C:\WINDOWS\system32\nvsvc32.exe 1288 C:\WINDOWS\system32\svchost.exe 1360 svchost.exe 1504 C:\WINDOWS\system32\svchost.exe 1620 svchost.exe 1732 svchost.exe 1988 C:\WINDOWS\system32\spoolsv.exe 2028 C:\drivers\audio\R267815\payload\WDM\stacsv.exe 248 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe 276 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe 332 scardsvr.exe 580 svchost.exe 752 C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe 904 wmiprvse.exe 480 C:\Program Files\Intel\ASF Agent\ASFAgent.exe 692 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 712 C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe 772 C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe 1852 C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe 1484 C:\Program Files\Java\jre6\bin\jqs.exe 2088 C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe 2436 C:\WINDOWS\system32\mfevtps.exe 2456 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe 2488 sqlservr.exe 2600 C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe 2628 C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe 2648 myAgtSvc.exe 2820 sqlbrowser.exe 2896 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 2912 C:\WINDOWS\system32\svchost.exe 2964 C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe 3068 C:\Program Files\Xobni\XobniService.exe 3412 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 3444 C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe 2132 alg.exe 3596 mfeann.exe 3188 C:\WINDOWS\explorer.exe 2732 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe 3832 C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE 3052 C:\Program Files\DellTPad\Apoint.exe 1232 C:\Program Files\IDT\WDM\sttray.exe 2016 C:\WINDOWS\system32\AESTFltr.exe 2512 C:\WINDOWS\system32\rundll32.exe 3564 C:\Program Files\DellTPad\ApMsgFwd.exe 588 C:\WINDOWS\system32\rundll32.exe 848 C:\WINDOWS\OA001Mon.exe 2740 C:\Program Files\DellTPad\hidfind.exe 2404 C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe 628 C:\Program Files\DellTPad\ApntEx.exe 280 C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe 1332 C:\Program Files\Wave Systems Corp\SecureUpgrade.exe 3816 C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe 3920 C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe 144 C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe 296 C:\Program Files\Logitech\SetPointP\SetPoint.exe 476 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2996 C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe 3388 C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe 360 C:\Program Files\Yahoo!\Common\YMailAdvisor.exe 3584 C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe 4388 C:\WINDOWS\system32\ctfmon.exe 4444 C:\Program Files\Microsoft ActiveSync\wcescomm.exe 4652 C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe 4944 C:\PROGRA~1\MI3AA1~1\rapimgr.exe 5048 C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe 7904 C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE 4684 C:\WINDOWS\system32\notepad.exe 3736 C:\Program Files\real\realplayer\Update\realsched.exe 9492 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE 5120 C:\Program Files\Internet Explorer\iexplore.exe 6120 C:\Program Files\Internet Explorer\iexplore.exe 4852 C:\Program Files\Internet Explorer\iexplore.exe 3192 C:\Program Files\Internet Explorer\iexplore.exe 4604 C:\Program Files\Internet Explorer\iexplore.exe 5112 C:\Program Files\Internet Explorer\iexplore.exe 2588 C:\Program Files\Internet Explorer\iexplore.exe 5444 C:\Documents and Settings\jzipkin\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000 (NTFS) PhysicalDrive0 Model Number: ST9160314AS, Rev: D005DEM1 Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979 Done!

Attachments:

Post #4
No problem.


Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
===================================================

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image] 

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #6
yes i do. sorry but i've been working late every night and have had no patience for battling malware once i get home. will post results this weekend. thx for your help, and persistance.
Post #8
thx for your patience. Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7226 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 7/21/2011 10:58:33 PM mbam-log-2011-07-21 (22-58-33).txt Scan type: Quick scan Objects scanned: 279936 Time elapsed: 18 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Combofix was unsuccessful. It kept reporting that some file wasn't found or was invalid. Suggestions? Thx.
Post #9
Hi SuMMiT, Delete Combofix from your desktop and download it from one of the two links again. Let me know if that works.
Post #10
got it! thx. here's the combofix log:

ComboFix 11-07-25.02 - JZipkin 07/25/2011 10:38:58.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3572.2977 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee® Security-as-a-Service Anti-virus *Disabled/Updated* {8C354827-2F54-4E28-90DC-AD391E77808C}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\jzipkin.WAYPOINT\WINDOWS
c:\documents and settings\jzipkin\WINDOWS
c:\program files\explorer
c:\windows\Temp\tmp3.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-06-25 to 2011-07-25 )))))))))))))))))))))))))))))))
.
.
2011-07-12 05:18 . 2011-07-12 05:20 ——– d—–w- c:\program files\Free Internet Window Washer
2011-07-12 03:55 . 2011-07-12 03:55 ——– d—–w- c:\documents and settings\JZipkin\Application Data\Malwarebytes
2011-07-12 03:54 . 2011-07-06 23:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-12 03:54 . 2011-07-12 03:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-07-12 03:54 . 2011-07-06 23:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-12 03:54 . 2011-07-22 02:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-07-08 17:09 . 2011-07-08 17:09 ——– d—–w- c:\documents and settings\JZipkin\Local Settings\Application Data\Trimble Access Installation Manager
2011-06-29 15:26 . 1998-10-29 21:45 306688 —-a-w- c:\windows\IsUninst.exe
2011-06-29 15:23 . 2011-06-29 15:23 ——– d—–w- c:\program files\Common Files\xing shared
2011-06-29 15:20 . 2011-06-29 15:20 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-25 13:46 . 2010-07-26 18:14 1994 –sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2011-07-22 03:57 . 2010-07-23 18:20 0 —-a-w- c:\documents and settings\JZipkin\Local Settings\Application Data\WavXMapDrive.bat
2011-06-29 15:23 . 2006-12-24 04:11 348160 —-a-w- c:\windows\system32\msvcr71.dll
2011-06-29 15:23 . 2006-12-24 04:11 499712 —-a-w- c:\windows\system32\msvcp71.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-02-17 278528]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-04-05 495708]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2010-04-05 737280]
"nwiz"="nwiz.exe" [2009-12-15 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-15 13770752]
"NVHotkey"="nvHotkey.dll" [2009-12-15 86016]
"OA001Mon"="c:\windows\OA001Mon.exe" [2010-01-28 24576]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-05-30 180224]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-05-14 105472]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-06-24 243000]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-06-24 79160]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2008-08-18 598016]
"DCPstrApp"="c:\program files\Dell\Dell ControlPoint\Security Manager\SecurityDeviceInfoSetRegistryString.exe" [2008-08-04 6656]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2008-10-01 1454080]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-01-25 476480]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Act.Outlook.Service"="c:\program files\ACT\Act for Windows\Act.Outlook.Service.exe" [2009-02-24 28672]
"Act! Preloader"="c:\program files\ACT\Act for Windows\ActSage.exe" [2009-02-24 393216]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-01-31 38840]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-22 640440]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-10-17 442536]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-06-29 273544]
.
c:\documents and settings\McAfeeMVSUser\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [N/A]
.
c:\documents and settings\ataylor.WAYPOINT.000\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-8-15 604776]
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2008-11-11 950048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 —-a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\ACT\\Act for Windows\\ActSage.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [8/12/2010 2:55 PM 88544]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 6:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [9/4/2008 6:28 PM 406808]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [11/11/2008 5:35 PM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [11/11/2008 5:35 PM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [11/11/2008 4:00 PM 451872]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [7/22/2010 1:13 PM 13336]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [7/26/2010 11:19 AM 10448]
R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [10/15/2010 3:44 PM 324928]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11/16/2010 10:37 AM 145936]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [12/10/2010 6:29 PM 29293408]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [7/22/2010 2:25 PM 291064]
R2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [7/22/2010 2:25 PM 291064]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [10/1/2008 5:28 AM 90112]
R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/20/2010 1:46 PM 55016]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [7/21/2010 5:25 PM 113664]
R3 CCIDFILTER;Broadcom Smart Card Reader Filter Driver;c:\windows\system32\drivers\ccidflt.sys [7/22/2010 1:11 PM 12840]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [7/21/2010 5:27 PM 32808]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [7/21/2010 5:25 PM 240344]
R3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [7/21/2010 5:25 PM 134144]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [7/21/2010 5:25 PM 133632]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [7/21/2010 5:25 PM 281472]
S2 ACT! Scheduler;ACT! Scheduler;c:\program files\ACT\Act for Windows\Act.Scheduler.exe [2/24/2009 2:08 PM 81920]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [8/12/2010 2:55 PM 85152]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [12/18/2009 12:13 PM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [12/18/2009 12:12 PM 174720]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 TrmbTS;TrmbTS;c:\windows\system32\drivers\TrmbTS.sys [8/26/2010 12:49 PM 29184]
S3 TRMUSB5K;Trimble USB GPS Driver;c:\windows\system32\drivers\TRMUSB5K.SYS [8/26/2010 12:49 PM 9881]
S3 USA19H;USA19H;c:\windows\system32\drivers\USA19H2k.sys [8/13/2010 3:56 PM 704000]
S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\USA19H2kp.sys [8/13/2010 3:56 PM 24192]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 12:16 PM 14336]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/22/2009 11:08 PM 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [3/30/2009 3:09 AM 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [9/17/2010 10:14 AM 370008]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2011-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2011-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2011-07-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-07-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.0.0.11
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-MVS - c:\progra~1\McAfee\MANAGE~1\Agent\myinx
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-25 10:44
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1016)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Completion time: 2011-07-25 10:45:42
ComboFix-quarantined-files.txt 2011-07-25 14:45
.
Pre-Run: 117,572,218,880 bytes free
Post-Run: 118,286,852,096 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 1C9D45A5218057DFD7F1CD8858AAD1A4
Post #13
Yep it looks clean. Let's confirm this.

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start.  The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button.  The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.
Post #14
that must be one serious scanner. took over an hour to run. anyhow, seems like i'm clean. here's the log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=8cc05ef9cf0e39448607e887e19a9b70 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-07-27 06:18:33 # local_time=2011-07-27 02:18:33 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=97668 # found=0 # cleaned=0 # scan_time=3569 Anything else I should do to confirm or are we good?
Post #15
Looks great! Now let's clean up the tools we used.

Please delete DDS, RootkitUnhooker, and MBRCheck from your desktop.

Next, follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

===================================================

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 26.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u26-windows-i586-p.exe to install the newest version.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are three options in the window to clear the cache - Leave all 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.
===================================================

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

===================================================

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.


Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.


SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop

WOT has an add-on available for both Firefox and IE.


  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.
Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically. 

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so. 

**Please respond this one more time to ensure it is resolved and close this topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI