OpenCloud Security

Hi I can usually find a solution that works online but every fix i try i get to the part of running mbam.exe and it crashes and disables it from running again same with Spyware Doctor. and rkill.exe does not find any process to kill other then it self. Thank you in advance for your help DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_22 Run by [removed] at 3:50:08 on 2011-09-29 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1279.733 [GMT -7:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe svchost.exe svchost.exe C:\WINDOWS\2015586727:1486281863.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\WINDOWS\System32\svchost.exe -k netsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&ptnrS=ZRxpt111YYUS&ptb=z87sVB9IVLQRI6G98pZx3w uSearch Page = uSearch Bar = mSearchAssistant = uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll uURLSearchHooks: H - No File uURLSearchHooks: H - No File BHO: {0063576d-bd60-4bc4-bff3-1e25524aff0c} - c:\documents and settings\david\local settings\application data\TCPIPWMP.dll BHO: {063576d0-bd60-4bc4-bff3-1e25524aff0c} - c:\windows\system32\avicap3232.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers runtime\YontooIEClient.dll TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [cdloader] "c:\documents and settings\david\application data\mjusbsp\cdloader2.exe" MAGICJACK uRun: [cftmon.exe] c:\docume~1\david\locals~1\temp\jre_setup2.exe uRun: [vcheck] c:\docume~1\david\locals~1\temp\vcheck.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [CTHelper] CTHELPER.EXE mRun: [CTxfiHlp] CTXFIHLP.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iSSS2oobF3pG5QJ8234A] c:\windows\system32\LekkIIVrzONyA0.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\pc tools security\pctsGui.exe IE: &Search IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll LSP: mswsock.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{18DA4C74-83EB-4841-83C5-6520702F0448} : DhcpNameServer = 192.168.1.254 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\david\application data\mozilla\firefox\profiles\2kcjrc06.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&q= FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\documents and settings\david\local settings\application data\unity\webplayer\loader\npUnity3D32.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll . —- FIREFOX POLICIES —- . . FF - user.js: extentions.y2layers.installId - 45ea0f10-4e85-4336-b595-7eb1d2a5c488 FF - user.js: extentions.y2layers.defaultEnableAppsList - PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlo bal, . ============= SERVICES / DRIVERS =============== . R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-9-28 239168] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-9-28 338880] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-7-15 136176] S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service –> c:\windows\system32\lxdncoms.exe -service [?] S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [2011-5-27 98984] S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-27 366152] S2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-4-26 223088] S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-9-28 366840] S2 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-9-28 1150936] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-7-15 136176] S3 L6PODLV;PODxt Live Service;c:\windows\system32\drivers\L6PODLV.sys [2010-4-2 571136] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-27 22216] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-7-17 20480] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2011-7-17 8320] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys –> c:\windows\system32\drivers\motodrv.sys [?] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2011-7-17 24064] S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] . =============== Created Last 30 ================ . 2011-09-28 21:01:47 ——– d—–w- c:\documents and settings\david\application data\ZG5sQJ7dE8RqYwU 2011-09-28 21:01:47 ——– d—–w- c:\documents and settings\david\application data\krlOBtxP0c1b3n 2011-09-28 21:00:27 ——– d—–w- c:\documents and settings\david\application data\kamH6sWK7E9TqYe 2011-09-28 20:56:39 ——– d—–w- c:\documents and settings\david\application data\S8RhXUVelBz0c1v 2011-09-28 20:56:39 ——– d—–w- c:\documents and settings\david\application data\brlONtA0uSiFpGa 2011-09-28 20:37:03 656320 —-a-w- c:\windows\system32\drivers\pctEFA.sys 2011-09-28 20:37:03 338880 —-a-w- c:\windows\system32\drivers\pctDS.sys 2011-09-28 20:37:03 251560 —-a-w- c:\windows\system32\drivers\pctgntdi.sys 2011-09-28 20:36:59 239168 —-a-w- c:\windows\system32\drivers\PCTCore.sys 2011-09-28 20:36:59 160448 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2011-09-28 20:36:55 70536 —-a-w- c:\windows\system32\drivers\pctplsg.sys 2011-09-28 20:36:49 ——– d—–w- c:\program files\PC Tools Security 2011-09-28 20:36:49 ——– d—–w- c:\program files\common files\PC Tools 2011-09-28 20:36:49 ——– d—–w- c:\documents and settings\david\application data\PC Tools 2011-09-28 20:35:45 ——– d—–w- c:\documents and settings\all users\application data\PC Tools 2011-09-28 04:44:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-09-28 04:43:36 22216 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-09-28 04:43:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-09-28 04:32:24 ——– d—–w- c:\documents and settings\david\application data\m6dWK8fRZhXjVlB 2011-09-28 04:32:24 ——– d—–w- c:\documents and settings\david\application data\irONtxA0uSiFpGa 2011-09-28 03:59:51 ——– d—–w- c:\documents and settings\david\application data\lRRRZ99hTXwUVlI 2011-09-28 03:59:51 ——– d—–w- c:\documents and settings\david\application data\h555aQQJ6dW8 2011-09-28 03:59:44 2456064 —-a-w- c:\windows\system32\LekkIIVrzONyA0.exe 2011-09-28 03:59:44 ——– d—–w- c:\documents and settings\david\application data\wTTTZqqjYC 2011-09-27 20:22:28 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll 2011-09-27 20:22:28 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin.dll 2011-09-27 20:21:33 ——– d—–w- c:\documents and settings\david\local settings\application data\Apple 2011-09-27 20:21:09 ——– d—–w- c:\documents and settings\david\local settings\application data\Apple Computer 2011-09-27 17:44:31 ——– d—–w- c:\documents and settings\david\application data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 2011-09-27 17:44:31 ——– d—–w- c:\documents and settings\david\application data\Adobe Mini Bridge CS5 2011-09-26 13:58:34 ——– d—–w- c:\documents and settings\david\local settings\application data\conduitEngine 2011-09-24 20:39:00 265728 —-a-w- c:\documents and settings\david\local settings\application data\TCPIPWMP.dll 2011-09-21 21:35:48 ——– d—–w- c:\program files\Yontoo Layers Runtime 2011-09-19 21:07:40 446464 —-a-w- c:\windows\system32\nvudisp.exe 2011-09-19 21:07:40 ——– d—–w- c:\windows\nview 2011-09-19 21:07:23 446464 —-a-w- c:\windows\system32\NVUNINST.EXE 2011-09-19 21:07:18 ——– d—–w- C:\NVIDIA 2011-09-11 15:36:17 ——– d—–w- c:\documents and settings\david\application data\Line 6 2011-09-08 22:09:03 ——– d—–w- c:\program files\VideoLAN 2011-09-05 17:04:56 183696 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll 2011-09-02 13:28:16 ——– d—–w- c:\windows\pss . ==================== Find3M ==================== . 2011-09-27 13:59:30 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-08-17 21:10:53 4400 —-a-w- c:\documents and settings\david\NDK11F.exe 2011-07-17 15:51:13 0 —ha-w- c:\documents and settings\david\nxqliktbgg.tmp 2011-07-08 18:53:19 205312 —-a-w- c:\windows\system32\Logo-Start.scr 2011-07-08 16:45:47 205312 —-a-w- c:\windows\system32\Bottle Glow.scr 2011-07-06 01:37:00 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2011-07-06 01:37:00 69632 —-a-w- c:\windows\system32\QuickTime.qts . ============= FINISH: 3:50:34.45 ===============

I'd like to have you run a fresh DDS log please.

Run DDS by sUBs

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.
DDS.txt and Attach.txt



Download and Run GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that may have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one - make sure it is UNCHECKED)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries




Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

You may need more than one post to copy and paste the contents of all these scans. It is certainly find if you need to separate them into multiple posts.

Please be aware that there is no easy quick fix for the infections on your machine. It may take many steps, multiple scans and tools to completely remove it.

Thanks again for your help. 1. I pasted both DDS.txt and attatch.txt. 2. I unchecked the three boxes as instructed then clicked scan it ran for about 8 seconds and the application closed. So i stopped right there. I was tempted to rename GMER.exe to firefox.exe and run it but I did not. how would you like me to proceed? And again I to thank you for your time and energy you put into helping people. DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_22 Run by [removed] at 6:30:00 on 2011-09-30 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1279.1024 [GMT -7:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\2015586727:1486281863.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE . ============== Pseudo HJT Report =============== . uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&ptnrS;=ZRxpt111YYUS&ptb;=z87sVB9IVLQRI6G98pZx3w uSearch Page = uSearch Bar = mSearchAssistant = uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll uURLSearchHooks: H - No File uURLSearchHooks: H - No File BHO: {0063576d-bd60-4bc4-bff3-1e25524aff0c} - c:\documents and settings\david\local settings\application data\TCPIPWMP.dll BHO: {063576d0-bd60-4bc4-bff3-1e25524aff0c} - c:\windows\system32\avicap3232.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\prxtbuTo0.dll TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [cdloader] "c:\documents and settings\david\application data\mjusbsp\cdloader2.exe" MAGICJACK uRun: [cftmon.exe] c:\docume~1\david\locals~1\temp\jre_setup2.exe uRun: [vcheck] c:\docume~1\david\locals~1\temp\vcheck.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [CTHelper] CTHELPER.EXE mRun: [CTxfiHlp] CTXFIHLP.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iSSS2oobF3pG5QJ8234A] c:\windows\system32\LekkIIVrzONyA0.exe mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent IE: &Search; IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: mswsock.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{18DA4C74-83EB-4841-83C5-6520702F0448} : DhcpNameServer = 192.168.1.254 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\david\application data\mozilla\firefox\profiles\2kcjrc06.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource;=3&q;={searchTerms} FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&q;= FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\documents and settings\david\local settings\application data\unity\webplayer\loader\npUnity3D32.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll . —- FIREFOX POLICIES —- . . FF - user.js: extentions.y2layers.installId - 45ea0f10-4e85-4336-b595-7eb1d2a5c488 FF - user.js: extentions.y2layers.defaultEnableAppsList - PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlo bal, . ============= SERVICES / DRIVERS =============== . S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-7-15 136176] S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service –> c:\windows\system32\lxdncoms.exe -service [?] S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [2011-5-27 98984] S2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-4-26 223088] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-7-15 136176] S3 L6PODLV;PODxt Live Service;c:\windows\system32\drivers\L6PODLV.sys [2010-4-2 571136] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-7-17 20480] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2011-7-17 8320] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys –> c:\windows\system32\drivers\motodrv.sys [?] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2011-7-17 24064] S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096] . =============== Created Last 30 ================ . 2011-09-30 02:53:58 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-09-30 02:32:48 ——– d—–w- c:\documents and settings\david\application data\tobF4pmG5Q7E8Rq 2011-09-30 02:32:48 ——– d—–w- c:\documents and settings\david\application data\HXwkUVrlOtPuSiD 2011-09-29 22:51:47 22216 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-09-29 22:06:49 ——– d—–w- c:\documents and settings\david\application data\uJ7dEK8gRqYwUrO 2011-09-29 22:06:49 ——– d—–w- c:\documents and settings\david\application data\FIBzONyxAuSoFpG 2011-09-29 21:27:09 ——– d—–w- c:\documents and settings\david\application data\OtxA0ucS2b3n5Q6 2011-09-29 21:27:08 ——– d—–w- c:\documents and settings\david\application data\wH5sWJ7dE8TqYwI 2011-09-28 21:01:47 ——– d—–w- c:\documents and settings\david\application data\ZG5sQJ7dE8RqYwU 2011-09-28 21:01:47 ——– d—–w- c:\documents and settings\david\application data\krlOBtxP0c1b3n 2011-09-28 21:00:27 ——– d—–w- c:\documents and settings\david\application data\kamH6sWK7E9TqYe 2011-09-28 20:56:39 ——– d—–w- c:\documents and settings\david\application data\S8RhXUVelBz0c1v 2011-09-28 20:56:39 ——– d—–w- c:\documents and settings\david\application data\brlONtA0uSiFpGa 2011-09-28 20:35:45 ——– d—–w- c:\documents and settings\all users\application data\PC Tools 2011-09-28 04:43:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-09-28 04:32:24 ——– d—–w- c:\documents and settings\david\application data\m6dWK8fRZhXjVlB 2011-09-28 04:32:24 ——– d—–w- c:\documents and settings\david\application data\irONtxA0uSiFpGa 2011-09-28 03:59:51 ——– d—–w- c:\documents and settings\david\application data\lRRRZ99hTXwUVlI 2011-09-28 03:59:51 ——– d—–w- c:\documents and settings\david\application data\h555aQQJ6dW8 2011-09-28 03:59:44 2456064 —-a-w- c:\windows\system32\LekkIIVrzONyA0.exe 2011-09-28 03:59:44 ——– d—–w- c:\documents and settings\david\application data\wTTTZqqjYC 2011-09-27 20:22:28 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll 2011-09-27 20:22:28 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll 2011-09-27 20:22:27 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin.dll 2011-09-27 20:21:33 ——– d—–w- c:\documents and settings\david\local settings\application data\Apple 2011-09-27 20:21:09 ——– d—–w- c:\documents and settings\david\local settings\application data\Apple Computer 2011-09-27 17:44:31 ——– d—–w- c:\documents and settings\david\application data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 2011-09-27 17:44:31 ——– d—–w- c:\documents and settings\david\application data\Adobe Mini Bridge CS5 2011-09-26 13:58:34 ——– d—–w- c:\documents and settings\david\local settings\application data\conduitEngine 2011-09-24 20:39:00 265728 —-a-w- c:\documents and settings\david\local settings\application data\TCPIPWMP.dll 2011-09-19 21:07:40 446464 —-a-w- c:\windows\system32\nvudisp.exe 2011-09-19 21:07:40 ——– d—–w- c:\windows\nview 2011-09-19 21:07:23 446464 —-a-w- c:\windows\system32\NVUNINST.EXE 2011-09-19 21:07:18 ——– d—–w- C:\NVIDIA 2011-09-11 15:36:17 ——– d—–w- c:\documents and settings\david\application data\Line 6 2011-09-08 22:09:03 ——– d—–w- c:\program files\VideoLAN 2011-09-05 17:04:56 183696 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll 2011-09-02 13:28:16 ——– d—–w- c:\windows\pss . ==================== Find3M ==================== . 2011-09-27 13:59:30 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-08-17 21:10:53 4400 —-a-w- c:\documents and settings\david\NDK11F.exe 2011-07-17 15:51:13 0 —ha-w- c:\documents and settings\david\nxqliktbgg.tmp 2011-07-08 18:53:19 205312 —-a-w- c:\windows\system32\Logo-Start.scr 2011-07-08 16:45:47 205312 —-a-w- c:\windows\system32\Bottle Glow.scr 2011-07-06 01:37:00 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2011-07-06 01:37:00 69632 —-a-w- c:\windows\system32\QuickTime.qts . ============= FINISH: 6:30:24.51 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 5/20/2011 2:23:06 PM System Uptime: 9/30/2011 6:27:52 AM (0 hours ago) . Motherboard: Intel Corporation | | D875PBZ Processor: Intel® Pentium® 4 CPU 3.00GHz | J2E1 | 2992/200mhz Processor: Intel® Pentium® 4 CPU 3.00GHz | J2E1 | 2992/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 51 GiB total, 10.673 GiB free. D: is FIXED (NTFS) - 98 GiB total, 9.946 GiB free. E: is Removable F: is CDROM (CDFS) G: is CDROM (UDF) H: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Network Controller Device ID: PCI\VEN_1814&DEV;_0301&SUBSYS;_25611814&REV;_00\4&2E98101C&0&20F0 Manufacturer: Name: Network Controller PNP Device ID: PCI\VEN_1814&DEV;_0301&SUBSYS;_25611814&REV;_00\4&2E98101C&0&20F0 Service: . ==== System Restore Points =================== . RP67: 7/17/2011 7:57:48 PM - Installed Windows XP Wdf01007. RP68: 7/17/2011 7:59:28 PM - Installed Motorola Software Update RP69: 7/18/2011 12:41:56 PM - Removed Motorola Phone Tools RP70: 7/19/2011 2:53:33 PM - System Checkpoint RP71: 7/20/2011 3:48:53 PM - System Checkpoint RP72: 7/21/2011 5:12:52 PM - System Checkpoint RP73: 7/22/2011 5:48:52 PM - System Checkpoint RP74: 7/23/2011 6:48:52 PM - System Checkpoint RP75: 7/24/2011 9:05:18 PM - System Checkpoint RP76: 7/25/2011 9:18:39 PM - System Checkpoint RP77: 7/26/2011 10:22:48 PM - System Checkpoint RP78: 7/27/2011 10:48:33 PM - System Checkpoint RP79: 7/28/2011 11:48:33 PM - System Checkpoint RP80: 7/30/2011 4:02:42 AM - System Checkpoint RP81: 7/31/2011 4:32:04 AM - System Checkpoint RP82: 8/1/2011 5:22:34 AM - System Checkpoint RP83: 8/2/2011 6:41:48 AM - System Checkpoint RP84: 8/3/2011 7:37:43 AM - System Checkpoint RP85: 8/4/2011 10:02:49 AM - System Checkpoint RP86: 8/5/2011 11:01:43 AM - System Checkpoint RP87: 8/6/2011 11:51:45 AM - System Checkpoint RP88: 8/7/2011 12:37:43 PM - System Checkpoint RP89: 8/8/2011 12:49:42 PM - System Checkpoint RP90: 8/9/2011 1:37:42 PM - System Checkpoint RP91: 8/11/2011 2:40:22 AM - System Checkpoint RP92: 8/12/2011 3:33:10 AM - System Checkpoint RP93: 8/13/2011 6:08:57 AM - System Checkpoint RP94: 8/14/2011 6:31:07 AM - System Checkpoint RP95: 8/15/2011 7:06:00 AM - System Checkpoint RP96: 8/16/2011 7:31:07 AM - System Checkpoint RP97: 8/17/2011 7:33:26 AM - System Checkpoint RP98: 8/18/2011 8:22:29 AM - System Checkpoint RP99: 8/19/2011 8:28:13 AM - System Checkpoint RP100: 8/20/2011 9:00:09 AM - System Checkpoint RP101: 8/21/2011 9:41:59 AM - System Checkpoint RP102: 8/22/2011 10:28:15 AM - System Checkpoint RP103: 8/23/2011 10:36:04 AM - System Checkpoint RP104: 8/24/2011 12:12:38 PM - System Checkpoint RP105: 8/25/2011 12:36:04 PM - System Checkpoint RP106: 8/26/2011 1:55:10 PM - System Checkpoint RP107: 8/27/2011 2:34:20 PM - System Checkpoint RP108: 8/28/2011 2:36:04 PM - System Checkpoint RP109: 8/29/2011 4:47:40 PM - System Checkpoint RP110: 8/30/2011 5:08:57 PM - System Checkpoint RP111: 8/31/2011 10:16:28 PM - System Checkpoint RP112: 9/1/2011 10:32:03 PM - System Checkpoint RP113: 9/2/2011 10:53:27 PM - System Checkpoint RP114: 9/3/2011 11:45:10 PM - System Checkpoint RP115: 9/5/2011 12:05:37 AM - System Checkpoint RP116: 9/6/2011 1:48:55 PM - System Checkpoint RP117: 9/7/2011 2:02:15 PM - System Checkpoint RP118: 9/8/2011 2:24:57 PM - System Checkpoint RP119: 9/9/2011 2:49:53 PM - System Checkpoint RP120: 9/9/2011 11:14:05 PM - Removed Google Earth Plug-in. RP121: 9/11/2011 12:01:54 AM - System Checkpoint RP122: 9/11/2011 8:38:54 AM - Unsigned driver install RP123: 9/12/2011 9:01:53 AM - System Checkpoint RP124: 9/13/2011 9:25:53 AM - System Checkpoint RP125: 9/14/2011 9:49:54 AM - System Checkpoint RP126: 9/15/2011 10:37:54 AM - System Checkpoint RP127: 9/16/2011 10:47:30 AM - System Checkpoint RP128: 9/17/2011 11:11:31 AM - System Checkpoint RP129: 9/18/2011 12:23:30 PM - System Checkpoint RP130: 9/19/2011 12:47:31 PM - System Checkpoint RP131: 9/20/2011 12:57:13 PM - System Checkpoint RP132: 9/21/2011 9:35:02 PM - System Checkpoint RP133: 9/22/2011 9:54:51 PM - System Checkpoint RP134: 9/23/2011 10:03:59 PM - System Checkpoint RP135: 9/25/2011 12:08:57 AM - System Checkpoint RP136: 9/26/2011 12:21:13 AM - System Checkpoint RP137: 9/27/2011 1:33:11 AM - System Checkpoint RP138: 9/27/2011 1:22:03 PM - Installed QuickTime . ==== Installed Programs ====================== . . µTorrent ABBYY FineReader 6.0 Sprint Adobe Acrobat 5.0 Adobe AIR Adobe Community Help Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Media Player Adobe Photoshop CS5 Adobe Reader X (10.1.1) Apple Application Support Apple Software Update Atomic Alarm Clock 5.9 Bottle Glow Screen Saver Canon Camera Access Library Canon Camera Support Core Library Canon Camera Window DC_DV 5 for ZoomBrowser EX Canon Camera Window DC_DV 6 for ZoomBrowser EX Canon Camera Window MC 6 for ZoomBrowser EX Canon Digital Camera USB WIA Driver Canon G.726 WMP-Decoder Canon MovieEdit Task for ZoomBrowser EX Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities EOS Utility Canon Utilities PhotoStitch Canon Utilities ZoomBrowser EX Creative MediaSource 5 Creative Software AutoUpdate Creative System Information Easy CD-DA Extractor 15 Free WAV To MP3 Converter 2.1 Google Earth Google Talk (remove only) Google Update Helper Hotfix for Windows XP (KB926239) Intel® Active Monitor Intel® PRO Network Connections [removed] Java Auto Updater Java™ 6 Update 22 K-Lite Codec Pack 7.1.8 (Full) Lexmark 2600 Series Lexmark Fax Solutions Lexmark Toolbar Logo-Start Screen Saver magicJack MahJong Suite 2011 v8.2 Malwarebytes' Anti-Malware version 1.51.2.1300 Microsoft .NET Framework 2.0 Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 MotoHelper 2.0.51 Driver 5.2.0 MotoHelper MergeModules Motorola Mobile Drivers Installation 5.2.0 Motorola Software Update Mozilla Firefox 6.0.2 (x86 en-US) Nero 7 Ultra Edition NVIDIA Drivers PDF Settings CS5 PeerBlock 1.1 (r518) PowerDVD PowerISO QuickTime Software Update for Web Folders Sound Blaster X-Fi Unity Web Player uTorrentBar Toolbar VLC media player 1.1.11 WAV MP3 Converter v4.4 build 1429 Windows Media Format 11 runtime WinRAR YouTube Downloader 3.3 . ==== Event Viewer Messages From Past Week ======== . 9/29/2011 3:46:56 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SCDEmu Tcpip 9/29/2011 3:46:56 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning. 9/29/2011 3:46:56 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 9/29/2011 3:46:56 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 9/29/2011 3:46:56 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 9/29/2011 3:45:52 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 9/29/2011 3:42:25 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Documents and Settings\David\My Documents\Downloads\msert.exe. Reference error message: The operation completed successfully. . 9/29/2011 3:42:24 PM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Documents and Settings\David\My Documents\Downloads\msert.exe" on line 0. 9/28/2011 2:00:35 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdn_device service to connect. 9/28/2011 2:00:35 PM, error: Service Control Manager [7000] - The lxdn_device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 9/28/2011 1:42:26 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s). 9/28/2011 1:42:26 PM, error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: Access is denied. 9/28/2011 1:36:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 9/27/2011 9:33:46 PM, error: Service Control Manager [7023] - The Network Location Awareness (NLA) service terminated with the following error: The specified procedure could not be found. 9/27/2011 9:33:46 PM, error: Service Control Manager [7000] - The MBAMService service failed to start due to the following error: Access is denied. 9/27/2011 9:10:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 9/27/2011 9:10:00 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm SCDEmu 9/27/2011 9:09:03 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 9/27/2011 8:56:28 PM, error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s). 9/27/2011 7:08:07 AM, error: Service Control Manager [7031] - The MotoHelper Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service. 9/25/2011 1:43:07 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde 9/25/2011 1:43:07 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdnCATSCustConnectService service to connect. 9/25/2011 1:43:07 PM, error: Service Control Manager [7000] - The lxdnCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 9/25/2011 1:41:38 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. . ==== End Of File ===========================

Please try to run GMER again and let me know what happens. If you get an error, I need to know exactly what it says. Even if GMER doesn't run, please go ahead with the TDSSKiller log making sure to choose skip and not cure. Let me know if you have any additional problems with running these.

I ran Combofix from safe mode with network support with antivirus software unloaded but combofix rebooted machine twice and i just let it do its thing. While in the final seconds of running ComboFix after its second auto reboot OpenCloud security window came up on top of the combofix window. So once it created the log and closed i rebooted safe mode with networking support and retrieved the log and here are the ComboFix results. because it rebooted into normal mode the Virus protection was reactivated. So I uninstalled malwarebytes anti-malware. and ran it a second time so it could run it again the way you said to.

Results for first scan

ComboFix 11-10-01.03 - David 10/01/2011 21:15:16.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1279.959 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Tarma Installer
c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setup.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.dat
c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.exe
c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.ico
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{20c1a76d-a1b7-42f9-b340-233c2c685b81}
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{20c1a76d-a1b7-42f9-b340-233c2c685b81}\chrome.manifest
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{20c1a76d-a1b7-42f9-b340-233c2c685b81}\chrome\xulcache.jar
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{20c1a76d-a1b7-42f9-b340-233c2c685b81}\defaults\preferences\xulcache.js
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{20c1a76d-a1b7-42f9-b340-233c2c685b81}\install.rdf
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{461ac1fd-2a2b-4085-8ca0-fe10f1085ba7}
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{461ac1fd-2a2b-4085-8ca0-fe10f1085ba7}\chrome.manifest
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{461ac1fd-2a2b-4085-8ca0-fe10f1085ba7}\chrome\xulcache.jar
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{461ac1fd-2a2b-4085-8ca0-fe10f1085ba7}\defaults\preferences\xulcache.js
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{461ac1fd-2a2b-4085-8ca0-fe10f1085ba7}\install.rdf
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{67aab23f-2055-4746-899a-96e13f92c9a9}
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{67aab23f-2055-4746-899a-96e13f92c9a9}\chrome.manifest
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{67aab23f-2055-4746-899a-96e13f92c9a9}\chrome\xulcache.jar
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{67aab23f-2055-4746-899a-96e13f92c9a9}\defaults\preferences\xulcache.js
c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\extensions\{67aab23f-2055-4746-899a-96e13f92c9a9}\install.rdf
c:\documents and settings\David\Application Data\PriceGong
c:\documents and settings\David\Application Data\PriceGong\Data\1.xml
c:\documents and settings\David\Application Data\PriceGong\Data\a.xml
c:\documents and settings\David\Application Data\PriceGong\Data\b.xml
c:\documents and settings\David\Application Data\PriceGong\Data\c.xml
c:\documents and settings\David\Application Data\PriceGong\Data\d.xml
c:\documents and settings\David\Application Data\PriceGong\Data\e.xml
c:\documents and settings\David\Application Data\PriceGong\Data\f.xml
c:\documents and settings\David\Application Data\PriceGong\Data\g.xml
c:\documents and settings\David\Application Data\PriceGong\Data\h.xml
c:\documents and settings\David\Application Data\PriceGong\Data\i.xml
c:\documents and settings\David\Application Data\PriceGong\Data\j.xml
c:\documents and settings\David\Application Data\PriceGong\Data\k.xml
c:\documents and settings\David\Application Data\PriceGong\Data\l.xml
c:\documents and settings\David\Application Data\PriceGong\Data\m.xml
c:\documents and settings\David\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\David\Application Data\PriceGong\Data\n.xml
c:\documents and settings\David\Application Data\PriceGong\Data\nxqliktbgg.tmp
c:\documents and settings\David\Application Data\PriceGong\Data\o.xml
c:\documents and settings\David\Application Data\PriceGong\Data\p.xml
c:\documents and settings\David\Application Data\PriceGong\Data\q.xml
c:\documents and settings\David\Application Data\PriceGong\Data\r.xml
c:\documents and settings\David\Application Data\PriceGong\Data\s.xml
c:\documents and settings\David\Application Data\PriceGong\Data\t.xml
c:\documents and settings\David\Application Data\PriceGong\Data\u.xml
c:\documents and settings\David\Application Data\PriceGong\Data\v.xml
c:\documents and settings\David\Application Data\PriceGong\Data\w.xml
c:\documents and settings\David\Application Data\PriceGong\Data\x.xml
c:\documents and settings\David\Application Data\PriceGong\Data\y.xml
c:\documents and settings\David\Application Data\PriceGong\Data\z.xml
c:\documents and settings\David\Local Settings\Application Data\TCPIPWMP.dll
c:\documents and settings\David\mail.dat
c:\documents and settings\David\mess.dat
c:\documents and settings\David\NDK11F.exe
c:\documents and settings\David\nxqliktbgg.tmp
c:\documents and settings\David\WINDOWS
c:\program files\messenger\msmsgsin.exe
c:\windows\$NtUninstallKB31726$
c:\windows\$NtUninstallKB31726$\2808685432\@
c:\windows\$NtUninstallKB31726$\2808685432\bckfg.tmp
c:\windows\$NtUninstallKB31726$\2808685432\cfg.ini
c:\windows\$NtUninstallKB31726$\2808685432\Desktop.ini
c:\windows\$NtUninstallKB31726$\2808685432\keywords
c:\windows\$NtUninstallKB31726$\2808685432\kwrd.dll
c:\windows\$NtUninstallKB31726$\2808685432\L\icyanozi
c:\windows\$NtUninstallKB31726$\2808685432\lsflt7.ver
c:\windows\$NtUninstallKB31726$\2808685432\U\00000001.@
c:\windows\$NtUninstallKB31726$\2808685432\U\00000002.@
c:\windows\$NtUninstallKB31726$\2808685432\U\80000000.@
c:\windows\$NtUninstallKB31726$\2808685432\U\80000032.@
c:\windows\$NtUninstallKB31726$\3179408289
c:\windows\kb913800.exe
c:\windows\system32\d3d9caps.dat
c:\windows\system32\winlogon.bak
.
Infected copy of c:\windows\system32\drivers\afd.sys was found and disinfected
Restored copy from - The cat found it
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_MYWEBSEARCHSERVICE
——-\Service_a7692378
.
.
((((((((((((((((((((((((( Files Created from 2011-09-02 to 2011-10-02 )))))))))))))))))))))))))))))))
.
.
2011-10-02 04:25 . 2011-10-02 04:25 ——– d—–w- c:\documents and settings\David\Application Data\r6dWK8fZ9
2011-10-02 04:25 . 2011-10-02 04:25 ——– d—–w- c:\documents and settings\David\Application Data\EA0ucS2ib3n5Q
2011-10-02 04:12 . 2004-08-03 22:14 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys
2011-10-02 04:12 . 2004-08-03 22:14 138496 —-a-w- c:\windows\system32\drivers\afd.sys
2011-09-30 02:59 . 2011-09-30 02:59 ——– d—–w- c:\documents and settings\test
2011-09-30 02:53 . 2011-09-30 03:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-30 02:32 . 2011-09-30 02:32 ——– d—–w- c:\documents and settings\David\Application Data\tobF4pmG5Q7E8Rq
2011-09-30 02:32 . 2011-09-30 02:32 ——– d—–w- c:\documents and settings\David\Application Data\HXwkUVrlOtPuSiD
2011-09-29 22:51 . 2011-09-01 00:00 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-09-29 22:45 . 2011-09-29 22:45 ——– d—–w- c:\documents and settings\Administrator
2011-09-29 22:06 . 2011-09-29 22:06 ——– d—–w- c:\documents and settings\David\Application Data\uJ7dEK8gRqYwUrO
2011-09-29 22:06 . 2011-09-29 22:06 ——– d—–w- c:\documents and settings\David\Application Data\FIBzONyxAuSoFpG
2011-09-29 21:52 . 2011-09-29 21:52 ——– d-s—w- c:\documents and settings\LocalService\UserData
2011-09-29 21:27 . 2011-09-29 21:27 ——– d—–w- c:\documents and settings\David\Application Data\OtxA0ucS2b3n5Q6
2011-09-29 21:27 . 2011-09-29 21:27 ——– d—–w- c:\documents and settings\David\Application Data\wH5sWJ7dE8TqYwI
2011-09-28 21:15 . 2011-09-28 21:15 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2011-09-28 21:01 . 2011-09-28 21:01 ——– d—–w- c:\documents and settings\David\Application Data\ZG5sQJ7dE8RqYwU
2011-09-28 21:01 . 2011-09-28 21:01 ——– d—–w- c:\documents and settings\David\Application Data\krlOBtxP0c1b3n
2011-09-28 21:00 . 2011-09-28 21:00 ——– d—–w- c:\documents and settings\David\Application Data\kamH6sWK7E9TqYe
2011-09-28 20:56 . 2011-09-28 20:56 ——– d—–w- c:\documents and settings\David\Application Data\S8RhXUVelBz0c1v
2011-09-28 20:56 . 2011-09-28 20:56 ——– d—–w- c:\documents and settings\David\Application Data\brlONtA0uSiFpGa
2011-09-28 20:35 . 2011-09-29 22:15 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2011-09-28 04:43 . 2011-09-30 03:02 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-09-28 04:32 . 2011-09-28 04:32 ——– d—–w- c:\documents and settings\David\Application Data\m6dWK8fRZhXjVlB
2011-09-28 04:32 . 2011-09-28 04:32 ——– d—–w- c:\documents and settings\David\Application Data\irONtxA0uSiFpGa
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\lRRRZ99hTXwUVlI
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\h555aQQJ6dW8
2011-09-28 03:59 . 2011-09-28 03:59 2456064 —-a-w- c:\windows\system32\LekkIIVrzONyA0.exe
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\wTTTZqqjYC
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2011-09-27 20:22 . 2011-09-27 20:22 ——– d—–w- c:\program files\QuickTime
2011-09-27 20:22 . 2011-09-27 20:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\program files\Common Files\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\program files\Apple Software Update
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\Apple Computer
2011-09-27 17:44 . 2011-09-27 17:44 ——– d—–w- c:\documents and settings\David\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-09-27 17:44 . 2011-09-27 17:44 ——– d—–w- c:\documents and settings\David\Application Data\Adobe Mini Bridge CS5
2011-09-26 13:58 . 2011-09-26 13:58 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\conduitEngine
2011-09-25 01:45 . 2011-09-25 01:45 ——– d—–w- c:\documents and settings\David\Application Data\OurPictures
2011-09-19 21:07 . 2011-09-19 21:07 ——– d—–w- c:\windows\nview
2011-09-19 21:07 . 2008-05-16 21:01 446464 —-a-w- c:\windows\system32\nvudisp.exe
2011-09-19 21:07 . 2008-05-16 18:48 446464 —-a-w- c:\windows\system32\NVUNINST.EXE
2011-09-19 21:07 . 2011-09-19 21:07 ——– d—–w- C:\NVIDIA
2011-09-11 15:36 . 2011-09-11 15:36 ——– d—–w- c:\documents and settings\David\Application Data\Line 6
2011-09-08 22:09 . 2011-09-08 22:20 ——– d—–w- c:\documents and settings\David\Application Data\vlc
2011-09-08 22:09 . 2011-09-08 22:09 ——– d—–w- c:\program files\VideoLAN
2011-09-05 17:04 . 2011-09-05 17:04 183696 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-27 13:59 . 2011-05-20 14:42 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 18:53 . 2011-07-08 18:53 205312 —-a-w- c:\windows\system32\Logo-Start.scr
2011-07-08 16:45 . 2011-07-08 16:45 205312 —-a-w- c:\windows\system32\Bottle Glow.scr
2011-07-06 01:37 . 2011-07-06 01:37 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-06 01:37 . 2011-07-06 01:37 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-09-03 06:01 . 2011-09-27 14:07 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49 176936 —-a-w- c:\program files\uTorrentBar\prxtbuTo0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\David\Application Data\mjusbsp\cdloader2.exe" [2011-08-23 50592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2006-05-24 17920]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 18944]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888]
"iSSS2oobF3pG5QJ8234A"="c:\windows\system32\LekkIIVrzONyA0.exe" [2011-09-28 2456064]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 19:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 10:44 500208 ——w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 11:57 406992 —-a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-11-17 02:04 139264 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
2009-01-29 15:43 320168 —-a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnamon]
2009-01-29 15:43 16040 —-a-w- c:\program files\Lexmark 2600 Series\lxdnamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnmon.exe]
2009-01-29 15:43 660136 —-a-w- c:\program files\Lexmark 2600 Series\lxdnmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2006-11-20 16:51 1694208 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mumservice]
2011-06-03 22:58 1066304 —-a-w- c:\program files\Motorola\Software Update\mumservice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 22:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2010-04-12 08:40 180224 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
2010-06-09 19:41 1726976 —-a-w- c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 20:37 517096 —-a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 08:00 90112 ——w- c:\windows\Updreg.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\lxdncoms.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Documents and Settings\\David\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"=
.
R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service –> c:\windows\system32\lxdncoms.exe -service [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/29/2011 3:51 PM 366152]
R2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [4/26/2011 1:23 PM 223088]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/29/2011 3:51 PM 22216]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2011 4:56 PM 136176]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [5/27/2011 6:26 AM 98984]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2011 4:56 PM 136176]
S3 L6PODLV;PODxt Live Service;c:\windows\system32\drivers\L6PODLV.sys [4/2/2010 6:28 PM 571136]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/17/2011 7:56 PM 20480]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/17/2011 7:56 PM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys –> c:\windows\system32\DRIVERS\motodrv.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/17/2011 7:56 PM 24064]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 1:37 PM 517096]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MBAMPROTECTOR
*NewlyCreated* - MBAMSERVICE
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-15 23:56]
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-15 23:56]
.
2011-09-16 c:\windows\Tasks\MotoHelper MUM.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
2011-09-28 c:\windows\Tasks\MotoHelper Routing.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
2011-09-16 c:\windows\Tasks\MotoHelper Update.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&ptnrS;=ZRxpt111YYUS&ptb;=z87sVB9IVLQRI6G98pZx3w
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource;=3&q;={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&q;=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 45ea0f10-4e85-4336-b595-7eb1d2a5c488
FF - user.js: extentions.y2layers.defaultEnableAppsList - PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlo
bal,
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{063576D0-BD60-4BC4-BFF3-1E25524AFF0c} - c:\windows\system32\avicap3232.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-01 21:25
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2804)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\CTsvcCDA.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lxdncoms.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Motorola\MotoHelper\MotoHelperAgent.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Completion time: 2011-10-01 21:26:59 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-02 04:26
.
Pre-Run: 11,333,361,664 bytes free
Post-Run: 15,351,115,776 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 2C5EF59CFFBA84BA8AF1DB61D7E6C499



Results for second scan

ComboFix 11-10-01.03 - David 10/01/2011 21:47:09.2.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1279.1007 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\d3d9caps.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-09-02 to 2011-10-02 )))))))))))))))))))))))))))))))
.
.
2011-10-02 04:25 . 2011-10-02 04:25 ——– d—–w- c:\documents and settings\David\Application Data\r6dWK8fZ9
2011-10-02 04:25 . 2011-10-02 04:25 ——– d—–w- c:\documents and settings\David\Application Data\EA0ucS2ib3n5Q
2011-10-02 04:12 . 2004-08-03 22:14 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys
2011-10-02 04:12 . 2004-08-03 22:14 138496 —-a-w- c:\windows\system32\drivers\afd.sys
2011-09-30 02:59 . 2011-09-30 02:59 ——– d—–w- c:\documents and settings\test
2011-09-30 02:53 . 2011-09-30 03:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-30 02:32 . 2011-09-30 02:32 ——– d—–w- c:\documents and settings\David\Application Data\tobF4pmG5Q7E8Rq
2011-09-30 02:32 . 2011-09-30 02:32 ——– d—–w- c:\documents and settings\David\Application Data\HXwkUVrlOtPuSiD
2011-09-29 22:45 . 2011-09-29 22:45 ——– d—–w- c:\documents and settings\Administrator
2011-09-29 22:06 . 2011-09-29 22:06 ——– d—–w- c:\documents and settings\David\Application Data\uJ7dEK8gRqYwUrO
2011-09-29 22:06 . 2011-09-29 22:06 ——– d—–w- c:\documents and settings\David\Application Data\FIBzONyxAuSoFpG
2011-09-29 21:52 . 2011-09-29 21:52 ——– d-s—w- c:\documents and settings\LocalService\UserData
2011-09-29 21:27 . 2011-09-29 21:27 ——– d—–w- c:\documents and settings\David\Application Data\OtxA0ucS2b3n5Q6
2011-09-29 21:27 . 2011-09-29 21:27 ——– d—–w- c:\documents and settings\David\Application Data\wH5sWJ7dE8TqYwI
2011-09-28 21:15 . 2011-09-28 21:15 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2011-09-28 21:01 . 2011-09-28 21:01 ——– d—–w- c:\documents and settings\David\Application Data\ZG5sQJ7dE8RqYwU
2011-09-28 21:01 . 2011-09-28 21:01 ——– d—–w- c:\documents and settings\David\Application Data\krlOBtxP0c1b3n
2011-09-28 21:00 . 2011-09-28 21:00 ——– d—–w- c:\documents and settings\David\Application Data\kamH6sWK7E9TqYe
2011-09-28 20:56 . 2011-09-28 20:56 ——– d—–w- c:\documents and settings\David\Application Data\S8RhXUVelBz0c1v
2011-09-28 20:56 . 2011-09-28 20:56 ——– d—–w- c:\documents and settings\David\Application Data\brlONtA0uSiFpGa
2011-09-28 20:35 . 2011-09-29 22:15 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2011-09-28 04:43 . 2011-10-02 04:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-09-28 04:32 . 2011-09-28 04:32 ——– d—–w- c:\documents and settings\David\Application Data\m6dWK8fRZhXjVlB
2011-09-28 04:32 . 2011-09-28 04:32 ——– d—–w- c:\documents and settings\David\Application Data\irONtxA0uSiFpGa
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\lRRRZ99hTXwUVlI
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\h555aQQJ6dW8
2011-09-28 03:59 . 2011-09-28 03:59 2456064 —-a-w- c:\windows\system32\LekkIIVrzONyA0.exe
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\wTTTZqqjYC
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2011-09-27 20:22 . 2011-09-27 20:22 ——– d—–w- c:\program files\QuickTime
2011-09-27 20:22 . 2011-09-27 20:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\program files\Common Files\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\program files\Apple Software Update
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\Apple Computer
2011-09-27 17:44 . 2011-09-27 17:44 ——– d—–w- c:\documents and settings\David\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-09-27 17:44 . 2011-09-27 17:44 ——– d—–w- c:\documents and settings\David\Application Data\Adobe Mini Bridge CS5
2011-09-26 13:58 . 2011-09-26 13:58 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\conduitEngine
2011-09-25 01:45 . 2011-09-25 01:45 ——– d—–w- c:\documents and settings\David\Application Data\OurPictures
2011-09-19 21:07 . 2011-09-19 21:07 ——– d—–w- c:\windows\nview
2011-09-19 21:07 . 2008-05-16 21:01 446464 —-a-w- c:\windows\system32\nvudisp.exe
2011-09-19 21:07 . 2008-05-16 18:48 446464 —-a-w- c:\windows\system32\NVUNINST.EXE
2011-09-19 21:07 . 2011-09-19 21:07 ——– d—–w- C:\NVIDIA
2011-09-11 15:36 . 2011-09-11 15:36 ——– d—–w- c:\documents and settings\David\Application Data\Line 6
2011-09-08 22:09 . 2011-09-08 22:20 ——– d—–w- c:\documents and settings\David\Application Data\vlc
2011-09-08 22:09 . 2011-09-08 22:09 ——– d—–w- c:\program files\VideoLAN
2011-09-05 17:04 . 2011-09-05 17:04 183696 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-27 13:59 . 2011-05-20 14:42 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 18:53 . 2011-07-08 18:53 205312 —-a-w- c:\windows\system32\Logo-Start.scr
2011-07-08 16:45 . 2011-07-08 16:45 205312 —-a-w- c:\windows\system32\Bottle Glow.scr
2011-07-06 01:37 . 2011-07-06 01:37 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-06 01:37 . 2011-07-06 01:37 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-09-03 06:01 . 2011-09-27 14:07 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49 176936 —-a-w- c:\program files\uTorrentBar\prxtbuTo0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\David\Application Data\mjusbsp\cdloader2.exe" [2011-08-23 50592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2006-05-24 17920]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 18944]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888]
"iSSS2oobF3pG5QJ8234A"="c:\windows\system32\LekkIIVrzONyA0.exe" [2011-09-28 2456064]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 19:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 10:44 500208 ——w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 11:57 406992 —-a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-11-17 02:04 139264 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
2009-01-29 15:43 320168 —-a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnamon]
2009-01-29 15:43 16040 —-a-w- c:\program files\Lexmark 2600 Series\lxdnamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnmon.exe]
2009-01-29 15:43 660136 —-a-w- c:\program files\Lexmark 2600 Series\lxdnmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2006-11-20 16:51 1694208 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mumservice]
2011-06-03 22:58 1066304 —-a-w- c:\program files\Motorola\Software Update\mumservice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 22:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2010-04-12 08:40 180224 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
2010-06-09 19:41 1726976 —-a-w- c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 20:37 517096 —-a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 08:00 90112 ——w- c:\windows\Updreg.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\lxdncoms.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Documents and Settings\\David\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"=
.
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2011 4:56 PM 136176]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service –> c:\windows\system32\lxdncoms.exe -service [?]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [5/27/2011 6:26 AM 98984]
S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [4/26/2011 1:23 PM 223088]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2011 4:56 PM 136176]
S3 L6PODLV;PODxt Live Service;c:\windows\system32\drivers\L6PODLV.sys [4/2/2010 6:28 PM 571136]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/17/2011 7:56 PM 20480]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/17/2011 7:56 PM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys –> c:\windows\system32\DRIVERS\motodrv.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/17/2011 7:56 PM 24064]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 1:37 PM 517096]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-15 23:56]
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-15 23:56]
.
2011-09-16 c:\windows\Tasks\MotoHelper MUM.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
2011-09-28 c:\windows\Tasks\MotoHelper Routing.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
2011-09-16 c:\windows\Tasks\MotoHelper Update.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&ptnrS;=ZRxpt111YYUS&ptb;=z87sVB9IVLQRI6G98pZx3w
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource;=3&q;={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&q;=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 45ea0f10-4e85-4336-b595-7eb1d2a5c488
FF - user.js: extentions.y2layers.defaultEnableAppsList - PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlo
bal,
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-01 21:51
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-10-01 21:52:22
ComboFix-quarantined-files.txt 2011-10-02 04:52
ComboFix2.txt 2011-10-02 04:27
.
Pre-Run: 15,357,100,032 bytes free
Post-Run: 15,343,570,944 bytes free
.
- - End Of File - - 80FB493E14939ADF761CECF84081EEB1

We will be using Combofix again but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/index.php?showtopic=120607&view=findpost&p=752122

Collect::
c:\windows\system32\LekkIIVrzONyA0.exe

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below. ComboFix may request an update; please allow it.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

Please post the Combofix log in your next reply and let me know how your machine is running now.





Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

I

ComboFix 11-10-01.03 - David 10/01/2011 22:26:35.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1279.922 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-09-02 to 2011-10-02 )))))))))))))))))))))))))))))))
.
.
2011-10-02 05:24 . 2011-10-02 05:24 ——– d—–w- c:\documents and settings\David\Application Data\EcA1uvD2oFpHsJd
2011-10-02 05:24 . 2011-10-02 05:24 ——– d—–w- c:\documents and settings\David\Application Data\y7fRL9hTXjClBzN
2011-10-02 04:25 . 2011-10-02 04:25 ——– d—–w- c:\documents and settings\David\Application Data\r6dWK8fZ9
2011-10-02 04:25 . 2011-10-02 04:25 ——– d—–w- c:\documents and settings\David\Application Data\EA0ucS2ib3n5Q
2011-10-02 04:12 . 2004-08-03 22:14 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys
2011-10-02 04:12 . 2004-08-03 22:14 138496 —-a-w- c:\windows\system32\drivers\afd.sys
2011-09-30 02:59 . 2011-09-30 02:59 ——– d—–w- c:\documents and settings\test
2011-09-30 02:53 . 2011-09-30 03:02 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-30 02:32 . 2011-09-30 02:32 ——– d—–w- c:\documents and settings\David\Application Data\tobF4pmG5Q7E8Rq
2011-09-30 02:32 . 2011-09-30 02:32 ——– d—–w- c:\documents and settings\David\Application Data\HXwkUVrlOtPuSiD
2011-09-29 22:45 . 2011-09-29 22:45 ——– d—–w- c:\documents and settings\Administrator
2011-09-29 22:06 . 2011-09-29 22:06 ——– d—–w- c:\documents and settings\David\Application Data\uJ7dEK8gRqYwUrO
2011-09-29 22:06 . 2011-09-29 22:06 ——– d—–w- c:\documents and settings\David\Application Data\FIBzONyxAuSoFpG
2011-09-29 21:52 . 2011-09-29 21:52 ——– d-s—w- c:\documents and settings\LocalService\UserData
2011-09-29 21:27 . 2011-09-29 21:27 ——– d—–w- c:\documents and settings\David\Application Data\OtxA0ucS2b3n5Q6
2011-09-29 21:27 . 2011-09-29 21:27 ——– d—–w- c:\documents and settings\David\Application Data\wH5sWJ7dE8TqYwI
2011-09-28 21:15 . 2011-09-28 21:15 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2011-09-28 21:01 . 2011-09-28 21:01 ——– d—–w- c:\documents and settings\David\Application Data\ZG5sQJ7dE8RqYwU
2011-09-28 21:01 . 2011-09-28 21:01 ——– d—–w- c:\documents and settings\David\Application Data\krlOBtxP0c1b3n
2011-09-28 21:00 . 2011-09-28 21:00 ——– d—–w- c:\documents and settings\David\Application Data\kamH6sWK7E9TqYe
2011-09-28 20:56 . 2011-09-28 20:56 ——– d—–w- c:\documents and settings\David\Application Data\S8RhXUVelBz0c1v
2011-09-28 20:56 . 2011-09-28 20:56 ——– d—–w- c:\documents and settings\David\Application Data\brlONtA0uSiFpGa
2011-09-28 20:35 . 2011-09-29 22:15 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2011-09-28 04:43 . 2011-10-02 04:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-09-28 04:32 . 2011-09-28 04:32 ——– d—–w- c:\documents and settings\David\Application Data\m6dWK8fRZhXjVlB
2011-09-28 04:32 . 2011-09-28 04:32 ——– d—–w- c:\documents and settings\David\Application Data\irONtxA0uSiFpGa
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\lRRRZ99hTXwUVlI
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\h555aQQJ6dW8
2011-09-28 03:59 . 2011-09-28 03:59 2456064 —-a-w- c:\windows\system32\LekkIIVrzONyA0.exe
2011-09-28 03:59 . 2011-09-28 03:59 ——– d—–w- c:\documents and settings\David\Application Data\wTTTZqqjYC
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2011-09-27 20:22 . 2011-09-27 20:22 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2011-09-27 20:22 . 2011-09-27 20:22 ——– d—–w- c:\program files\QuickTime
2011-09-27 20:22 . 2011-09-27 20:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\program files\Common Files\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\program files\Apple Software Update
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2011-09-27 20:21 . 2011-09-27 20:21 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\Apple Computer
2011-09-27 17:44 . 2011-09-27 17:44 ——– d—–w- c:\documents and settings\David\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-09-27 17:44 . 2011-09-27 17:44 ——– d—–w- c:\documents and settings\David\Application Data\Adobe Mini Bridge CS5
2011-09-26 13:58 . 2011-09-26 13:58 ——– d—–w- c:\documents and settings\David\Local Settings\Application Data\conduitEngine
2011-09-25 01:45 . 2011-09-25 01:45 ——– d—–w- c:\documents and settings\David\Application Data\OurPictures
2011-09-19 21:07 . 2011-09-19 21:07 ——– d—–w- c:\windows\nview
2011-09-19 21:07 . 2008-05-16 21:01 446464 —-a-w- c:\windows\system32\nvudisp.exe
2011-09-19 21:07 . 2008-05-16 18:48 446464 —-a-w- c:\windows\system32\NVUNINST.EXE
2011-09-19 21:07 . 2011-09-19 21:07 ——– d—–w- C:\NVIDIA
2011-09-11 15:36 . 2011-09-11 15:36 ——– d—–w- c:\documents and settings\David\Application Data\Line 6
2011-09-08 22:09 . 2011-09-08 22:20 ——– d—–w- c:\documents and settings\David\Application Data\vlc
2011-09-08 22:09 . 2011-09-08 22:09 ——– d—–w- c:\program files\VideoLAN
2011-09-05 17:04 . 2011-09-05 17:04 183696 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-27 13:59 . 2011-05-20 14:42 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 18:53 . 2011-07-08 18:53 205312 —-a-w- c:\windows\system32\Logo-Start.scr
2011-07-08 16:45 . 2011-07-08 16:45 205312 —-a-w- c:\windows\system32\Bottle Glow.scr
2011-07-06 01:37 . 2011-07-06 01:37 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-06 01:37 . 2011-07-06 01:37 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-09-03 06:01 . 2011-09-27 14:07 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-10-02_04.25.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-02 05:24 . 2011-10-02 05:24 16384 c:\windows\temp\Perflib_Perfdata_6e4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49 176936 —-a-w- c:\program files\uTorrentBar\prxtbuTo0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\prxtbuTo0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\David\Application Data\mjusbsp\cdloader2.exe" [2011-08-23 50592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2006-05-24 17920]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 18944]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888]
"iSSS2oobF3pG5QJ8234A"="c:\windows\system32\LekkIIVrzONyA0.exe" [2011-09-28 2456064]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 19:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 10:44 500208 ——w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 11:57 406992 —-a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-11-17 02:04 139264 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
2009-01-29 15:43 320168 —-a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnamon]
2009-01-29 15:43 16040 —-a-w- c:\program files\Lexmark 2600 Series\lxdnamon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnmon.exe]
2009-01-29 15:43 660136 —-a-w- c:\program files\Lexmark 2600 Series\lxdnmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2006-11-20 16:51 1694208 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mumservice]
2011-06-03 22:58 1066304 —-a-w- c:\program files\Motorola\Software Update\mumservice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 22:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2010-04-12 08:40 180224 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
2010-06-09 19:41 1726976 —-a-w- c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 18:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 20:37 517096 —-a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 08:00 90112 ——w- c:\windows\Updreg.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\lxdncoms.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnamon.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"=
"c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=
"c:\\Program Files\\Motorola\\Software Update\\msu.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Documents and Settings\\David\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Administrator\\Application Data\\mjusbsp\\magicJack.exe"=
.
R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service –> c:\windows\system32\lxdncoms.exe -service [?]
R2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [4/26/2011 1:23 PM 223088]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2011 4:56 PM 136176]
S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [5/27/2011 6:26 AM 98984]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/15/2011 4:56 PM 136176]
S3 L6PODLV;PODxt Live Service;c:\windows\system32\drivers\L6PODLV.sys [4/2/2010 6:28 PM 571136]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/17/2011 7:56 PM 20480]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/17/2011 7:56 PM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys –> c:\windows\system32\DRIVERS\motodrv.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/17/2011 7:56 PM 24064]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 1:37 PM 517096]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-15 23:56]
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-15 23:56]
.
2011-09-16 c:\windows\Tasks\MotoHelper MUM.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
2011-09-28 c:\windows\Tasks\MotoHelper Routing.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
2011-09-16 c:\windows\Tasks\MotoHelper Update.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26 20:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&ptnrS=ZRxpt111YYUS&ptb=z87sVB9IVLQRI6G98pZx3w
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\2kcjrc06.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 45ea0f10-4e85-4336-b595-7eb1d2a5c488
FF - user.js: extentions.y2layers.defaultEnableAppsList - PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlo
bal,
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-01 22:30
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2752)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-10-01 22:31:24
ComboFix-quarantined-files.txt 2011-10-02 05:31
ComboFix2.txt 2011-10-02 04:52
ComboFix3.txt 2011-10-02 04:27
.
Pre-Run: 15,327,678,464 bytes free
Post-Run: 15,312,994,304 bytes free
.
- - End Of File - - 9A19D11CE1B17D02D23F93B902112606




20:04:36.0640 1456 TDSS rootkit removing tool [removed] Sep 26 2011 18:56:43
20:04:37.0140 1456 ============================================================
20:04:37.0140 1456 Current date / time: 2011/10/02 20:04:37.0140
20:04:37.0140 1456 SystemInfo:
20:04:37.0140 1456
20:04:37.0140 1456 OS Version: 5.1.2600 ServicePack: 2.0
20:04:37.0140 1456 Product type: Workstation
20:04:37.0140 1456 ComputerName: BUTCHER-ES8E5J7
20:04:37.0140 1456 UserName: David
20:04:37.0140 1456 Windows directory: C:\WINDOWS
20:04:37.0140 1456 System windows directory: C:\WINDOWS
20:04:37.0140 1456 Processor architecture: Intel x86
20:04:37.0140 1456 Number of processors: 2
20:04:37.0140 1456 Page size: 0x1000
20:04:37.0140 1456 Boot type: Normal boot
20:04:37.0140 1456 ============================================================
20:04:38.0281 1456 Initialize success
20:04:41.0218 1324 ============================================================
20:04:41.0218 1324 Scan started
20:04:41.0218 1324 Mode: Manual;
20:04:41.0218 1324 ============================================================
20:04:41.0921 1324 Abiosdsk - ok
20:04:41.0921 1324 abp480n5 - ok
20:04:41.0968 1324 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:04:41.0968 1324 ACPI - ok
20:04:42.0031 1324 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:04:42.0031 1324 ACPIEC - ok
20:04:42.0031 1324 adpu160m - ok
20:04:42.0078 1324 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
20:04:42.0078 1324 aec - ok
20:04:42.0125 1324 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
20:04:42.0125 1324 AFD - ok
20:04:42.0140 1324 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
20:04:42.0140 1324 agp440 - ok
20:04:42.0156 1324 Aha154x - ok
20:04:42.0171 1324 aic78u2 - ok
20:04:42.0187 1324 aic78xx - ok
20:04:42.0203 1324 AliIde - ok
20:04:42.0234 1324 allegro (bc129f409af5fcf46e978c1c144e31be) C:\WINDOWS\system32\drivers\es198x.sys
20:04:42.0234 1324 allegro - ok
20:04:42.0265 1324 amsint - ok
20:04:42.0281 1324 asc - ok
20:04:42.0296 1324 asc3350p - ok
20:04:42.0312 1324 asc3550 - ok
20:04:42.0343 1324 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:04:42.0343 1324 AsyncMac - ok
20:04:42.0375 1324 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:04:42.0375 1324 atapi - ok
20:04:42.0390 1324 Atdisk - ok
20:04:42.0406 1324 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:04:42.0406 1324 Atmarpc - ok
20:04:42.0437 1324 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:04:42.0437 1324 audstub - ok
20:04:42.0453 1324 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:04:42.0453 1324 Beep - ok
20:04:42.0515 1324 catchme - ok
20:04:42.0546 1324 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:04:42.0546 1324 cbidf2k - ok
20:04:42.0562 1324 cd20xrnt - ok
20:04:42.0578 1324 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:04:42.0578 1324 Cdaudio - ok
20:04:42.0578 1324 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
20:04:42.0593 1324 Cdfs - ok
20:04:42.0609 1324 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:04:42.0609 1324 Cdrom - ok
20:04:42.0625 1324 Changer - ok
20:04:42.0640 1324 CmdIde - ok
20:04:42.0671 1324 Cpqarray - ok
20:04:42.0750 1324 ctac32k (04a43d6b00bf09b2d5cffcd3c5790741) C:\WINDOWS\system32\drivers\ctac32k.sys
20:04:42.0750 1324 ctac32k - ok
20:04:42.0781 1324 ctaud2k (f501738d0bf4de69f7307109efa0246c) C:\WINDOWS\system32\drivers\ctaud2k.sys
20:04:42.0796 1324 ctaud2k - ok
20:04:42.0843 1324 ctdvda2k (c4333325d325efa668888d0d3177c6ff) C:\WINDOWS\system32\drivers\ctdvda2k.sys
20:04:42.0843 1324 ctdvda2k - ok
20:04:42.0875 1324 ctprxy2k (e3aad66077b2594503ab11a31c3d2e7d) C:\WINDOWS\system32\drivers\ctprxy2k.sys
20:04:42.0875 1324 ctprxy2k - ok
20:04:42.0906 1324 ctsfm2k (72c73af1a60321d7e3aaa61859a32f0b) C:\WINDOWS\system32\drivers\ctsfm2k.sys
20:04:42.0906 1324 ctsfm2k - ok
20:04:42.0906 1324 dac2w2k - ok
20:04:42.0921 1324 dac960nt - ok
20:04:42.0968 1324 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
20:04:42.0968 1324 Disk - ok
20:04:43.0031 1324 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
20:04:43.0125 1324 dmboot - ok
20:04:43.0453 1324 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\DRIVERS\dmio.sys
20:04:43.0500 1324 dmio - ok
20:04:43.0562 1324 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:04:43.0562 1324 dmload - ok
20:04:43.0593 1324 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
20:04:43.0593 1324 DMusic - ok
20:04:43.0609 1324 dpti2o - ok
20:04:43.0640 1324 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
20:04:43.0640 1324 drmkaud - ok
20:04:43.0671 1324 E1000 (4de4bae4accb5a49fa85801d4f226355) C:\WINDOWS\system32\DRIVERS\e1000325.sys
20:04:43.0671 1324 E1000 - ok
20:04:43.0718 1324 emupia (bb1d92ac27b6129d3bef215c5a1b9a84) C:\WINDOWS\system32\drivers\emupia2k.sys
20:04:43.0718 1324 emupia - ok
20:04:43.0750 1324 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
20:04:43.0750 1324 Fastfat - ok
20:04:43.0796 1324 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
20:04:43.0796 1324 Fdc - ok
20:04:43.0812 1324 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
20:04:43.0812 1324 Fips - ok
20:04:43.0843 1324 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
20:04:43.0843 1324 Flpydisk - ok
20:04:43.0875 1324 FltMgr (5a85cd3d07273e3f6fe72ee9c6431632) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:04:43.0875 1324 FltMgr - ok
20:04:43.0890 1324 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:04:43.0890 1324 Fs_Rec - ok
20:04:43.0906 1324 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:04:43.0906 1324 Ftdisk - ok
20:04:43.0921 1324 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:04:43.0921 1324 Gpc - ok
20:04:43.0984 1324 ha20x2k (b70a5f66a5505da65e54a4c2bab4c78f) C:\WINDOWS\system32\drivers\ha20x2k.sys
20:04:44.0000 1324 ha20x2k - ok
20:04:44.0046 1324 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:04:44.0046 1324 hidusb - ok
20:04:44.0062 1324 hpn - ok
20:04:44.0078 1324 hpt3xx - ok
20:04:44.0125 1324 HTTP (909d110c9634b0f1487eaaea837317d9) C:\WINDOWS\system32\Drivers\HTTP.sys
20:04:44.0125 1324 HTTP - ok
20:04:44.0156 1324 i2omgmt - ok
20:04:44.0156 1324 i2omp - ok
20:04:44.0187 1324 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:04:44.0187 1324 i8042prt - ok
20:04:44.0187 1324 Imapi (12c59b8929121ace2f55acc86682cf12) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:04:44.0203 1324 Imapi - ok
20:04:44.0218 1324 ini910u - ok
20:04:44.0250 1324 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
20:04:44.0250 1324 IntelIde - ok
20:04:44.0281 1324 intelppm (db8a1859cf9e48914dcc0a7206d87be5) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:04:44.0281 1324 intelppm - ok
20:04:44.0312 1324 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:04:44.0312 1324 Ip6Fw - ok
20:04:44.0343 1324 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:04:44.0343 1324 IpFilterDriver - ok
20:04:44.0343 1324 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:04:44.0343 1324 IpInIp - ok
20:04:44.0375 1324 IpNat (472c75f85e631f8aa87d21c9fee6238d) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:04:44.0375 1324 IpNat - ok
20:04:44.0390 1324 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:04:44.0390 1324 IPSec - ok
20:04:44.0421 1324 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:04:44.0421 1324 IRENUM - ok
20:04:44.0453 1324 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:04:44.0453 1324 isapnp - ok
20:04:44.0468 1324 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:04:44.0468 1324 Kbdclass - ok
20:04:44.0515 1324 kmixer (8531438246ce9474e41ee1599904c0c7) C:\WINDOWS\system32\drivers\kmixer.sys
20:04:44.0515 1324 kmixer - ok
20:04:44.0531 1324 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
20:04:44.0546 1324 KSecDD - ok
20:04:44.0578 1324 L6PODLV (f18aa0f97b2632027cc3efb9a4195a4e) C:\WINDOWS\system32\Drivers\L6PODLV.sys
20:04:44.0593 1324 L6PODLV - ok
20:04:44.0625 1324 lbrtfdc - ok
20:04:44.0656 1324 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:04:44.0656 1324 mnmdd - ok
20:04:44.0687 1324 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
20:04:44.0687 1324 Modem - ok
20:04:44.0734 1324 motccgp (f4ea1193a52c8fe4b8a135e210abe546) C:\WINDOWS\system32\DRIVERS\motccgp.sys
20:04:44.0734 1324 motccgp - ok
20:04:44.0750 1324 motccgpfl (b812da6605caf02641312f1f65c75419) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
20:04:44.0750 1324 motccgpfl - ok
20:04:44.0750 1324 MotDev - ok
20:04:44.0781 1324 motmodem (69814acd50a9d6d28296050ef6215d46) C:\WINDOWS\system32\DRIVERS\motmodem.sys
20:04:44.0781 1324 motmodem - ok
20:04:44.0796 1324 motport (69814acd50a9d6d28296050ef6215d46) C:\WINDOWS\system32\DRIVERS\motport.sys
20:04:44.0796 1324 motport - ok
20:04:44.0828 1324 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:04:44.0828 1324 Mouclass - ok
20:04:44.0875 1324 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
20:04:44.0875 1324 MountMgr - ok
20:04:44.0875 1324 mraid35x - ok
20:04:44.0890 1324 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:04:44.0906 1324 MRxDAV - ok
20:04:44.0937 1324 MRxSmb (3ecc5f53a627b28a23aa7cc8c9376db4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:04:44.0953 1324 MRxSmb - ok
20:04:44.0984 1324 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
20:04:44.0984 1324 Msfs - ok
20:04:45.0015 1324 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:04:45.0015 1324 MSKSSRV - ok
20:04:45.0031 1324 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:04:45.0046 1324 MSPCLOCK - ok
20:04:45.0062 1324 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
20:04:45.0062 1324 MSPQM - ok
20:04:45.0093 1324 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:04:45.0093 1324 mssmbios - ok
20:04:45.0109 1324 Mup (f66b6b1cddee6ca87cefc016eb7a0d8e) C:\WINDOWS\system32\drivers\Mup.sys
20:04:45.0109 1324 Mup - ok
20:04:45.0125 1324 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
20:04:45.0125 1324 NDIS - ok
20:04:45.0140 1324 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:04:45.0140 1324 NdisTapi - ok
20:04:45.0171 1324 Ndisuio (77d9bf86b912104c229d4f0d25be3c12) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:04:45.0171 1324 Ndisuio - ok
20:04:45.0187 1324 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:04:45.0187 1324 NdisWan - ok
20:04:45.0203 1324 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
20:04:45.0203 1324 NDProxy - ok
20:04:45.0218 1324 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:04:45.0218 1324 NetBIOS - ok
20:04:45.0234 1324 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:04:45.0250 1324 NetBT - ok
20:04:45.0281 1324 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
20:04:45.0281 1324 Npfs - ok
20:04:45.0343 1324 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
20:04:45.0375 1324 Ntfs - ok
20:04:45.0406 1324 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:04:45.0406 1324 Null - ok
20:04:45.0656 1324 nv (9f4384aa43548ddd438f7b7825d11699) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
20:04:45.0859 1324 nv - ok
20:04:45.0906 1324 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:04:45.0906 1324 NwlnkFlt - ok
20:04:45.0921 1324 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:04:45.0937 1324 NwlnkFwd - ok
20:04:45.0953 1324 ossrv (594f2968c741ca03e41e57e65f616351) C:\WINDOWS\system32\drivers\ctoss2k.sys
20:04:45.0953 1324 ossrv - ok
20:04:45.0968 1324 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\drivers\Parport.sys
20:04:45.0968 1324 Parport - ok
20:04:45.0984 1324 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
20:04:45.0984 1324 PartMgr - ok
20:04:46.0031 1324 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
20:04:46.0031 1324 ParVdm - ok
20:04:46.0046 1324 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
20:04:46.0046 1324 PCI - ok
20:04:46.0078 1324 PCIDump - ok
20:04:46.0093 1324 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys
20:04:46.0093 1324 PCIIde - ok
20:04:46.0125 1324 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:04:46.0125 1324 Pcmcia - ok
20:04:46.0140 1324 PDCOMP - ok
20:04:46.0140 1324 PDFRAME - ok
20:04:46.0156 1324 PDRELI - ok
20:04:46.0171 1324 PDRFRAME - ok
20:04:46.0187 1324 perc2 - ok
20:04:46.0203 1324 perc2hib - ok
20:04:46.0265 1324 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:04:46.0265 1324 PptpMiniport - ok
20:04:46.0265 1324 Processor (9e372a156f92425a1904b84589093a37) C:\WINDOWS\system32\DRIVERS\processr.sys
20:04:46.0281 1324 Processor - ok
20:04:46.0281 1324 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
20:04:46.0296 1324 PSched - ok
20:04:46.0296 1324 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:04:46.0296 1324 Ptilink - ok
20:04:46.0312 1324 ql1080 - ok
20:04:46.0328 1324 Ql10wnt - ok
20:04:46.0343 1324 ql12160 - ok
20:04:46.0343 1324 ql1240 - ok
20:04:46.0359 1324 ql1280 - ok
20:04:46.0375 1324 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:04:46.0375 1324 RasAcd - ok
20:04:46.0406 1324 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:04:46.0406 1324 Rasl2tp - ok
20:04:46.0421 1324 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:04:46.0421 1324 RasPppoe - ok
20:04:46.0437 1324 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:04:46.0437 1324 Raspti - ok
20:04:46.0453 1324 Rdbss (b48441a6dc703ee4c36db14ee51a189c) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:04:46.0453 1324 Rdbss - ok
20:04:46.0468 1324 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:04:46.0468 1324 RDPCDD - ok
20:04:46.0500 1324 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:04:46.0515 1324 rdpdr - ok
20:04:46.0578 1324 RDPWD (047bea21274c8a4a233674a76c958c2c) C:\WINDOWS\system32\drivers\RDPWD.sys
20:04:46.0578 1324 RDPWD - ok
20:04:46.0625 1324 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:04:46.0625 1324 redbook - ok
20:04:46.0671 1324 SCDEmu (20b2751cd4c8f3fd989739ca661b9f30) C:\WINDOWS\system32\drivers\SCDEmu.sys
20:04:46.0687 1324 SCDEmu - ok
20:04:46.0718 1324 Secdrv (07f7f501ad50de2ba2d5842d9b6d6155) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:04:46.0718 1324 Secdrv - ok
20:04:46.0765 1324 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:04:46.0765 1324 serenum - ok
20:04:46.0781 1324 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
20:04:46.0781 1324 Serial - ok
20:04:46.0796 1324 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:04:46.0796 1324 Sfloppy - ok
20:04:46.0812 1324 Simbad - ok
20:04:46.0843 1324 SIODRV (20f6649d168567a66c25662171bf4fe8) C:\WINDOWS\System32\drivers\SIODRV.SYS
20:04:46.0843 1324 SIODRV - ok
20:04:46.0859 1324 SMBios (d72a21424ca66c7a745bd995eca6a710) C:\WINDOWS\system32\DRIVERS\SMBios.sys
20:04:46.0859 1324 SMBios - ok
20:04:46.0890 1324 smbusp (067114712715d88e1fccaba33e418e24) C:\WINDOWS\system32\DRIVERS\smb.sys
20:04:46.0890 1324 smbusp - ok
20:04:46.0906 1324 Sparrow - ok
20:04:46.0921 1324 splitter (9bb1dd670cb7505a90fc4e61d4aa8227) C:\WINDOWS\system32\drivers\splitter.sys
20:04:46.0921 1324 splitter - ok
20:04:46.0937 1324 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
20:04:46.0953 1324 sr - ok
20:04:46.0984 1324 Srv (5230953c21c811b5fc1ff31ae2b48097) C:\WINDOWS\system32\DRIVERS\srv.sys
20:04:46.0984 1324 Srv - ok
20:04:47.0031 1324 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:04:47.0031 1324 swenum - ok
20:04:47.0078 1324 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
20:04:47.0078 1324 swmidi - ok
20:04:47.0093 1324 symc810 - ok
20:04:47.0093 1324 symc8xx - ok
20:04:47.0109 1324 sym_hi - ok
20:04:47.0125 1324 sym_u3 - ok
20:04:47.0156 1324 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
20:04:47.0156 1324 sysaudio - ok
20:04:47.0203 1324 Tcpip (b2220c618b42a2212a59d91ebd6fc4b4) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:04:47.0218 1324 Tcpip - ok
20:04:47.0234 1324 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:04:47.0234 1324 TDPIPE - ok
20:04:47.0250 1324 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
20:04:47.0250 1324 TDTCP - ok
20:04:47.0265 1324 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:04:47.0265 1324 TermDD - ok
20:04:47.0281 1324 TosIde - ok
20:04:47.0328 1324 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
20:04:47.0328 1324 Udfs - ok
20:04:47.0343 1324 ultra - ok
20:04:47.0375 1324 Update (a4815a4884898f355a3513e60843a4fd) C:\WINDOWS\system32\DRIVERS\update.sys
20:04:47.0375 1324 Update - ok
20:04:47.0453 1324 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
20:04:47.0453 1324 usbaudio - ok
20:04:47.0484 1324 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:04:47.0484 1324 usbccgp - ok
20:04:47.0500 1324 usbehci (6cd8e0ac00f6998f4794296c15fbe41d) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:04:47.0500 1324 usbehci - ok
20:04:47.0515 1324 usbhub (14300c1a174290513d5f2a38b44cdb12) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:04:47.0515 1324 usbhub - ok
20:04:47.0531 1324 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:04:47.0531 1324 usbprint - ok
20:04:47.0546 1324 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:04:47.0546 1324 usbscan - ok
20:04:47.0562 1324 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:04:47.0562 1324 usbstor - ok
20:04:47.0593 1324 usbuhci (4d81ec4a1a4b9fb8cf374fc0e1d22b23) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:04:47.0593 1324 usbuhci - ok
20:04:47.0609 1324 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
20:04:47.0609 1324 VgaSave - ok
20:04:47.0625 1324 ViaIde - ok
20:04:47.0640 1324 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
20:04:47.0640 1324 VolSnap - ok
20:04:47.0671 1324 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:04:47.0671 1324 Wanarp - ok
20:04:47.0718 1324 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
20:04:47.0734 1324 Wdf01000 - ok
20:04:47.0750 1324 WDICA - ok
20:04:47.0796 1324 wdmaud (0bfa8203b8148fb4e54bc212c41ce497) C:\WINDOWS\system32\drivers\wdmaud.sys
20:04:47.0796 1324 wdmaud - ok
20:04:47.0875 1324 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
20:04:47.0875 1324 WS2IFSL - ok
20:04:47.0921 1324 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:04:47.0921 1324 WudfPf - ok
20:04:47.0937 1324 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:04:47.0937 1324 WudfRd - ok
20:04:47.0984 1324 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
20:04:48.0062 1324 \Device\Harddisk0\DR0 - ok
20:04:48.0093 1324 MBR (0x1B8) (94a28e3f8bd1a7eb7784d264987fa30b) \Device\Harddisk1\DR3
20:04:48.0546 1324 \Device\Harddisk1\DR3 - ok
20:04:48.0562 1324 Boot (0x1200) (2fcc2d70856da9904fdf9f14bd35c110) \Device\Harddisk0\DR0\Partition0
20:04:48.0562 1324 \Device\Harddisk0\DR0\Partition0 - ok
20:04:48.0578 1324 Boot (0x1200) (ef203bf732e80386b9288724dc714531) \Device\Harddisk0\DR0\Partition1
20:04:48.0578 1324 \Device\Harddisk0\DR0\Partition1 - ok
20:04:48.0578 1324 ============================================================
20:04:48.0578 1324 Scan finished
20:04:48.0578 1324 ============================================================
20:04:48.0593 1236 Detected object count: 0
20:04:48.0593 1236 Actual detected object count: 0