What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC Infected / Malware

318 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #61
CatByte

Thanks for your continuous help and latest set of instructions. Yes we have made good progress and pc is starting up ok and there are no problems with internet connection or to download to desktop, cut & paste, etc. THANK YOU.

Followed your instructions and the reports from the following can be found below:

* GrantPerms - Perms.txt
* TDSSKiller log
* ComboFix log

However, with regards the TDSSKiller process, I did not get the 'Continue > Reboot now' and had to do this manually. The log was were you said it would be under C:\

I also have trouble in shutting down pc. I think the problem is with a 'Status' box I'm getting which states the following:

Status
The feature you are trying to use is on a cd-rom or other removable disk that is not available. Insert the 'status' disk and click ok.
Use Source [ 1 ] [OK] [cancel] [browse]

This box does not go away whatever you click. Another 'Status' box also appear which attempts to run some windows installer, however, it never completes. Boxes remain on desktop.

Also upon starting pc I get the following box:

Warning
Please reinstall/update the display driver and program
[ok]


Just giving you all the information I have. Don't know if it is useful.

Thanks again.

Pete


LOGS

GrantPerms by Farbar
Ran by [removed] at 2011-10-03 19:30:53

===============================================
\\?\c:\\Documents and Settings\Owner\Desktop\aswMBR.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Documents and Settings\Owner\My Documents\Downloads\autoruns(2).exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Documents and Settings\Owner\My Documents\Downloads\autoruns(3).exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Documents and Settings\Owner\My Documents\Downloads\autoruns(4).exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Documents and Settings\Owner\My Documents\Downloads\autoruns(5).exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Documents and Settings\Owner\My Documents\Downloads\autoruns.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\Ad-Aware\Ad-Aware.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\AVG\AVG8\avgcsrvx.exe.vir

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\AVG\AVG8\avgtray.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\AVG\AVG8\avgui.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\Lavasoft\Ad-Aware\AAWService.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\Trend Micro\HijackThis\HijackThis.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\Trusteer\Rapport\bin\RapportService.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\Qoobox\BackEnv

Owner: BUILTIN\Administrators

DACL(NP)(AI):
BUILTIN\Administrators FULL ALLOW (CI)(OI)(I)
NT AUTHORITY\SYSTEM FULL ALLOW (CI)(OI)(I)
CREATOR OWNER FULL ALLOW (CI)(OI)(IO)(I)
BUILTIN\Users READ/EXECUTE ALLOW (CI)(OI)(I)
BUILTIN\Users ADD SUBDIRECTORY ALLOW (CI)(I)
BUILTIN\Users ADD FILE ALLOW (CI)(I)


\\?\c:\\WINDOWS\assembly\GAC_MSIL\123.xxx.vir

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


\\?\c:\\WINDOWS\assembly\GAC_MSIL\Desktop.ini.vir

Owner: BUILTIN\Administrators

DACL(P)(AI):
BUILTIN\Administrators FULL ALLOW (NI)
NT AUTHORITY\SYSTEM FULL ALLOW (NI)
BUILTIN\Users READ/EXECUTE ALLOW (NI)


19:34:01.0546 1880 TDSS rootkit removing tool 2.6.4.0 Oct 3 2011 17:37:01
19:34:02.0109 1880 ============================================================
19:34:02.0109 1880 Current date / time: 2011/10/03 19:34:02.0109
19:34:02.0109 1880 SystemInfo:
19:34:02.0109 1880
19:34:02.0109 1880 OS Version: 5.1.2600 ServicePack: 3.0
19:34:02.0109 1880 Product type: Workstation
19:34:02.0109 1880 ComputerName: YOUR-OYHMBPEOOX
19:34:02.0109 1880 UserName: Owner
19:34:02.0109 1880 Windows directory: C:\WINDOWS
19:34:02.0109 1880 System windows directory: C:\WINDOWS
19:34:02.0109 1880 Processor architecture: Intel x86
19:34:02.0109 1880 Number of processors: 2
19:34:02.0109 1880 Page size: 0x1000
19:34:02.0109 1880 Boot type: Normal boot
19:34:02.0109 1880 ============================================================
19:34:04.0250 1880 Initialize success
19:34:06.0718 0380 ============================================================
19:34:06.0718 0380 Scan started
19:34:06.0718 0380 Mode: Manual;
19:34:06.0718 0380 ============================================================
19:34:16.0000 0380 Abiosdsk - ok
19:34:16.0250 0380 abp480n5 - ok
19:34:16.0828 0380 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
19:34:16.0906 0380 ACPI - ok
19:34:17.0109 0380 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
19:34:17.0125 0380 ACPIEC - ok
19:34:17.0343 0380 ADIHdAudAddService (6a4e4e2cd491b3a11853130cf98acfb9) C:\WINDOWS\system32\drivers\ADIHdAud.sys
19:34:17.0390 0380 ADIHdAudAddService - ok
19:34:17.0578 0380 adpu160m - ok
19:34:17.0968 0380 AEAudioService (9f59ae2de835641fbb0c6afd80d8fa9b) C:\WINDOWS\system32\drivers\AEAudio.sys
19:34:18.0000 0380 AEAudioService - ok
19:34:18.0296 0380 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
19:34:18.0359 0380 aec - ok
19:34:18.0734 0380 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
19:34:18.0765 0380 AFD - ok
19:34:19.0093 0380 Aha154x - ok
19:34:19.0187 0380 aic78u2 - ok
19:34:19.0281 0380 aic78xx - ok
19:34:19.0484 0380 AliIde - ok
19:34:19.0640 0380 amsint - ok
19:34:19.0906 0380 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
19:34:19.0937 0380 Arp1394 - ok
19:34:20.0140 0380 asc - ok
19:34:20.0281 0380 asc3350p - ok
19:34:20.0468 0380 asc3550 - ok
19:34:20.0734 0380 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
19:34:20.0750 0380 AsyncMac - ok
19:34:21.0046 0380 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
19:34:21.0046 0380 atapi - ok
19:34:21.0203 0380 Atdisk - ok
19:34:21.0375 0380 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
19:34:21.0406 0380 Atmarpc - ok
19:34:21.0687 0380 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
19:34:21.0703 0380 audstub - ok
19:34:22.0015 0380 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
19:34:22.0171 0380 AvgLdx86 - ok
19:34:22.0437 0380 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
19:34:22.0453 0380 AvgMfx86 - ok
19:34:22.0687 0380 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
19:34:22.0718 0380 AvgTdiX - ok
19:34:22.0906 0380 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
19:34:22.0921 0380 Beep - ok
19:34:23.0015 0380 catchme - ok
19:34:23.0343 0380 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
19:34:23.0359 0380 cbidf2k - ok
19:34:23.0500 0380 cd20xrnt - ok
19:34:23.0750 0380 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
19:34:23.0765 0380 Cdaudio - ok
19:34:24.0015 0380 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
19:34:24.0031 0380 Cdfs - ok
19:34:24.0281 0380 cdrbsdrv (351735695e9ead93de6af85d8beb1ca8) C:\WINDOWS\system32\drivers\cdrbsdrv.sys
19:34:24.0296 0380 cdrbsdrv - ok
19:34:24.0750 0380 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
19:34:24.0750 0380 Cdrom - ok
19:34:24.0812 0380 Changer - ok
19:34:24.0921 0380 CmdIde - ok
19:34:25.0234 0380 Cpqarray - ok
19:34:25.0437 0380 ctsfm2k (8db84de3aab34a8b4c2f644eff41cd76) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys
19:34:25.0468 0380 ctsfm2k - ok
19:34:25.0531 0380 dac2w2k - ok
19:34:25.0609 0380 dac960nt - ok
19:34:25.0671 0380 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
19:34:25.0687 0380 Disk - ok
19:34:25.0937 0380 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
19:34:26.0187 0380 dmboot - ok
19:34:26.0687 0380 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
19:34:26.0718 0380 dmio - ok
19:34:27.0046 0380 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
19:34:27.0062 0380 dmload - ok
19:34:27.0312 0380 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
19:34:27.0328 0380 DMusic - ok
19:34:27.0562 0380 dpti2o - ok
19:34:27.0734 0380 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
19:34:27.0765 0380 drmkaud - ok
19:34:28.0015 0380 E1000 (73c0eef62ad50c7ff7a4b1ec9321af9f) C:\WINDOWS\system32\DRIVERS\e1000325.sys
19:34:28.0078 0380 E1000 - ok
19:34:28.0328 0380 ENTECH - ok
19:34:28.0562 0380 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
19:34:28.0609 0380 Fastfat - ok
19:34:28.0843 0380 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
19:34:28.0859 0380 Fdc - ok
19:34:29.0015 0380 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
19:34:29.0031 0380 Fips - ok
19:34:29.0171 0380 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
19:34:29.0187 0380 Flpydisk - ok
19:34:29.0406 0380 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
19:34:29.0437 0380 FltMgr - ok
19:34:29.0609 0380 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
19:34:29.0640 0380 Fs_Rec - ok
19:34:29.0968 0380 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
19:34:29.0984 0380 Ftdisk - ok
19:34:30.0296 0380 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\drivers\gearaspiwdm.sys
19:34:30.0312 0380 GEARAspiWDM - ok
19:34:30.0609 0380 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
19:34:30.0640 0380 Gpc - ok
19:34:30.0906 0380 HdAudAddService (9131ede087af04a7d80f7ebadc164254) C:\WINDOWS\system32\drivers\HdAudio.sys
19:34:30.0968 0380 HdAudAddService - ok
19:34:31.0343 0380 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
19:34:31.0359 0380 HDAudBus - ok
19:34:31.0703 0380 hpn - ok
19:34:31.0921 0380 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
19:34:31.0953 0380 HPZid412 - ok
19:34:32.0406 0380 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
19:34:32.0484 0380 HPZipr12 - ok
19:34:32.0812 0380 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
19:34:32.0859 0380 HPZius12 - ok
19:34:33.0250 0380 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
19:34:33.0296 0380 HTTP - ok
19:34:33.0609 0380 i2omgmt - ok
19:34:33.0937 0380 i2omp - ok
19:34:34.0265 0380 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
19:34:34.0281 0380 i8042prt - ok
19:34:34.0640 0380 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
19:34:34.0656 0380 Imapi - ok
19:34:34.0937 0380 ini910u - ok
19:34:35.0890 0380 IntcAzAudAddService (1b3d60fab88ba7fa5d8c515870b43f73) C:\WINDOWS\system32\drivers\RtkHDAud.sys
19:34:37.0140 0380 IntcAzAudAddService - ok
19:34:37.0859 0380 IntelC51 (874db5e07fe2a7f1b22f7c760736f6f4) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
19:34:38.0640 0380 IntelC51 - ok
19:34:39.0187 0380 IntelC52 (4c0f190119ebc5ce728c9d060d8ae3e7) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
19:34:39.0546 0380 IntelC52 - ok
19:34:39.0937 0380 IntelC53 (85b36bc9e8fa579c64de88ffececce6c) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
19:34:39.0984 0380 IntelC53 - ok
19:34:40.0437 0380 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
19:34:40.0453 0380 IntelIde - ok
19:34:40.0906 0380 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
19:34:40.0921 0380 intelppm - ok
19:34:41.0375 0380 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
19:34:41.0406 0380 Ip6Fw - ok
19:34:41.0937 0380 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
19:34:41.0968 0380 IpFilterDriver - ok
19:34:42.0500 0380 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
19:34:42.0531 0380 IpInIp - ok
19:34:43.0156 0380 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
19:34:43.0296 0380 IpNat - ok
19:34:43.0843 0380 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
19:34:43.0875 0380 IPSec - ok
19:34:44.0312 0380 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
19:34:44.0328 0380 IRENUM - ok
19:34:44.0921 0380 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
19:34:44.0937 0380 isapnp - ok
19:34:45.0359 0380 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
19:34:45.0390 0380 Kbdclass - ok
19:34:45.0875 0380 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
19:34:45.0906 0380 kmixer - ok
19:34:46.0453 0380 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
19:34:46.0453 0380 KSecDD - ok
19:34:46.0671 0380 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
19:34:46.0687 0380 Lavasoft Kernexplorer - ok
19:34:47.0046 0380 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
19:34:47.0062 0380 Lbd - ok
19:34:47.0359 0380 lbrtfdc - ok
19:34:47.0890 0380 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
19:34:47.0921 0380 mnmdd - ok
19:34:48.0343 0380 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
19:34:48.0359 0380 Modem - ok
19:34:48.0734 0380 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
19:34:48.0750 0380 MODEMCSA - ok
19:34:49.0234 0380 mohfilt (f2cc6273e7de087dc0fd701f753461ca) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
19:34:49.0328 0380 mohfilt - ok
19:34:49.0906 0380 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
19:34:49.0906 0380 Mouclass - ok
19:34:50.0406 0380 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
19:34:50.0437 0380 MountMgr - ok
19:34:50.0781 0380 mraid35x - ok
19:34:51.0390 0380 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
19:34:51.0484 0380 MRxDAV - ok
19:34:52.0031 0380 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
19:34:52.0062 0380 Msfs - ok
19:34:52.0562 0380 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
19:34:52.0562 0380 MSKSSRV - ok
19:34:53.0031 0380 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
19:34:53.0046 0380 MSPCLOCK - ok
19:34:53.0312 0380 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
19:34:53.0312 0380 MSPQM - ok
19:34:53.0687 0380 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
19:34:53.0703 0380 mssmbios - ok
19:34:54.0234 0380 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
19:34:54.0250 0380 MTsensor - ok
19:34:54.0656 0380 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
19:34:54.0656 0380 Mup - ok
19:34:55.0062 0380 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
19:34:55.0171 0380 NDIS - ok
19:34:55.0593 0380 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
19:34:55.0593 0380 NdisTapi - ok
19:34:56.0109 0380 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
19:34:56.0140 0380 Ndisuio - ok
19:34:56.0578 0380 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
19:34:56.0609 0380 NdisWan - ok
19:34:57.0156 0380 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
19:34:57.0156 0380 NDProxy - ok
19:34:57.0656 0380 NEOFLTR_530_10641 (60b289e60ce9fed0f453476b863c0ff4) C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS
19:34:57.0734 0380 NEOFLTR_530_10641 - ok
19:34:58.0296 0380 NEOFLTR_620_14085 (342e99e06e059f1a2456e39da1f661b0) C:\WINDOWS\system32\Drivers\NEOFLTR_620_14085.SYS
19:34:58.0328 0380 NEOFLTR_620_14085 - ok
19:34:58.0875 0380 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
19:34:59.0015 0380 NetBT - ok
19:34:59.0562 0380 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
19:34:59.0593 0380 NIC1394 - ok
19:35:00.0250 0380 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
19:35:00.0265 0380 Npfs - ok
19:35:00.0953 0380 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
19:35:01.0375 0380 Ntfs - ok
19:35:02.0015 0380 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
19:35:02.0031 0380 Null - ok
19:35:09.0156 0380 nv (6733e80a193fc36f41c24142b0c45c0e) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
19:35:17.0546 0380 nv - ok
19:35:17.0984 0380 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
19:35:18.0031 0380 NwlnkFlt - ok
19:35:18.0437 0380 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
19:35:18.0453 0380 NwlnkFwd - ok
19:35:19.0421 0380 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
19:35:19.0625 0380 NwlnkIpx - ok
19:35:20.0109 0380 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
19:35:20.0140 0380 NwlnkNb - ok
19:35:20.0562 0380 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
19:35:20.0578 0380 NwlnkSpx - ok
19:35:21.0015 0380 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
19:35:21.0046 0380 ohci1394 - ok
19:35:21.0453 0380 ossrv (103a9b117a7d9903111955cdafe65ac6) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys
19:35:21.0468 0380 ossrv - ok
19:35:22.0203 0380 P17 (df886ffed69aead0cf608b89b18c3f6f) C:\WINDOWS\system32\drivers\P17.sys
19:35:22.0843 0380 P17 - ok
19:35:23.0359 0380 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
19:35:23.0437 0380 Parport - ok
19:35:24.0062 0380 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
19:35:24.0078 0380 PartMgr - ok
19:35:24.0687 0380 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
19:35:24.0687 0380 ParVdm - ok
19:35:25.0140 0380 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
19:35:25.0156 0380 PCI - ok
19:35:25.0625 0380 PCIDump - ok
19:35:26.0218 0380 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
19:35:26.0218 0380 PCIIde - ok
19:35:26.0718 0380 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
19:35:26.0812 0380 Pcmcia - ok
19:35:27.0250 0380 Pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\Pcouffin.sys
19:35:27.0281 0380 Pcouffin - ok
19:35:27.0640 0380 PDCOMP - ok
19:35:27.0984 0380 PDFRAME - ok
19:35:28.0328 0380 PDRELI - ok
19:35:28.0703 0380 PDRFRAME - ok
19:35:29.0093 0380 perc2 - ok
19:35:29.0515 0380 perc2hib - ok
19:35:30.0093 0380 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
19:35:30.0171 0380 PptpMiniport - ok
19:35:30.0796 0380 project (d2a3683f5eb91fb9c38ccc8a4c7bc273) C:\WINDOWS\system32\Drivers\register.sys
19:35:30.0859 0380 project - ok
19:35:31.0375 0380 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
19:35:31.0437 0380 PSched - ok
19:35:32.0062 0380 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
19:35:32.0093 0380 Ptilink - ok
19:35:32.0609 0380 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
19:35:32.0656 0380 PxHelp20 - ok
19:35:33.0093 0380 ql1080 - ok
19:35:33.0484 0380 Ql10wnt - ok
19:35:33.0921 0380 ql12160 - ok
19:35:34.0328 0380 ql1240 - ok
19:35:34.0718 0380 ql1280 - ok
19:35:35.0437 0380 RapportCerberus_29574 (dda98cc4f34977914c731b8155e1cbd5) C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\29574\RapportCerberus32_29574.sys
19:35:35.0671 0380 RapportCerberus_29574 - ok
19:35:36.0000 0380 RapportEI (ebb483bb8e50345bcf3228e3b47a7b78) C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys
19:35:36.0250 0380 RapportEI - ok
19:35:36.0687 0380 RapportKELL (2641560e667c74a08a0826828417ddb7) C:\WINDOWS\system32\Drivers\RapportKELL.sys
19:35:36.0765 0380 RapportKELL - ok
19:35:37.0140 0380 RapportPG (69a0ecb8291bb6d2027c845d6cbef6b8) C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys
19:35:37.0312 0380 RapportPG - ok
19:35:37.0781 0380 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
19:35:37.0843 0380 RasAcd - ok
19:35:38.0390 0380 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
19:35:38.0406 0380 Rasl2tp - ok
19:35:38.0890 0380 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
19:35:38.0921 0380 RasPppoe - ok
19:35:39.0343 0380 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
19:35:39.0406 0380 Raspti - ok
19:35:39.0984 0380 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
19:35:40.0015 0380 RDPCDD - ok
19:35:40.0515 0380 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
19:35:40.0578 0380 RDPWD - ok
19:35:41.0015 0380 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
19:35:41.0062 0380 redbook - ok
19:35:41.0406 0380 RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys
19:35:41.0437 0380 RimUsb - ok
19:35:41.0734 0380 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
19:35:41.0781 0380 RimVSerPort - ok
19:35:42.0218 0380 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
19:35:42.0234 0380 ROOTMODEM - ok
19:35:42.0609 0380 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
19:35:42.0640 0380 Secdrv - ok
19:35:43.0109 0380 SenFiltService (eca77beeb2be8d573cf1b265e44fbfbd) C:\WINDOWS\system32\drivers\Senfilt.sys
19:35:43.0390 0380 SenFiltService - ok
19:35:43.0890 0380 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
19:35:43.0906 0380 serenum - ok
19:35:44.0203 0380 Serial - ok
19:35:44.0593 0380 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
19:35:44.0656 0380 Sfloppy - ok
19:35:45.0015 0380 Simbad - ok
19:35:45.0703 0380 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
19:35:45.0734 0380 SONYPVU1 - ok
19:35:46.0125 0380 Sparrow - ok
19:35:46.0437 0380 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
19:35:46.0484 0380 splitter - ok
19:35:47.0125 0380 sptd (71e276f6d189413266ea22171806597b) C:\WINDOWS\System32\Drivers\sptd.sys
19:35:47.0578 0380 sptd - ok
19:35:48.0109 0380 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
19:35:48.0187 0380 sr - ok
19:35:48.0703 0380 ss_bus (bd15182e9d2d3fabc1d1313badbd2415) C:\WINDOWS\system32\DRIVERS\ss_bus.sys
19:35:48.0734 0380 ss_bus - ok
19:35:49.0093 0380 ss_mdfl (67d1144f249a3c5e03ebd7a2304dee11) C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
19:35:49.0109 0380 ss_mdfl - ok
19:35:49.0484 0380 ss_mdm (954b7ce2d54c703d6a8471d6b05a5e13) C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
19:35:49.0546 0380 ss_mdm - ok
19:35:49.0890 0380 StarOpen (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys
19:35:49.0953 0380 StarOpen - ok
19:35:50.0281 0380 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
19:35:50.0328 0380 swenum - ok
19:35:50.0687 0380 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
19:35:50.0703 0380 swmidi - ok
19:35:50.0953 0380 symc810 - ok
19:35:51.0171 0380 symc8xx - ok
19:35:51.0468 0380 sym_hi - ok
19:35:51.0765 0380 sym_u3 - ok
19:35:52.0109 0380 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
19:35:52.0125 0380 sysaudio - ok
19:35:52.0453 0380 TBPanel (04e1c782cf14b7282ebc633b0fd3ed16) C:\WINDOWS\system32\drivers\TBPanel.sys
19:35:52.0468 0380 TBPanel - ok
19:35:52.0953 0380 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
19:35:53.0062 0380 Tcpip - ok
19:35:53.0421 0380 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
19:35:53.0437 0380 TDPIPE - ok
19:35:53.0750 0380 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
19:35:53.0781 0380 TDTCP - ok
19:35:54.0203 0380 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
19:35:54.0218 0380 TermDD - ok
19:35:54.0609 0380 TosIde - ok
19:35:55.0046 0380 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
19:35:55.0046 0380 Udfs - ok
19:35:55.0375 0380 ultra - ok
19:35:55.0765 0380 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
19:35:56.0000 0380 Update - ok
19:35:56.0421 0380 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys
19:35:56.0437 0380 USBAAPL - ok
19:35:56.0687 0380 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
19:35:56.0750 0380 usbccgp - ok
19:35:57.0078 0380 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
19:35:57.0078 0380 usbehci - ok
19:35:57.0546 0380 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
19:35:57.0609 0380 usbhub - ok
19:35:57.0968 0380 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
19:35:57.0984 0380 usbprint - ok
19:35:58.0390 0380 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
19:35:58.0390 0380 usbscan - ok
19:35:58.0687 0380 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
19:35:58.0687 0380 USBSTOR - ok
19:35:59.0093 0380 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
19:35:59.0156 0380 usbuhci - ok
19:35:59.0562 0380 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
19:35:59.0562 0380 VgaSave - ok
19:35:59.0875 0380 ViaIde - ok
19:36:00.0265 0380 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
19:36:00.0296 0380 VolSnap - ok
19:36:00.0640 0380 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
19:36:00.0656 0380 Wanarp - ok
19:36:00.0953 0380 WDICA - ok
19:36:01.0265 0380 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
19:36:01.0312 0380 wdmaud - ok
19:36:01.0703 0380 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
19:36:01.0750 0380 WudfPf - ok
19:36:02.0203 0380 yukonwxp (b29e7a2e211494ac05c2575d4725497a) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
19:36:02.0359 0380 yukonwxp - ok
19:36:02.0406 0380 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
19:36:03.0812 0380 \Device\Harddisk0\DR0 - ok
19:36:03.0828 0380 Boot (0x1200) (89338385daec4d51aec01a7af66862c6) \Device\Harddisk0\DR0\Partition0
19:36:03.0828 0380 \Device\Harddisk0\DR0\Partition0 - ok
19:36:03.0875 0380 Boot (0x1200) (3801417ed33de828f8ca8171f3e099d8) \Device\Harddisk0\DR0\Partition1
19:36:03.0890 0380 \Device\Harddisk0\DR0\Partition1 - ok
19:36:03.0890 0380 ============================================================
19:36:03.0890 0380 Scan finished
19:36:03.0890 0380 ============================================================
19:36:03.0937 2884 Detected object count: 0
19:36:03.0937 2884 Actual detected object count: 0
19:36:56.0781 3008 Deinitialize success




ComboFix 11-10-03.01 - Owner 2011-10-03 19:57:04.7.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.242 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\google\common\google updater\googleupdaterservice.exe
c:\program files\Mozilla Firefox\searchplugins\search.xml
c:\windows\{2521BB91-29B1-4d7e-9137-AC9875D77735}
c:\windows\settings.reg
c:\windows\system32\comct332.ocx
c:\windows\system32\d3d9caps.dat
c:\windows\system32\Memman.vxd
c:\windows\system32\skinboxer43.dll
c:\windows\wuauclt.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-03 to 2011-10-03 )))))))))))))))))))))))))))))))
.
.
2011-10-02 21:38 . 2010-09-07 13:39 150392 —-a-w- c:\windows\junction.exe
2011-09-22 20:00 . 2011-09-22 20:00 50112 –sha-w- c:\windows\system32\c_52283.nl_.vir
2011-09-11 15:30 . 2011-09-11 15:30 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware1
2011-09-05 18:04 . 2011-08-18 13:25 64512 —-a-w- c:\windows\system32\drivers\Lbd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-03 17:49 . 2004-08-04 12:00 26112 —-a-w- c:\windows\system32\userinit.exe
2011-09-09 09:12 . 2004-08-04 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-05 18:06 . 2010-09-29 19:24 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-08-21 08:00 . 2011-08-21 08:00 53816 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2011-08-03 11:49 . 2011-08-27 11:24 600680 —-a-w- c:\windows\system32\easyupdatusapiu.dll
2011-08-03 11:49 . 2011-08-27 11:22 61440 —-a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:49 . 2011-08-27 11:21 914024 —-a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:49 . 2011-08-27 11:21 875112 —-a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:49 . 2011-08-27 11:21 2090088 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:49 . 2011-08-27 11:21 17186816 —-a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:49 . 2009-02-19 09:26 5427200 —-a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:49 . 2009-02-19 09:26 54272 —-a-w- c:\windows\system32\nvwddi.dll
2011-08-03 11:49 . 2009-02-19 09:26 2404864 —-a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:49 . 2009-02-19 09:26 2387560 —-a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:49 . 2009-02-19 09:26 16191488 —-a-w- c:\windows\system32\nvoglnt.dll
2011-08-03 11:49 . 2009-02-19 09:26 146024 —-a-w- c:\windows\system32\nvsvc32.exe.vir
2011-08-03 11:49 . 2009-02-19 09:26 145000 —-a-w- c:\windows\system32\nvcolor.exe
2011-08-03 11:49 . 2009-02-19 09:26 13892200 —-a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:49 . 2009-02-19 09:26 111208 —-a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:49 . 2005-04-01 14:16 4210816 —-a-w- c:\windows\system32\nv4_disp.dll
2011-08-03 11:49 . 2005-04-01 14:16 12542592 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-07-15 13:29 . 2004-08-04 12:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 22:55 . 2002-01-01 00:09 2237440 —-a-w- C:\OTLPE.exe
2011-07-12 09:20 . 2011-07-12 09:20 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-07-08 14:02 . 2004-08-04 12:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 17:52 . 2011-05-03 21:00 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2011-05-03 21:00 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2008-09-01 22:08 . 2008-09-01 22:06 28868320 —-a-w- c:\program files\FileFormatConverters.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2001-12-31 23:00 25600 –sha-w- c:\windows\assembly\GAC_MSIL\123.xxx.vir
2002-01-01 01:31 25600 –sha-w- c:\windows\assembly\GAC_MSIL\Desktop.ini.vir
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
.
[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
.
[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
.
[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
.
[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
.
[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys
.
[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll
.
[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
.
[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 3516D8A18B36784B1005B950B84232E1 . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll
.
[-] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
.
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
[-] 2005-07-26 . C369DF215D352B6F3A0B8C3469AA34F8 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . DA383FB39A6F1C445F3AFC94B3EB1248 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-04-28 . C8061F289E000703E7672916B7FE1571 . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll
[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll
.
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
.
[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
.
[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
.
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2007-04-16 . 09F7CB3687F86EDAA4CA081F7AB66C03 . 986112 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2006-07-05 . 0FDD84928A5DDE2510761B7EC76CCEC9 . 985088 . . [5.1.2600.2945] . . c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2006-07-05 . D8DB5397DE07577C1CB50BA6D23B3AD4 . 984064 . . [5.1.2600.2945] . . c:\windows\$NtUninstallKB935839$\kernel32.dll
[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB917422$\kernel32.dll
.
[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 648BF0B4DDE4F7A1156DAE7174D36EFA . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll
.
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
.
[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
.
[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
.
[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
.
[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
.
[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
.
[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
.
[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 1418A3A6E76E5A2E3F5E43866E793A8B . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll
.
[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2007-03-08 . 7AA4F6C00405DFC4B70ED4214E7D687B . 578048 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2005-03-02 . 1800F293BCCC8EDE8A70E12B88D80036 . 577024 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll
.
[-] 2011-10-03 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
.
[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
.
[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
.
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\ole32.dll
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\dllcache\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[-] 2005-07-26 . A2F755E237FA2CDD748A80BFBE6657F3 . 1285632 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . 7440D29F257B7E44329343F944F2142C . 1286144 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
[-] 2005-04-28 . 5950E4F28FDA9D147576BF6798937397 . 1285120 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\ole32.dll
[-] 2004-08-04 . 4FE9D9FA62D020E35E0AC6D1AEEB96F0 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\ole32.dll
.
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[-] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll
.
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
.
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
.
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
.
[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
.
[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
.
[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
[-] 2006-12-19 . 53D9184A21C5CBF600D918E51EF3A7E5 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll
.
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
.
[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
.
[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
.
[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
.
[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
.
[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2004-08-04 12:00 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtUninstallKB900485$\aec.sys
.
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
.
[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
.
[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
.
[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
.
[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
.
[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2007-02-05 . 36ACA6CDC19C95FF468A1426EB7F32F0 . 185344 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll
.
[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
.
[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
.
[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
.
[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
.
[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
.
[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
.
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
.
[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
.
[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[-] 2006-12-19 . D9F097AA3B97034D3358A01B43E635B2 . 333824 . . [5.1.2600.3051] . . c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll
[-] 2004-08-04 . D9F6C4F6B1E188ADAFC42B561D9BC2E6 . 333312 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB927802$\wiaservc.dll
.
[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
.
[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2006-06-26 . B5D08C96B2DADAF5171FB69E341B272B . 7680 . . [5.1.2600.2938] . . c:\windows\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll
[-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB920683$\rasadhlp.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-10-01_11.49.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-01-01 04:46 . 2009-08-06 17:24 53472 c:\windows\system32\wuauclt.exe
+ 2004-08-04 12:00 . 2011-10-03 17:23 83278 c:\windows\system32\perfc009.dat
- 2004-08-04 12:00 . 2011-09-08 08:44 83278 c:\windows\system32\perfc009.dat
+ 2002-01-01 04:46 . 2009-08-06 17:24 53472 c:\windows\system32\dllcache\wuauclt.exe
- 2005-08-23 15:07 . 2009-08-06 18:24 53472 c:\windows\system32\dllcache\wuauclt.exe
- 2004-08-04 12:00 . 2011-09-08 08:44 489196 c:\windows\system32\perfh009.dat
+ 2004-08-04 12:00 . 2011-10-03 17:23 489196 c:\windows\system32\perfh009.dat
+ 2011-09-03 10:17 . 2011-09-09 09:12 599040 c:\windows\system32\dllcache\crypt32.dll
- 2011-09-03 10:17 . 2011-09-03 10:17 599040 c:\windows\system32\dllcache\crypt32.dll
+ 2006-10-10 18:46 . 2011-09-16 08:38 47369160 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-12-09 11:51 3911776 —-a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-05-30 09:33 2495816 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 11:51 3911776 —-a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-02-03 2181672]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-18 39408]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-04-22 399736]
"Uniblue RegistryBooster2"="c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 1856544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"="P17.dll" [2005-05-03 64512]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-10 2048352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-09-21 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
"NvMediaCenter"="NvMCTray.dll" [2011-08-03 111208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-07-05 1632360]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-08-13 273544]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-9-21 1545488]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-21 14:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
2005-01-31 11:11 2752000 —-a-r- c:\windows\ALCWZRD.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 —-a-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
2004-08-12 15:45 61952 —-a-w- c:\windows\system32\Hdaudpropshortcut.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hotkey]
2004-04-03 16:38 36864 —-a-w- c:\program files\Hotkey\Hotkey.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-07-19 16:29 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2006-01-24 09:37 7094272 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-06-08 07:31 2221352 —-a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-06-19 07:53 570664 —-a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
2005-03-18 11:18 98304 —-a-r- c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-01-05 07:40 77824 —-a-r- c:\windows\SOUNDMAN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2005-05-20 01:11 925696 —-a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:23 273544 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Photo Express Calendar Checker]
2004-01-12 19:40 69632 —-a-w- c:\program files\Ulead Systems\Ulead Photo Express 5 SE\CalCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
2007-05-16 09:18 1856544 —-a-w- c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster2]
2007-05-16 09:18 1856544 —-a-w- c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-03-09 15:49 37888 —-a-w- c:\program files\Winamp\winampa.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\RecordingManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Piolet\\Piolet.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Program Files\\Real\\RealUpgrade\\realupgrade.exe"=
"c:\\Program Files\\Acrobat 6.0\\Reader\\AcroRd32.exe"=
"c:\\Program Files\\Acrobat 6.0\\Reader\\AdobeUpdateManager.exe"=
"c:\\Program Files\\Windows Live Toolbar\\msn_sl.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Ad-Aware\\Ad-Aware.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
"c:\\Documents and Settings\\Owner\\Desktop\\aswMBR.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-09-05 64512]
R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2011-08-21 53816]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-08 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-08 108552]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);c:\windows\system32\drivers\NEOFLTR_530_10641.sys [2006-04-27 57063]
R1 NEOFLTR_620_14085;Juniper Networks TDI Filter Driver (NEOFLTR_620_14085);c:\windows\system32\drivers\NEOFLTR_620_14085.sys [2009-03-18 64480]
R1 RapportCerberus_29574;RapportCerberus_29574;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\29574\RapportCerberus32_29574.sys [2011-08-08 216912]
R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2011-08-21 66360]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2011-08-21 158904]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-27 2255464]
R3 Pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [2008-01-05 47360]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe –> c:\progra~1\AVG\AVG8\avgemc.exe [?]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1ca59fff6283766;Google Update Service (gupdate1ca59fff6283766);c:\program files\Google\Update\GoogleUpdate.exe /svc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-08-18 2151640]
S2 RapportMgmtService;Rapport Management Service;"c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe" –> c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [2002-01-01 1025352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe /medsvc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [2011-08-18 15232]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-09-13 717296]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - project
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-08-18 18:06]
.
2011-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2011-10-02 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
.
2010-09-17 c:\windows\Tasks\FileCure Default.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]
.
2011-10-03 c:\windows\Tasks\FileCure Startup.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]
.
2011-09-07 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]
.
2001-12-31 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
2011-10-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2675221718-2984062707-343184829-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
2011-10-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2675221718-2984062707-343184829-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.msn.com
mStart Page = about:blank
uInternet Settings,ProxyServer = http=127.0.0.1:25503
uInternet Settings,ProxyOverride = *.local
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: google.com\mail
Trusted Zone: google.com\www
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{3E33D33F-CD38-4F1B-8410-6A3DB395DFB1}: DhcpNameServer = [removed] [removed]
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\m225jtwg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://uk.search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.mt/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=3c30ef60&v=6.010.006.004&i=23&tp=ab&iy=b&ychte=us&lng=en-GB&q=
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Subtile: {88ce39f5-1e54-477c-809d-93d411720f0c} - %profile%\extensions\{88ce39f5-1e54-477c-809d-93d411720f0c}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: AVG Security Toolbar em:version=7.005.030.004 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-03 20:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-10-03 20:16:49
ComboFix-quarantined-files.txt 2011-10-03 18:16
ComboFix2.txt 2011-10-01 12:00
ComboFix3.txt 2008-12-28 19:16
.
Pre-Run: 14,827,094,016 bytes free
Post-Run: 14,790,225,920 bytes free
.
- - End Of File - - C8A1B37A539882E377D1F111D7F55AD3
Post #62 last edited
Hi

What HP disks do you have as that message is looking for a driver or installation file on an HP disk,

did you run the system file checker, it was in one of my previous instructions? If not, run it now:

  • Click Start, click Run, type cmd.exe, and then click OK.
  • At the command prompt, type sfc /scannow, and then press ENTER.
    Note This command may take several minutes to finish. You may be prompted to provide Windows installation source files when you run the sfc /scannow command.
  • At the command prompt, type exit, and then press ENTER to close the command prompt.



NEXT

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\system32\c_52283.nl_.vir
c:\windows\assembly\GAC_MSIL\123.xxx.vir
c:\windows\assembly\GAC_MSIL\Desktop.ini.vir

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:25503

ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #63
CatByte (the genius)

Thanks for your reply. HP disk requested was of my printer. Inserted cd and it seems ok now.

Followed all your instructions as requested and ComboFix log is attached.

THANK YOU!

Pete


ComboFix 11-10-03.01 - Owner 2011-10-03 22:13:45.8.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.323 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
FILE ::
"c:\windows\assembly\GAC_MSIL\123.xxx.vir"
"c:\windows\assembly\GAC_MSIL\Desktop.ini.vir"
"c:\windows\system32\c_52283.nl_.vir"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\assembly\GAC_MSIL\123.xxx.vir
c:\windows\assembly\GAC_MSIL\Desktop.ini.vir
c:\windows\system32\c_52283.nl_.vir
c:\windows\system32\d3d9caps.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-09-03 to 2011-10-03 )))))))))))))))))))))))))))))))
.
.
2011-10-02 21:38 . 2010-09-07 13:39 150392 —-a-w- c:\windows\junction.exe
2011-09-11 15:30 . 2011-09-11 15:30 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware1
2011-09-05 18:04 . 2011-08-18 13:25 64512 —-a-w- c:\windows\system32\drivers\Lbd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-03 20:00 . 2004-08-04 12:00 26112 —-a-w- c:\windows\system32\userinit.exe
2011-09-09 09:12 . 2004-08-04 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-05 18:06 . 2010-09-29 19:24 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-08-21 08:00 . 2011-08-21 08:00 53816 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2011-08-03 11:49 . 2011-08-27 11:24 600680 —-a-w- c:\windows\system32\easyupdatusapiu.dll
2011-08-03 11:49 . 2011-08-27 11:22 61440 —-a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:49 . 2011-08-27 11:21 914024 —-a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:49 . 2011-08-27 11:21 875112 —-a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:49 . 2011-08-27 11:21 2090088 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:49 . 2011-08-27 11:21 17186816 —-a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:49 . 2009-02-19 09:26 5427200 —-a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:49 . 2009-02-19 09:26 54272 —-a-w- c:\windows\system32\nvwddi.dll
2011-08-03 11:49 . 2009-02-19 09:26 2404864 —-a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:49 . 2009-02-19 09:26 2387560 —-a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:49 . 2009-02-19 09:26 16191488 —-a-w- c:\windows\system32\nvoglnt.dll
2011-08-03 11:49 . 2009-02-19 09:26 146024 —-a-w- c:\windows\system32\nvsvc32.exe.vir
2011-08-03 11:49 . 2009-02-19 09:26 145000 —-a-w- c:\windows\system32\nvcolor.exe
2011-08-03 11:49 . 2009-02-19 09:26 13892200 —-a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:49 . 2009-02-19 09:26 111208 —-a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:49 . 2005-04-01 14:16 4210816 —-a-w- c:\windows\system32\nv4_disp.dll
2011-08-03 11:49 . 2005-04-01 14:16 12542592 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-07-15 13:29 . 2004-08-04 12:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 22:55 . 2002-01-01 00:09 2237440 —-a-w- C:\OTLPE.exe
2011-07-12 09:20 . 2011-07-12 09:20 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:20 . 2011-07-12 09:20 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:20 . 2011-07-12 09:20 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:20 . 2011-07-12 09:20 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-07-08 14:02 . 2004-08-04 12:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 17:52 . 2011-05-03 21:00 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2011-05-03 21:00 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2008-09-01 22:08 . 2008-09-01 22:06 28868320 —-a-w- c:\program files\FileFormatConverters.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
.
[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
.
[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
.
[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
.
[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
.
[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys
.
[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll
.
[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
.
[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 3516D8A18B36784B1005B950B84232E1 . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll
.
[-] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
.
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
[-] 2005-07-26 . C369DF215D352B6F3A0B8C3469AA34F8 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . DA383FB39A6F1C445F3AFC94B3EB1248 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-04-28 . C8061F289E000703E7672916B7FE1571 . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll
[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll
.
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
.
[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
.
[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
.
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2007-04-16 . 09F7CB3687F86EDAA4CA081F7AB66C03 . 986112 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2006-07-05 . 0FDD84928A5DDE2510761B7EC76CCEC9 . 985088 . . [5.1.2600.2945] . . c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2006-07-05 . D8DB5397DE07577C1CB50BA6D23B3AD4 . 984064 . . [5.1.2600.2945] . . c:\windows\$NtUninstallKB935839$\kernel32.dll
[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB917422$\kernel32.dll
.
[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 648BF0B4DDE4F7A1156DAE7174D36EFA . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll
.
[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
.
[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
.
[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
.
[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
.
[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
.
[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
.
[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
.
[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 1418A3A6E76E5A2E3F5E43866E793A8B . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll
.
[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2007-03-08 . 7AA4F6C00405DFC4B70ED4214E7D687B . 578048 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2005-03-02 . 1800F293BCCC8EDE8A70E12B88D80036 . 577024 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll
.
[-] 2011-10-03 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
.
[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
.
[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
.
[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[-] 2005-07-26 . A2F755E237FA2CDD748A80BFBE6657F3 . 1285632 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . 7440D29F257B7E44329343F944F2142C . 1286144 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
[-] 2005-04-28 . 5950E4F28FDA9D147576BF6798937397 . 1285120 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\ole32.dll
[-] 2004-08-04 . 4FE9D9FA62D020E35E0AC6D1AEEB96F0 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\ole32.dll
.
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[-] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll
.
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
.
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
.
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
.
[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
.
[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
.
[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
[-] 2006-12-19 . 53D9184A21C5CBF600D918E51EF3A7E5 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll
.
[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
.
[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
.
[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
.
[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
.
[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
.
[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2004-08-04 12:00 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtUninstallKB900485$\aec.sys
.
[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
.
[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
.
[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
.
[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
.
[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
.
[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2007-02-05 . 36ACA6CDC19C95FF468A1426EB7F32F0 . 185344 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll
.
[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
.
[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
.
[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
.
[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
.
[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
.
[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
.
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
.
[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
.
[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[-] 2006-12-19 . D9F097AA3B97034D3358A01B43E635B2 . 333824 . . [5.1.2600.3051] . . c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll
[-] 2004-08-04 . D9F6C4F6B1E188ADAFC42B561D9BC2E6 . 333312 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB927802$\wiaservc.dll
.
[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
.
[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2006-06-26 . B5D08C96B2DADAF5171FB69E341B272B . 7680 . . [5.1.2600.2938] . . c:\windows\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll
[-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB920683$\rasadhlp.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-10-01_11.49.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-01-01 04:46 . 2009-08-06 17:24 53472 c:\windows\system32\wuauclt.exe
- 2004-08-04 12:00 . 2011-09-08 08:44 83278 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2011-10-03 17:23 83278 c:\windows\system32\perfc009.dat
- 2005-08-23 15:07 . 2009-08-06 18:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2002-01-01 04:46 . 2009-08-06 17:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2005-08-23 15:07 . 2010-10-11 14:59 45568 c:\windows\system32\dllcache\wab.exe
- 2010-12-19 17:08 . 2010-10-11 14:59 45568 c:\windows\system32\dllcache\wab.exe
- 2010-08-27 05:57 . 2010-08-27 05:57 99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2004-08-04 12:00 . 2010-08-27 05:57 99840 c:\windows\system32\dllcache\srvsvc.dll
+ 2004-08-04 12:00 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
- 2010-08-17 13:17 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
- 2010-12-19 17:11 . 2010-11-02 15:17 40960 c:\windows\system32\dllcache\ndproxy.sys
+ 2004-08-04 12:00 . 2010-11-02 15:17 40960 c:\windows\system32\dllcache\ndproxy.sys
+ 2004-08-04 12:00 . 2011-07-08 14:02 10496 c:\windows\system32\dllcache\ndistapi.sys
- 2011-08-12 17:30 . 2011-07-08 14:02 10496 c:\windows\system32\dllcache\ndistapi.sys
- 2008-06-12 14:23 . 2008-06-12 14:23 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2005-08-23 15:05 . 2008-06-12 14:23 91648 c:\windows\system32\dllcache\mtxoci.dll
- 2008-06-12 14:23 . 2008-06-12 14:23 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2004-08-04 12:00 . 2008-06-12 14:23 66560 c:\windows\system32\dllcache\mtxclu.dll
- 2008-06-12 14:23 . 2008-06-12 14:23 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2005-08-23 15:05 . 2008-06-12 14:23 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2005-08-23 15:07 . 2010-11-18 18:12 81920 c:\windows\system32\dllcache\isign32.dll
- 2010-11-18 18:12 . 2010-11-18 18:12 81920 c:\windows\system32\dllcache\isign32.dll
- 2009-02-20 18:09 . 2011-06-21 18:45 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2004-08-04 12:00 . 2011-06-21 18:45 78336 c:\windows\system32\dllcache\ieencode.dll
- 2009-04-20 17:17 . 2009-04-20 17:17 45568 c:\windows\system32\dllcache\dnsrslvr.dll
+ 2004-08-04 12:00 . 2009-04-20 17:17 45568 c:\windows\system32\dllcache\dnsrslvr.dll
+ 2004-08-04 12:00 . 2011-04-26 11:07 33280 c:\windows\system32\dllcache\csrsrv.dll
- 2009-12-14 07:08 . 2011-04-26 11:07 33280 c:\windows\system32\dllcache\csrsrv.dll
- 2009-06-29 16:12 . 2011-06-21 18:45 17408 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-04 12:00 . 2011-06-21 18:45 17408 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-04 12:00 . 2011-10-03 17:23 489196 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2011-09-08 08:44 489196 c:\windows\system32\perfh009.dat
- 2010-06-18 17:45 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2004-08-04 12:00 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2004-08-04 12:00 . 2011-06-21 18:45 832512 c:\windows\system32\dllcache\wininet.dll
- 2008-05-09 10:53 . 2011-03-04 06:45 434176 c:\windows\system32\dllcache\vbscript.dll
+ 2004-08-04 12:00 . 2011-03-04 06:45 434176 c:\windows\system32\dllcache\vbscript.dll
+ 2004-08-04 12:00 . 2011-06-21 18:45 106496 c:\windows\system32\dllcache\url.dll
+ 2004-08-04 12:00 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\tcpip.sys
- 2008-06-20 11:51 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\tcpip.sys
+ 2004-08-04 12:00 . 2011-02-17 13:18 357888 c:\windows\system32\dllcache\srv.sys
- 2008-10-15 21:01 . 2011-02-17 13:18 357888 c:\windows\system32\dllcache\srv.sys
+ 2004-08-04 12:00 . 2011-01-21 14:44 439296 c:\windows\system32\dllcache\shimgvw.dll
- 2011-01-21 14:44 . 2011-01-21 14:44 439296 c:\windows\system32\dllcache\shimgvw.dll
+ 2004-08-04 12:00 . 2011-04-29 17:25 151552 c:\windows\system32\dllcache\schannel.dll
- 2008-12-05 06:54 . 2011-04-29 17:25 151552 c:\windows\system32\dllcache\schannel.dll
- 2011-02-09 13:53 . 2011-02-09 13:53 270848 c:\windows\system32\dllcache\sbe.dll
+ 2004-08-04 12:00 . 2011-02-09 13:53 270848 c:\windows\system32\dllcache\sbe.dll
+ 2004-08-04 12:00 . 2010-08-16 08:45 590848 c:\windows\system32\dllcache\rpcrt4.dll
- 2009-04-15 14:51 . 2010-08-16 08:45 590848 c:\windows\system32\dllcache\rpcrt4.dll
- 2008-06-11 03:39 . 2008-05-08 14:02 203136 c:\windows\system32\dllcache\rmcast.sys
+ 2004-08-04 12:00 . 2008-05-08 14:02 203136 c:\windows\system32\dllcache\rmcast.sys
- 2011-08-12 17:32 . 2011-06-24 14:10 139656 c:\windows\system32\dllcache\rdpwd.sys
+ 2005-08-23 15:05 . 2011-06-24 14:10 139656 c:\windows\system32\dllcache\rdpwd.sys
- 2010-12-20 17:32 . 2010-12-20 17:32 551936 c:\windows\system32\dllcache\oleaut32.dll
+ 2004-08-04 12:00 . 2010-12-20 17:32 551936 c:\windows\system32\dllcache\oleaut32.dll
+ 2004-08-04 12:00 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 249856 c:\windows\system32\dllcache\odbc32.dll
+ 2004-08-04 12:00 . 2010-12-09 15:15 718336 c:\windows\system32\dllcache\ntdll.dll
- 2009-04-14 17:40 . 2010-12-09 15:15 718336 c:\windows\system32\dllcache\ntdll.dll
+ 2004-08-04 12:00 . 2011-04-21 13:37 105472 c:\windows\system32\dllcache\mup.sys
- 2001-12-31 22:08 . 2011-04-21 13:37 105472 c:\windows\system32\dllcache\mup.sys
- 2008-06-20 17:46 . 2008-06-20 16:02 245248 c:\windows\system32\dllcache\mswsock.dll
+ 2004-08-04 12:00 . 2008-06-20 16:02 245248 c:\windows\system32\dllcache\mswsock.dll
+ 2004-08-04 12:00 . 2011-06-21 18:45 193024 c:\windows\system32\dllcache\msrating.dll
+ 2005-08-23 15:07 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 102400 c:\windows\system32\dllcache\msjro.dll
- 2008-06-12 14:23 . 2008-06-12 14:23 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2005-08-23 15:05 . 2008-06-12 14:23 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2005-08-23 15:05 . 2008-06-12 14:23 956928 c:\windows\system32\dllcache\msdtctm.dll
- 2008-06-12 14:23 . 2008-06-12 14:23 956928 c:\windows\system32\dllcache\msdtctm.dll
- 2008-06-12 14:23 . 2008-06-12 14:23 428032 c:\windows\system32\dllcache\msdtcprx.dll
+ 2005-08-23 15:05 . 2008-06-12 14:23 428032 c:\windows\system32\dllcache\msdtcprx.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
+ 2005-08-23 15:07 . 2010-11-09 14:52 200704 c:\windows\system32\dllcache\msadox.dll
+ 2005-08-23 15:07 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 180224 c:\windows\system32\dllcache\msadomd.dll
+ 2005-08-23 15:07 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
+ 2005-08-23 15:07 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
- 2010-11-09 14:52 . 2010-11-09 14:52 143360 c:\windows\system32\dllcache\msadco.dll
- 2008-11-12 17:07 . 2011-07-15 13:29 456320 c:\windows\system32\dllcache\mrxsmb.sys
+ 2004-08-04 12:00 . 2011-07-15 13:29 456320 c:\windows\system32\dllcache\mrxsmb.sys
- 2010-10-13 19:10 . 2011-02-08 13:33 978944 c:\windows\system32\dllcache\mfc42.dll
+ 2004-08-04 12:00 . 2011-02-08 13:33 978944 c:\windows\system32\dllcache\mfc42.dll
+ 2004-08-04 12:00 . 2010-09-18 06:53 953856 c:\windows\system32\dllcache\mfc40u.dll
- 2010-10-13 19:10 . 2010-09-18 06:53 953856 c:\windows\system32\dllcache\mfc40u.dll
+ 2004-08-04 12:00 . 2010-12-20 17:26 730112 c:\windows\system32\dllcache\lsasrv.dll
- 2009-04-14 17:40 . 2010-12-20 17:26 730112 c:\windows\system32\dllcache\lsasrv.dll
- 2011-01-27 11:57 . 2011-01-27 11:57 677888 c:\windows\system32\dllcache\lhmstsc.exe
+ 2005-08-23 15:05 . 2011-01-27 11:57 677888 c:\windows\system32\dllcache\lhmstsc.exe
- 2009-06-25 08:25 . 2010-12-22 12:34 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2004-08-04 12:00 . 2010-12-22 12:34 301568 c:\windows\system32\dllcache\kerberos.dll
- 2008-05-09 10:53 . 2011-03-04 06:45 512000 c:\windows\system32\dllcache\jscript.dll
+ 2004-08-04 12:00 . 2011-03-04 06:45 512000 c:\windows\system32\dllcache\jscript.dll
+ 2005-08-23 15:07 . 2011-05-02 15:31 692736 c:\windows\system32\dllcache\inetcomm.dll
- 2008-08-16 07:50 . 2011-05-02 15:31 692736 c:\windows\system32\dllcache\inetcomm.dll
- 2010-07-17 05:13 . 2010-06-14 14:31 744448 c:\windows\system32\dllcache\helpsvc.exe
+ 2005-08-23 15:07 . 2010-06-14 14:31 744448 c:\windows\system32\dllcache\helpsvc.exe
- 2008-07-07 20:26 . 2008-07-07 20:26 253952 c:\windows\system32\dllcache\es.dll
+ 2004-08-04 12:00 . 2008-07-07 20:26 253952 c:\windows\system32\dllcache\es.dll
+ 2004-08-04 12:00 . 2011-02-09 13:53 186880 c:\windows\system32\dllcache\encdec.dll
- 2011-02-09 13:53 . 2011-02-09 13:53 186880 c:\windows\system32\dllcache\encdec.dll
+ 2004-08-04 12:00 . 2011-03-03 06:55 149504 c:\windows\system32\dllcache\dnsapi.dll
- 2008-06-20 17:46 . 2011-03-03 06:55 149504 c:\windows\system32\dllcache\dnsapi.dll
- 2011-09-03 10:17 . 2011-09-03 10:17 599040 c:\windows\system32\dllcache\crypt32.dll
+ 2004-08-04 12:00 . 2011-09-09 09:12 599040 c:\windows\system32\dllcache\crypt32.dll
- 2010-10-13 19:09 . 2010-08-23 16:12 617472 c:\windows\system32\dllcache\comctl32.dll
+ 2004-08-04 12:00 . 2010-08-23 16:12 617472 c:\windows\system32\dllcache\comctl32.dll
+ 2004-08-04 12:00 . 2011-02-15 12:56 290432 c:\windows\system32\dllcache\atmfd.dll
- 2010-04-20 05:30 . 2011-02-15 12:56 290432 c:\windows\system32\dllcache\atmfd.dll
+ 2004-08-04 12:00 . 2011-02-16 13:22 138496 c:\windows\system32\dllcache\afd.sys
- 2008-06-20 11:40 . 2011-02-16 13:22 138496 c:\windows\system32\dllcache\afd.sys
+ 2008-03-25 18:49 . 2008-03-25 18:49 1645320 c:\windows\system32\gdiplus.dll
+ 2004-08-04 12:00 . 2011-06-02 14:02 1858944 c:\windows\system32\dllcache\win32k.sys
- 2008-10-15 21:00 . 2011-06-02 14:02 1858944 c:\windows\system32\dllcache\win32k.sys
+ 2004-08-04 12:00 . 2011-06-21 18:45 1168896 c:\windows\system32\dllcache\urlmon.dll
+ 2004-08-04 12:00 . 2011-01-21 14:44 8462336 c:\windows\system32\dllcache\shell32.dll
- 2008-06-17 19:02 . 2011-01-21 14:44 8462336 c:\windows\system32\dllcache\shell32.dll
- 2008-10-15 20:59 . 2010-12-09 13:07 2027008 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2004-08-03 22:59 . 2010-12-09 13:07 2027008 c:\windows\system32\dllcache\ntkrpamp.exe
- 2008-10-15 20:59 . 2010-12-09 13:42 2148864 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2004-08-04 12:00 . 2010-12-09 13:42 2148864 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2004-08-04 12:00 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
- 2008-11-12 17:05 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2005-08-23 15:05 . 2011-02-02 07:58 2067456 c:\windows\system32\dllcache\lhmstscx.dll
- 2011-02-02 07:58 . 2011-02-02 07:58 2067456 c:\windows\system32\dllcache\lhmstscx.dll
+ 2006-10-10 18:46 . 2011-09-16 08:38 47369160 c:\windows\system32\MRT.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-12-09 11:51 3911776 —-a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-05-30 09:33 2495816 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 11:51 3911776 —-a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-05-30 2495816]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-02-03 2181672]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-18 39408]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-04-22 399736]
"Uniblue RegistryBooster2"="c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-05-16 1856544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"="P17.dll" [2005-05-03 64512]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-10 2048352]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-09-21 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
"NvMediaCenter"="NvMCTray.dll" [2011-08-03 111208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-07-05 1632360]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-08-13 273544]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-9-21 1545488]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-21 14:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
2005-01-31 11:11 2752000 —-a-r- c:\windows\ALCWZRD.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 —-a-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
2004-08-12 15:45 61952 —-a-w- c:\windows\system32\Hdaudpropshortcut.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hotkey]
2004-04-03 16:38 36864 —-a-w- c:\program files\Hotkey\Hotkey.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-07-19 16:29 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2006-01-24 09:37 7094272 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-06-08 07:31 2221352 —-a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-06-19 07:53 570664 —-a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
2005-03-18 11:18 98304 —-a-r- c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-01-05 07:40 77824 —-a-r- c:\windows\SOUNDMAN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2005-05-20 01:11 925696 —-a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-13 06:23 273544 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Photo Express Calendar Checker]
2004-01-12 19:40 69632 —-a-w- c:\program files\Ulead Systems\Ulead Photo Express 5 SE\CalCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
2007-05-16 09:18 1856544 —-a-w- c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster2]
2007-05-16 09:18 1856544 —-a-w- c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-03-09 15:49 37888 —-a-w- c:\program files\Winamp\winampa.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\RecordingManager.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Piolet\\Piolet.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Program Files\\Real\\RealUpgrade\\realupgrade.exe"=
"c:\\Program Files\\Acrobat 6.0\\Reader\\AcroRd32.exe"=
"c:\\Program Files\\Acrobat 6.0\\Reader\\AdobeUpdateManager.exe"=
"c:\\Program Files\\Windows Live Toolbar\\msn_sl.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Ad-Aware\\Ad-Aware.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
"c:\\Documents and Settings\\Owner\\Desktop\\aswMBR.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-09-05 64512]
R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2011-08-21 53816]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-08 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-08 108552]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);c:\windows\system32\drivers\NEOFLTR_530_10641.sys [2006-04-27 57063]
R1 NEOFLTR_620_14085;Juniper Networks TDI Filter Driver (NEOFLTR_620_14085);c:\windows\system32\drivers\NEOFLTR_620_14085.sys [2009-03-18 64480]
R1 RapportCerberus_29574;RapportCerberus_29574;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\29574\RapportCerberus32_29574.sys [2011-08-08 216912]
R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2011-08-21 66360]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2011-08-21 158904]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-27 2255464]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-08-18 2151640]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [2011-08-18 15232]
R3 Pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [2008-01-05 47360]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe –> c:\progra~1\AVG\AVG8\avgemc.exe [?]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe –> c:\progra~1\AVG\AVG8\avgwdsvc.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1ca59fff6283766;Google Update Service (gupdate1ca59fff6283766);c:\program files\Google\Update\GoogleUpdate.exe /svc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 RapportMgmtService;Rapport Management Service;"c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe" –> c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [2002-01-01 1025352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe /medsvc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2008-09-13 717296]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - project
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-08-18 18:06]
.
2011-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2011-10-03 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
.
2010-09-17 c:\windows\Tasks\FileCure Default.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]
.
2011-10-03 c:\windows\Tasks\FileCure Startup.job
- c:\program files\ParetoLogic\FileCure\FileCure.exe [2010-03-28 19:47]
.
2011-09-07 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]
.
2001-12-31 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
2011-10-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2675221718-2984062707-343184829-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
2011-10-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2675221718-2984062707-343184829-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.msn.com
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: google.com\mail
Trusted Zone: google.com\www
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{3E33D33F-CD38-4F1B-8410-6A3DB395DFB1}: DhcpNameServer = [removed] [removed]
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\m225jtwg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://uk.search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.mt/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=3c30ef60&v=6.010.006.004&i=23&tp=ab&iy=b&ychte=us&lng=en-GB&q=
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Subtile: {88ce39f5-1e54-477c-809d-93d411720f0c} - %profile%\extensions\{88ce39f5-1e54-477c-809d-93d411720f0c}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: AVG Security Toolbar em:version=7.005.030.004 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-03 22:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-10-03 22:32:35
ComboFix-quarantined-files.txt 2011-10-03 20:32
ComboFix2.txt 2011-10-03 18:16
ComboFix3.txt 2011-10-01 12:00
ComboFix4.txt 2008-12-28 19:16
.
Pre-Run: 14,536,790,016 bytes free
Post-Run: 14,512,095,232 bytes free
.
- - End Of File - - 6F2654B0FB30A0875AEAAEDA1FDC5A67
Post #64
There are still some issues, we'll address those soon, but let's finish up checking for any leftover malware

Please do the following:



  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish


NEXT

Please advise how the computer is running and if there are any outstanding issues
Post #65
CatByte Thanks for instructions. These were carried out and the output reports can be found below. PC appears to be working OK. Regards Pete Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 7868 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 2011-10-04 21:35:53 mbam-log-2011-10-04 (21-35-53).txt Scan type: Quick scan Objects scanned: 223115 Time elapsed: 5 minute(s), 42 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\Owner\my documents\downloads\mywebface.exe (Adware.FunWeb) -> Quarantined and deleted successfully. ESETSCAN C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\Process.exe Win32/PrcView application C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\restart.exe Win32/Shutdown.NAA application C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\SmitfraudFix.exe multiple threats C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\SmitfraudFix\Process.exe Win32/PrcView application C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\SmitfraudFix\restart.exe Win32/Shutdown.NAA application C:\Documents and Settings\Owner\My Documents\PC Security\SmitfraudFix\Process.exe Win32/PrcView application C:\Documents and Settings\Owner\My Documents\PC Security\SmitfraudFix\restart.exe Win32/Shutdown.NAA application C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL Win32/Toolbar.AskSBar application C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Win32/Toolbar.AskSBar application C:\Program Files\AVG\AVG8\avgcsrvx.exe.vir Win32/Patched.HN trojan C:\Program Files\AVG\AVG8\avgemc.exe.vir Win32/Patched.HN trojan C:\Program Files\AVG\AVG8\avgnsx.exe.vir Win32/Patched.HN trojan C:\Program Files\AVG\AVG8\avgrsx.exe.vir Win32/Patched.HN trojan C:\Program Files\AVG\AVG8\avgwdsvc.exe.vir Win32/Patched.HN trojan C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe.vir Win32/Patched.HN trojan C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE.vir Win32/Patched.HN trojan C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe.vir Win32/Patched.HN trojan C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe.vir Win32/Patched.HN trojan C:\Program Files\Google\Update\GoogleUpdate.exe.vir Win32/Patched.HN trojan C:\Program Files\iPod\bin\iPodService.exe.vir Win32/Patched.HN trojan C:\Program Files\Nero\Nero-8.2.8.0_eng_trial.exe Win32/Toolbar.AskSBar application C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe.vir Win32/Patched.HN trojan C:\Program Files\Nero 8\Nero 8.3.6\Nero-8.3.6.0 de.exe Win32/Toolbar.AskSBar application C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe.vir Win32/Patched.HN trojan C:\Program Files\Serial Key Generator 3.1\SKGenerator.exe a variant of Win32/Packed.Themida application C:\Program Files\smitRem\Process.exe Win32/PrcView application C:\Program Files\smitRem\smitRem.exe.vir Win32/PrcView application C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe.vir Win32/Patched.HN trojan C:\Program Files\VSO\VSO.Software.ConvertXtoDVD.v2.2.3.258g.Cracked-F4CG.rar a variant of Win32/HackTool.Patcher.A application C:\Program Files\VSO\ConvertXtoDVD\patch.exe a variant of Win32/HackTool.Patcher.A application C:\Program Files\Winferno\PC Confidential\PCConfidential.exe Win32/Adware.PCConfidential application C:\Qoobox\Quarantine\C\WINDOWS\assembly\GAC_MSIL\123.xxx.vir.vir a variant of Win32/Sirefef.CH trojan C:\Qoobox\Quarantine\C\WINDOWS\assembly\GAC_MSIL\Desktop.ini.vir.vir a variant of Win32/Sirefef.CH trojan C:\Qoobox\Quarantine\C\WINDOWS\system32\c_52283.nl_.vir.vir a variant of Win32/Sirefef.CR trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP391\A0133862.DLL Win32/Toolbar.MyWebSearch application C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP396\A0141102.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP396\A0141103.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0141435.rbf.vir Win32/Patched.HN trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0141492.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0141493.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0142492.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0142493.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0142507.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP397\A0142508.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP399\A0142767.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP399\A0142768.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP400\A0143159.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP400\A0143160.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP401\A0143181.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP402\A0143640.exe.vir Win32/Patched.HN trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP403\A0143699.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP403\A0143700.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP403\A0143704.rbf.vir Win32/Patched.HN trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP403\A0143982.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP403\A0143983.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP405\A0144021.exe.vir Win32/Patched.HN trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP405\A0144026.exe.vir Win32/Patched.HN trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP407\A0144134.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP407\A0144135.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP407\A0145134.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP407\A0145135.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP407\A0147167.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP407\A0147168.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0147694.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0147695.ini.vir Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0147734.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0147735.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0147790.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0147791.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0148790.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0148791.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0148814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0148815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0149814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0149815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0150814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0150815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0151814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0151815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0152814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0152815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0153814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0153815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0154814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0154815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0155814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0155815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0156814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0156815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0157814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0157815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0158814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0158815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0159814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0159815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0160814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0160815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0161814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0161815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0162814.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0162815.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0162839.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0162840.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0163839.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0163840.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0163868.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0163869.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0163964.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0163965.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0164964.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0164965.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0165964.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0165965.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0166041.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0166042.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0167041.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0167042.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0168041.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0168042.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0168125.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0168126.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0168146.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0168147.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0169146.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0169147.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0170146.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0170147.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0171146.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0171147.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0171161.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0171162.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0172161.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0172162.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0173161.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0173162.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0173175.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0173176.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0173185.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0173186.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0174185.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0175185.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0175186.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0175265.sys.vir Win32/Sirefef.CO trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0175266.ini.vir a variant of Win32/Sirefef.CH trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0177265.sys.vir Win32/Sirefef.CV trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0177281.sys.vir Win32/Sirefef.CV trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0178281.sys.vir Win32/Sirefef.CV trojan C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP408\A0178303.sys.vir Win32/Sirefef.CV trojan C:\WINDOWS\system32\CTSVCCDA.EXE.vir Win32/Patched.HN trojan C:\WINDOWS\system32\IoctlSvc.exe.vir Win32/Patched.HN trojan C:\WINDOWS\system32\nvsvc32.exe.vir Win32/Patched.HN trojan C:\WINDOWS\system32\wuauclt.exe.old.exe.vir Win32/Patched.HN trojan C:\WINDOWS\system32\drivers\cdrom.sys.old.sys.vir Win32/Sirefef.CO trojan C:\WINDOWS\system32\drivers\serial.sys.vir Win32/Sirefef.CV trojan C:\_OTL\MovedFiles\01012002_000921\C_Documents and Settings\All Users\Application Data\f4f74a\357.mof Win32/RogueAV.A trojan
Post #66 last edited
Hi

There are still a few issues that we need to deal with:

Uninstall AVG totally, it has been infected and wont work properly

remove it from add/remove programs, then use the AVG removal tool to get the remainder

http://www.avg.com/filedir/util/avg_arm_su…/avgremover.exe


You will need an AV, give Microsoft Security Essentials a try, it's excellent and free

http://www.microsoft.com/security_essentials/

before you install it, I would like you to install the trial version of Kaspersky Anti Virus, (you can uninstall it once we are done the scan)

It does a great job of curing the Win32/Patched.HN trojan which many of your program files are patched with

(don't delete or quarantine > select cure)

http://www.kaspersky.com/anti-virus_trial

Once you are done that, re run the ESET scan so we can see what is left, we may need to uninstall some programs and reinstall them.

There are a few programs such as the ASK tool bar that you should uninstall from Add/Remove programs, the SmitFraudFix, that you don't need and PC Confidential which contains Adware.

Reset and clear out the old restore points first

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

We need to set a new system restore point:

Click Start > Run > copy and paste the following into the run box:

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.

Now remove all previous Restore Points:
Click Start > Run > copy and paste the following into the run box:

cleanmgr

Choose to scan drive C:\ (if C:\ is your main drive) At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.


Let me know how you get on with that, then we'll go on from there.
Post #67
CatByte Thank you for your most recent instructions. I think we are making good progress. Did as instructed. AVG removed. Kaspersky installed and scan undertaken - Report below. Also did new ESET scan - Report also below. New restore point created and old ones removed. As always thanks for your incredible help. Regards Pete Type: Trojan program (138) Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:20:13 Rootkit.Win32.ZAccess.e Deleted 2011-10-06 22:20:12 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:20:12 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:20:12 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:11 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:20:10 Trojan-GameThief.Win32.Lmir.tdo Deleted 2011-10-06 22:20:10 Rootkit.Win32.ZAccess.e Deleted 2011-10-06 22:20:09 Rootkit.Win32.ZAccess.e Deleted 2011-10-06 22:20:09 Rootkit.Win32.ZAccess.e Deleted 2011-10-06 22:20:08 Rootkit.Win32.ZAccess.e Deleted 2011-10-06 22:20:07 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:06 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:06 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:05 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:05 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:04 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:04 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:03 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:03 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:02 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:02 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:02 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:01 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:00 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:20:00 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:20:00 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:59 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:59 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:58 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:58 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:40 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:40 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:40 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:39 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:38 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:38 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:37 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:37 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:37 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:36 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:36 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:35 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:35 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:34 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:33 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:33 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:32 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:32 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:32 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:31 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:31 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:30 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:30 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:30 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:29 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:28 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:28 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:27 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:27 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:26 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:26 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:26 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:25 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:25 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:24 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:23 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:23 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:23 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:22 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:22 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:21 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:21 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:20 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:20 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:19 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:19 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:18 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:18 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:17 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:17 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:16 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:16 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:15 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:15 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:14 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:14 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:13 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:13 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:19:12 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:12 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:11 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:11 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:10 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:10 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:09 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:09 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:08 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:07 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:19:06 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:19:05 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:04 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:04 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:19:03 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:02 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:02 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:19:01 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:01 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:00 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:19:00 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:19:00 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:18:59 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:18:58 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:18:58 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:18:57 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:18:57 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:18:56 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:18:56 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:55 Backdoor.Win32.ZAccess.dg Deleted 2011-10-06 22:18:54 Rootkit.Win32.ZAccess.c Deleted 2011-10-06 22:18:53 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:18:52 Backdoor.Win32.ZAccess.aid Deleted 2011-10-06 22:18:52 Trojan.Win32.Patched.mf Will be processed after the computer reboot 2011-10-06 22:18:50 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:49 Trojan-GameThief.Win32.Lmir.tdo Deleted 2011-10-06 22:18:49 Trojan-GameThief.Win32.Lmir.tdo Deleted 2011-10-06 22:18:49 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:47 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:46 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:46 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:45 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:44 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:44 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:43 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:43 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:42 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:42 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:41 Trojan.Win32.Patched.mf Disinfected 2011-10-06 22:18:40 Type: virus (1) HEUR:Backdoor.Win32.ZAccess.gen Deleted 2011-10-06 22:18:52 ESETSCAN C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\Process.exe Win32/PrcView application cleaned by deleting - quarantined C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\restart.exe Win32/Shutdown.NAA application cleaned by deleting - quarantined C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\SmitfraudFix.exe multiple threats deleted - quarantined C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\SmitfraudFix\Process.exe Win32/PrcView application cleaned by deleting - quarantined C:\Documents and Settings\Owner\Desktop\Unused Desktop Shortcuts\SmitfraudFix\SmitfraudFix\restart.exe Win32/Shutdown.NAA application cleaned by deleting - quarantined C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\m225jtwg.default\Cache\8BBD46B2d01 a variant of Win32/Adware.HotBar.K application cleaned by deleting - quarantined C:\Program Files\Nero\Nero-8.2.8.0_eng_trial.exe Win32/Toolbar.AskSBar application deleted - quarantined C:\Program Files\Nero 8\Nero 8.3.6\Nero-8.3.6.0 de.exe Win32/Toolbar.AskSBar application deleted - quarantined C:\Program Files\Serial Key Generator 3.1\SKGenerator.exe a variant of Win32/Packed.Themida application cleaned by deleting - quarantined C:\Program Files\smitRem\Process.exe Win32/PrcView application cleaned by deleting - quarantined C:\Program Files\smitRem\smitRem.exe.vir Win32/PrcView application deleted - quarantined C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe.vir Win32/Patched.HN trojan error while cleaning C:\Program Files\VSO\VSO.Software.ConvertXtoDVD.v2.2.3.258g.Cracked-F4CG.rar a variant of Win32/HackTool.Patcher.A application deleted - quarantined C:\Program Files\VSO\ConvertXtoDVD\patch.exe a variant of Win32/HackTool.Patcher.A application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP391\A0133862.DLL Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP416\A0190204.exe Win32/Adware.PCConfidential application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP417\A0190301.DLL Win32/Toolbar.AskSBar application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP417\A0190302.DLL Win32/Toolbar.AskSBar application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191562.exe Win32/PrcView application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191563.exe Win32/Shutdown.NAA application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191564.exe multiple threats deleted - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191565.exe Win32/PrcView application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191566.exe Win32/Shutdown.NAA application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191567.exe Win32/Toolbar.AskSBar application deleted - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191568.exe Win32/Toolbar.AskSBar application deleted - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191569.exe a variant of Win32/Packed.Themida application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191570.exe Win32/PrcView application cleaned by deleting - quarantined C:\System Volume Information\_restore{E13A6A0D-FF7A-43EA-821C-6D9E855689E3}\RP419\A0191571.exe a variant of Win32/HackTool.Patcher.A application cleaned by deleting - quarantined C:\_OTL\MovedFiles\01012002_000921\C_Documents and Settings\All Users\Application Data\f4f74a\357.mof Win32/RogueAV.A trojan cleaned by deleting - quarantined
Post #68
Looking much much better


looks like this is the only left over

C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe.vir Win32/Patched.HN trojan error while cleaning

is this third party software from your bank? or something else?

If it can be completely uninstalled and re-installed then please do so:

Next please post a fresh DDS Log and Attach.txt and advise how the computer is running now and if there are any outstanding issues:


(I'll re-give you the instructions for DDS to save you scrolling back)

also please see if GMER will now run on your machine, I want to make certain nothing is hidden:


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #69
CatByte

As always thank for your help and last set of instructions.

The Trusteer program was a bank related one. I have uninstalled this from the Control Panel. I'm sure I can reinstall later.

Downloaded and ran DDS as requested and two Reports are attached.

I then downloaded GMER Rootkit Scanner and ran a scan (no warnings received). The GMER report is also attached. This scan did take quite a long time, over 5 hrs.

I think we are making good progress as pc appears to be working fine.

The only thing when I start the pc I get the following message in a pop up box:

Warning: Please reinstall/update the display driver and program.
[OK]

I just click ok and carry on. An idea how to get rid of it?


Thanks.

Best Regards

Pete

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.11
Run by [removed] at 19:17:37 on 2011-10-07
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.436 [GMT 2:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\ParetoLogic\FileCure\FileCure.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.msn.com
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: Software - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Ask Search Assistant BHO: {9cb65201-89c4-402c-ba80-02d8c59f9b1d} - Ask Search Assistant BHO
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [GAINWARD] c:\program files\expertool\TBPanel.exe /A
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [Uniblue RegistryBooster2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: &Windows; Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {9455301C-CF6B-11D3-A266-00C04F689C50} - {9455301C-CF6B-11D3-A266-00C04F689C50} - c:\program files\common files\microsoft shared\encarta researcher\EROPROJ.DLL
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: google.com\mail
Trusted Zone: google.com\www
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://start.hsbc.com.mt/dana-cached/setup/JuniperSetupSP1.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{3E33D33F-CD38-4F1B-8410-6A3DB395DFB1} : DhcpNameServer = [removed] [removed]
Handler: msero - {B0D92A71-886B-453B-A649-1B91F93801E7} - c:\program files\common files\microsoft shared\encarta researcher\MSERO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: DVDIdleShell Class: {93994de8-8239-4655-b1d1-5f4e91300429} - c:\progra~1\dvdreg~1\DVDShell.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\m225jtwg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.mt/
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=3c30ef60&v;=6.010.006.004&i;=23&tp;=ab&iy;=b&ychte;=us&lng;=en-GB&q;=
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordlegacyext.dll
FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\m225jtwg.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\m225jtwg.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko5.dll
FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\m225jtwg.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko6.dll
FF - component: c:\program files\daemon tools toolbar\firefoxdtt\components\DTToolbarFF.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\m225jtwg.default\extensions\{195a3098-0bd5-4e90-ae22-ba1c540afd1e}\plugins\npGarmin.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Subtile: {88ce39f5-1e54-477c-809d-93d411720f0c} - %profile%\extensions\{88ce39f5-1e54-477c-809d-93d411720f0c}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-9-5 64512]
R1 NEOFLTR_530_10641;Juniper Networks TDI Filter Driver (NEOFLTR_530_10641);c:\windows\system32\drivers\NEOFLTR_530_10641.sys [2006-4-27 57063]
R1 NEOFLTR_620_14085;Juniper Networks TDI Filter Driver (NEOFLTR_620_14085);c:\windows\system32\drivers\NEOFLTR_620_14085.sys [2009-3-18 64480]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-8-27 2255464]
R4 RapportCerberus_29574;RapportCerberus_29574;c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportcerberus\29574\RapportCerberus32_29574.sys [2011-8-8 216912]
R4 RapportEI;RapportEI;\??\c:\program files\trusteer\rapport\bin\rapportei.sys –> c:\program files\trusteer\rapport\bin\RapportEI.sys [?]
R4 RapportPG;RapportPG;\??\c:\program files\trusteer\rapport\bin\rapportpg.sys –> c:\program files\trusteer\rapport\bin\RapportPG.sys [?]
RUnknown RapportKELL;RapportKELL; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca59fff6283766;Google Update Service (gupdate1ca59fff6283766);c:\program files\google\update\googleupdate.exe /svc –> c:\program files\google\update\GoogleUpdate.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\googleupdate.exe /medsvc –> c:\program files\google\update\GoogleUpdate.exe [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-8-18 2151640]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-8-18 15232]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-10-04 19:45:27 ——– d—–w- c:\program files\ESET
2011-10-04 19:15:15 ——– d—–w- c:\documents and settings\owner\application data\Malwarebytes
2011-10-02 21:38:56 150392 —-a-w- c:\windows\junction.exe
2011-10-01 08:49:25 98816 —-a-w- c:\windows\sed.exe
2011-10-01 08:49:25 518144 —-a-w- c:\windows\SWREG.exe
2011-10-01 08:49:25 256000 —-a-w- c:\windows\PEV.exe
2011-10-01 08:49:25 208896 —-a-w- c:\windows\MBR.exe
.
==================== Find3M ====================
.
2011-10-06 20:20:13 47104 —-a-w- c:\windows\system32\wuauclt.exe.old.exe.vir
2011-10-06 20:20:13 139264 —-a-w- c:\windows\system32\nvsvc32.exe.vir
2011-10-06 20:20:12 81920 —-a-w- c:\windows\system32\IoctlSvc.exe.vir
2011-10-06 20:20:10 44032 —-a-w- c:\windows\system32\CTSVCCDA.EXE.vir
2011-10-03 20:00:24 26112 —-a-w- c:\windows\system32\userinit.exe
2011-09-09 09:12:13 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-05 18:06:29 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-08-27 11:23:55 280276 —-a-w- c:\windows\system32\nvdrsdb0.bin
2011-08-27 11:23:55 1 —-a-w- c:\windows\system32\nvdrssel.bin
2011-08-27 11:23:48 280276 —-a-w- c:\windows\system32\nvdrsdb1.bin
2011-08-18 13:25:12 64512 —-a-w- c:\windows\system32\drivers\Lbd.sys
2011-07-15 13:29:31 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 22:55:06 2237440 —-a-w- C:\OTLPE.exe
2011-07-12 09:20:54 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-07-12 09:20:54 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-07-12 09:20:54 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 09:20:54 178536 —-a-w- c:\windows\system32\dnssdX.dll
2008-09-01 22:08:40 28868320 —-a-w- c:\program files\FileFormatConverters.exe
.
============= FINISH: 19:18:53.98 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 2006-04-15 12:43:50
System Uptime: 2011-10-07 19:00:10 (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | P5GPL-X
Processor: Intel® Pentium® 4 CPU 3.20GHz | LGA 775 | 3200/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 117 GiB total, 19.015 GiB free.
D: is FIXED (NTFS) - 116 GiB total, 15.852 GiB free.
E: is CDROM ()
G: is Removable
H: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: NVIDIA GeForce 8400 GS
Device ID: PCI\VEN_10DE&DEV;_06E4&SUBSYS;_140110B0&REV;_A1\4&178951BB&0&0008
Manufacturer: NVIDIA
Name: NVIDIA GeForce 8400 GS
PNP Device ID: PCI\VEN_10DE&DEV;_06E4&SUBSYS;_140110B0&REV;_A1\4&178951BB&0&0008
Service: nv
.
Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318}
Description: ECP Printer Port
Device ID: ACPI\PNP0401\4&E0550D1;&0
Manufacturer: (Standard port types)
Name: ECP Printer Port (LPT1)
PNP Device ID: ACPI\PNP0401\4&E0550D1;&0
Service: Parport
.
Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318}
Description: Communications Port
Device ID: ACPI\PNP0501\1
Manufacturer: (Standard port types)
Name: Communications Port (COM2)
PNP Device ID: ACPI\PNP0501\1
Service: Serial
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Kaspersky Anti-Virus NDIS Miniport
Device ID: ROOT\KL_KLIM5MP\0000
Manufacturer: Kaspersky Lab
Name: 1394 Net Adapter - Kaspersky Anti-Virus NDIS Miniport
PNP Device ID: ROOT\KL_KLIM5MP\0000
Service: klim5
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Kaspersky Anti-Virus NDIS Miniport
Device ID: ROOT\KL_KLIM5MP\0001
Manufacturer: Kaspersky Lab
Name: WAN Miniport (Network Monitor) - Kaspersky Anti-Virus NDIS Miniport
PNP Device ID: ROOT\KL_KLIM5MP\0001
Service: klim5
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Kaspersky Anti-Virus NDIS Miniport
Device ID: ROOT\KL_KLIM5MP\0002
Manufacturer: Kaspersky Lab
Name: Intel® PRO/1000 MT Network Connection - Kaspersky Anti-Virus NDIS Miniport
PNP Device ID: ROOT\KL_KLIM5MP\0002
Service: klim5
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Kaspersky Anti-Virus NDIS Miniport
Device ID: ROOT\KL_KLIM5MP\0003
Manufacturer: Kaspersky Lab
Name: WAN Miniport (IP) - Kaspersky Anti-Virus NDIS Miniport
PNP Device ID: ROOT\KL_KLIM5MP\0003
Service: klim5
.
==== System Restore Points ===================
.
RP420: 2011-10-07 04:18:58 - RestorePointOct2011
RP421: 2011-10-07 19:16:07 - Removed Rapport
.
==== Installed Programs ======================
.
µTorrent
001 File Joiner and Splitter
32 Bit HP CIO Components Installer
AAC Decoder
Absolute MP3 Splitter version 2.3.8
Ad-Aware
Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
ALTools Update
AnvSoft Flash to iPod Converter 1.10
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
Avi Join 0.1.0.1
AVI Joiner
AVS Video Tools 5.6
BlackBerry Desktop Software 4.7
BlackBerry® Media Sync
Blaze Media Pro
Bonjour
BufferChm
C4400
C4400_Help
Capture-A-ScreenShot
Compatibility Pack for the 2007 Office system
Conduit Engine
ConvertXtoDVD 2.2.3.258h
Creative MediaSource
Critical Update for Windows Media Player 11 (KB959772)
CustomerResearchQFolder
DAEMON Tools Toolbar
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DocProc
DocProcQFolder
DriverBoost
DVD Region+CSS Free [removed]
DVD Shrink 3.2
DVDFab Platinum 2.9.8.1 Beta
ESET Online Scanner v3
eSupportQFolder
EXPERTool 7.2
File Scavenger 3.2
Form Fill (Windows Live Toolbar)
FrameShots Video Screen Capture
Fx Joiner and Splitter
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService
GPBaseService2
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Hotkey 2.0
HP Customer Participation Program 11.0
HP Imaging Device Functions 11.0
HP Photosmart C4400 All-In-One Driver Software 11.0 Rel .3
HP Photosmart Essential 3.5
HP Smart Web Printing 4.60
HP Update
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
HPSSupply
ImageMixer VCD2
Intel® 537EP Modem
Intel® PRO Network Connections Drivers
iTunes
Juniper Networks Host Checker
Juniper Networks Secure Application Manager
L&H; TTS3000 British English
LaserJet 1020 series
Map Button (Windows Live Toolbar)
Marvell Miniport Driver
Mega Manager
MetaFrame Presentation Server Web Client for Win32
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Encarta Premium Suite 2005
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
MKV Splitter
MKV TO AVI CONVERTER version 3.22
MKV To AVI With Subtitle version 2.0
MobileMe Control Panel
Mozilla Firefox (3.6.23)
MSN Messenger 7.5
MSVCSetup
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
MUSIC PLAYER
Nero 8
neroxml
Nokia Connectivity Cable Driver
NVIDIA Control Panel 280.26
NVIDIA Graphics Driver 280.26
NVIDIA Install Application
NVIDIA nView 135.94
NVIDIA nView Desktop Manager
NVIDIA PhysX
NVIDIA PhysX System Software 9.10.0514
NVIDIA Update 1.4.28
NVIDIA Update Components
OCR Software by I.R.I.S. 11.0
OneCare Advisor (Windows Live Toolbar)
OpenMG Limited Patch 3.3-03-09-03-01
OpenMG Secure Module 3.3.01
OrderReminder HP LaserJet 1020
PanoStandAlone
ParetoLogic FileCure
Passware Kit - 5.0.0
Password Revealer Pro
Picture Package
Piolet 3.1.1
Piolet Toolbar
Popup Blocker (Windows Live Toolbar)
PowerDVD
PrimoPDF
PrimoPDF Redistribution Package
Prism Video Converter
PS_AIO_03_C4400_ProductContext
PS_AIO_03_C4400_Software
PS_AIO_03_C4400_Software_Min
PSSWCORE
Quick AVI Splitter v2.0
Quick Screen Capture 3.0
QuickTime
RAR Password Cracker 4.12
RAR Password Recovery 5.0
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
RON Tool Offersfortoday
Roxio Media Manager
Safari
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile USB Modem ^^
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio
Scan
Search Settings 1.2
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Internet Explorer 7 (KB2530548)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB2559049)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953155)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Serial Key Generator version 3.1
Shockwave
Shop for HP Supplies
Smart Menus (Windows Live Toolbar)
SolutionCenter
Sony USB Driver
Sorenson Squeeze Trial
Sound Blaster Live! 24-bit
Status
Super Screen Capture 4.0
Toolbox
TrayApp
TubeHunter Ultra
Ulead Photo Explorer 8.0 SE Basic
Ulead Photo Express 5 SE
Ultra RM Converter 4.0.1017
Uniblue RegistryBooster 2
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB960763)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
uTorrentBar Toolbar
VC80CRTRedist - 8.0.50727.4053
VCRedistSetup
VIA Register Tool
VideoToolkit01
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.5
WebFldrs XP
WebReg
Winamp
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Key 9.0 Demo
Windows Live Favorites for Windows Live Toolbar
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
Winferno Registry Power Cleaner
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
.
==== Event Viewer Messages From Past Week ========
.
2011-10-06 23:16:19, error: DCOM [10005] - DCOM got error "%2" attempting to start the service gusvc with arguments "" in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
2011-10-06 23:16:05, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
2011-10-06 23:14:43, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The specified module could not be found.
2011-10-06 23:14:43, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The Rapport Management Service service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The PLFlash DeviceIoControl Service service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The NVIDIA Driver Helper Service service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The Nero BackItUp Scheduler 3 service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The Machine Debug Manager service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The Google Update Service (gupdate1ca59fff6283766) service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The Creative Service for CDROM Access service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:14:43, error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:06:01, error: Service Control Manager [7000] - The SSDP Discovery Service service failed to start due to the following error: The system cannot find the file specified.
2011-10-06 23:05:35, error: Service Control Manager [7034] - The Kaspersky Anti-Virus Service service terminated unexpectedly. It has done this 1 time(s).
2011-10-06 22:51:49, error: Service Control Manager [7023] - The Remote Access Connection Manager service terminated with the following error: The specified module could not be found.
2011-10-06 22:51:48, error: Rasman [20063] - Remote Access Connection Manager failed to start because the Point to Point Protocol failed to initialize. The specified module could not be found.
2011-10-06 22:51:30, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 60 minutes. The error was: No more results can be returned by WSALookupServiceNext. (0x80072776)
.
==== End Of File ===========================

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-08 12:58:06
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e WDC_WD2500JD-00HBB0 rev.08.02D08
Running: v9zqr2m9.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pfroypod.sys


—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF78DF87E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF78DFBFE]

—- Kernel code sections - GMER 1.0.15 —-

init C:\WINDOWS\system32\DRIVERS\mohfilt.sys entry point in "init" section [0xF7C7A760]
init C:\WINDOWS\system32\drivers\Senfilt.sys entry point in "init" section [0xF5A01A80]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\Explorer.EXE[272] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 51981CE2 C:\PROGRA~1\DVDREG~1\DVDShell.dll (DVD Region-Free Shell Module/Fengtao Software Inc.)
.text C:\Program Files\Mozilla Firefox\firefox.exe[872] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[872] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 51981CE2 C:\PROGRA~1\DVDREG~1\DVDShell.dll (DVD Region-Free Shell Module/Fengtao Software Inc.)
.text C:\program files\real\realplayer\update\realsched.exe[876] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1032] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 51981CE2 C:\PROGRA~1\DVDREG~1\DVDShell.dll (DVD Region-Free Shell Module/Fengtao Software Inc.)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2448] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 10407D29 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip NEOFLTR_620_14085.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \Driver\Tcpip \Device\Tcp NEOFLTR_620_14085.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \Driver\Tcpip \Device\Udp NEOFLTR_620_14085.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \Driver\Tcpip \Device\RawIp NEOFLTR_620_14085.SYS (NetBIOS Redirector/Juniper Networks)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x73 0xB8 0x36 0x5A …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x27 0x66 0xD9 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC5 0xBF 0xED 0x1B …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x73 0xB8 0x36 0x5A …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x27 0x66 0xD9 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC5 0xBF 0xED 0x1B …
Reg HKLM\SOFTWARE\Classes\wmafile\shellex\ContextMenuHandlers\WMPAddToPüaylist@ {F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\Media\Windows XP Logon Sound.wav 190208 bytes
File C:\WINDOWS\Media\chimes.wav 55776 bytes
File C:\WINDOWS\Media\chord.wav 97016 bytes
File C:\WINDOWS\Media\ding.wav 80856 bytes
File C:\WINDOWS\Media\flourish.mid 24253 bytes
File C:\WINDOWS\Media\notify.wav 119384 bytes
File C:\WINDOWS\Media\onestop.mid 40075 bytes
File C:\WINDOWS\Media\recycle.wav 25434 bytes
File C:\WINDOWS\Media\ringin.wav 10026 bytes
File C:\WINDOWS\Media\ringout.wav 5212 bytes
File C:\WINDOWS\Media\start.wav 1192 bytes
File C:\WINDOWS\Media\tada.wav 171100 bytes
File C:\WINDOWS\Media\town.mid 22097 bytes
File C:\WINDOWS\Media\Windows Feed Discovered.wav 8636 bytes
File C:\WINDOWS\Media\Windows Information Bar.wav 20336 bytes
File C:\WINDOWS\Media\Windows Navigation Start.wav 2202 bytes
File C:\WINDOWS\Media\Windows Pop-up Blocked.wav 29444 bytes
File C:\WINDOWS\Media\Windows XP Balloon.wav 6400 bytes
File C:\WINDOWS\Media\Windows XP Battery Critical.wav 36910 bytes
File C:\WINDOWS\Media\Windows XP Battery Low.wav 53864 bytes
File C:\WINDOWS\Media\Windows XP Critical Stop.wav 39382 bytes
File C:\WINDOWS\Media\Windows XP Default.wav 24530 bytes
File C:\WINDOWS\Media\Windows XP Ding.wav 17132 bytes
File C:\WINDOWS\Media\Windows XP Error.wav 44136 bytes
File C:\WINDOWS\Media\Windows XP Exclamation.wav 42576 bytes
File C:\WINDOWS\Media\Windows XP Hardware Fail.wav 36614 bytes
File C:\WINDOWS\Media\Windows XP Hardware Insert.wav 36636 bytes
File C:\WINDOWS\Media\Windows XP Hardware Remove.wav 36538 bytes
File C:\WINDOWS\Media\Windows XP Information Bar.wav 20336 bytes
File C:\WINDOWS\Media\Windows XP Logoff Sound.wav 179704 bytes
File C:\WINDOWS\Media\Windows XP Menu Command.wav 1404 bytes
File C:\WINDOWS\Media\Windows XP Minimize.wav 22580 bytes
File C:\WINDOWS\Media\Windows XP Notify.wav 48988 bytes
File C:\WINDOWS\Media\Windows XP Pop-up Blocked.wav 29444 bytes
File C:\WINDOWS\Media\Windows XP Print complete.wav 43762 bytes
File C:\WINDOWS\Media\Windows XP Recycle.wav 22816 bytes
File C:\WINDOWS\Media\Windows XP Restore.wav 19458 bytes
File C:\WINDOWS\Media\Windows XP Ringin.wav 38930 bytes
File C:\WINDOWS\Media\Windows XP Ringout.wav 22070 bytes
File C:\WINDOWS\Media\Windows XP Shutdown.wav 282608 bytes
File C:\WINDOWS\Media\Windows XP Start.wav 2202 bytes
File C:\WINDOWS\Media\Windows XP Startup.wav 424644 bytes
File C:\WINDOWS\Microsoft.NET\NETFXRepair.1031.dll 8536 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\CustomMarshalers 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll 81248 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\ISymWrapper 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll 78168 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll 170368 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll 2989456 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll 5197648 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normidna.nlp 59342 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfc.nlp 47076 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfd.nlp 40566 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkc.nlp 67808 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkd.nlp 61718 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\PresentationCore 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll 3545952 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Data 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll 2970968 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Printing 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Transactions 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll 269672 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Accessibility 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll 17240 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll 505184 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll 746336 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll 387960 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll 661352 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll 349576 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll 97680 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll 12128 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll 6346600 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll 232304 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Classic\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll 167288 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll 478576 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll 194424 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationUI 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\PresentationUI\v4.0_4.0.0.0__31bf3856ad364e35\PresentationUI.dll 832856 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll 436600 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll 747360 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Deployment 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll 829280 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Device 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll 51032 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll 395120 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll 285072 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll 182144 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Drawing 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll 607064 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll 120152 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll 392552 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll 125816 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll 123736 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Management 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll 378720 bytes executable
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Messaging 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Net 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Numerics 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing 0 bytes
File C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting 0 bytes
File C:\WINDOWS\Microsoft.NET\DirectX for Managed Code 0 bytes
File C:\WINDOWS\Microsoft.NET\Framework 0 bytes
File C:\WINDOWS\Microsoft.NET\NETFXRepair.1025.dll 0 bytes
File C:\WINDOWS\Microsoft.NET\NETFXRepair.1028.dll 0 bytes
File C:\WINDOWS\Microsoft.NET\NETFXRepair.1029.dll 0 bytes
File C:\WINDOWS\Microsoft.NET\NETFXRepair.1030.dll 0 bytes

—- EOF - GMER 1.0.15 —-
Post #70 last edited
OK

We are certainly making progress.

One of the major issues remaining though, was the sigcheck failure of many of your files,

this can be caused by a number of reasons,

Your Cryptograhic services may not be running, (cryptsvc) or one of the services it relies upon may not be running (RPC) or your catroot is busted, which is resolved by downloading and reinstalling SP3.


Open up your Services and see how many are stopped. (some services don't need to be running, but you can set your services to "automatic" so they are there if needed.

Go to Start > Run > type services.msc into the open run box


Let me know what you find


Now open up device manager

Press the WinKey + R to open a run box > copy/paste devmgmt.msc into the open run box > press OK > Device Manager will open.

expand the trees and then look for your display drivers > click the update button

if that makes no difference > uninstall it > reboot and allow windows to re-install the drivers;

once you have done that, re-run ComboFix to see if the files still fail sig check, if they do, then you'll have to re-install SP3


Let me know how you get on.
Post #71
CatByte

Thank you. Report as follows:

Services.msc

‘CryptSvc’ status is ‘Started’ and is set on automatic.

Out of 107 files 42 are listed as ‘Started’.

All are either set to ‘Manual’ or ‘Automatic’ except the following which have Status as ‘Disabled’:

.Net Runtime Optimization Service v2.0.50727_X86
Human Interface Device Access
Net.Tcp Port Sharing Service
Network DDE
Network DDE DSDM
Routing and Remote Access


Device Manager

Did as instructed and expanded trees but did not find ‘Display Drivers’. I did find ‘Display adapters’ and updated ‘NVIDEA GeForce 8400 GS’ but this made no difference.

Went through the expanded files a couple of times, did not find Display Drivers. Should I be looking for something else?


ComboFix

Did not run ComboFix as I thought best to wait for your next instructions.

For note, my original Windows XP cd has Service Pack 2 (SP2), using this and with Achamian’s instructions I created an XP SP3 cd. This was then used to replace some files, etc.

As always thank you for your assistance.

Pete
Post #73
CatByte Thanks for reply. Tried the 'Fix It' procedure (twice) and went back to 'Devmgmt.msc' and expanded all I could but there was no difference. Pop up window still appears when pc is started. Pete
Post #74
Try uninstalling SP3


Use the hidden $NtServicePackUninstall$ folder
  • Click Start, click Run, copy/paste the following into the open run box:
    c:\windows\$NtServicePackUninstall$\spuninst\spuninst.exe then click OK.
  • When the Windows XP Service Pack 3 Removal Wizard starts, click Next.
  • Follow the instructions on the screen to remove Windows XP SP3.

Then go to MS to download and reinstall the service pack:

Download the latest Windows XP service pack from the Microsoft Download Center
You can download the stand-alone update package from the Download Center.
This page will say that this installation package is intended for IT professionals and developers. However, you can safely download this file.

http://www.microsoft.com/downloads/details…08-1E1555D4F3D4
Post #75
CatByte Thanks for latest email. Followed your instructions, however, when I tried to run "c:\windows\$NtServicePackUninstall$\spuninst\spuninst.exe", I received a message "Windows cannot find… Make sure you typed the name correctly…" As I copied and pasted the file link, I found this odd. So I went to C: Drive and looked under Windows folder. First of all, all folders beginning "$NtService…" and "$NtUninstall…" were in blue as opposed to black. I managed to get to c:\windows\$NtServicePackUninstall$\spuninst, however, the latter folder was empty, i.e. no "spuninst.exe" found. Hope this helps. Best Regards Peter

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI