Spyware / Malware / Virus Removal

Hodgepode - Slow Processing/Google Redirect/Trojan - mwusvw32.dll/ping

24 min read

Looking for the outcome? Ask AI

aconnerty Topic Starter

Post #1November 4, 2011, 9:57 PM UTC

Hi,

I've got an old Dell desktop (Windows XP) that appears to be infected and is running very very slowly.
I've received some Google redirects to a gaming site. Scanning using SUPER AntiSpyware has turned up a Trojan, 'mwusbw32.dll'.
Also, 'ping.exe' has been sucking up a huge part of my utiliization.

My HijackThis log is below.

If anyone has any suggestions on how to clean this up, I'd appreciate it.
If I can provide any additional details, please let me know.

Thanks!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:45:51 PM, on 11/4/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\RETROS~1\RETROS~1.5\retrorun.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Adrian Connerty\Desktop\HiJackThis.exe
C:\WINDOWS\System32\ping.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:52492
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-21-1373425496-2533515895-3883004065-1007\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User '?')
O4 - HKUS\S-1-5-21-1373425496-2533515895-3883004065-1007\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1373425496-2533515895-3883004065-1007\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot (User '?')
O4 - HKUS\S-1-5-21-1373425496-2533515895-3883004065-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1373425496-2533515895-3883004065-1007\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User '?')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-21-1373425496-2533515895-3883004065-1007 Startup: RCA Detective.lnk = C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe (User '?')
O4 - S-1-5-18 Startup: RCA Detective.lnk = C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe (User '?')
O4 - .DEFAULT Startup: RCA Detective.lnk = C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe (User 'Default user')
O4 - Startup: RCA Detective.lnk = C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: mwusbw32 - mwusbw32.dll (file missing)
O20 - Winlogon Notify: vmwusb - mwusbw32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Corporation - C:\PROGRA~1\RETROS~1\RETROS~1.5\retrorun.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

–
End of file - 11391 bytes

jeffce

Post #2November 4, 2011, 10:03 PM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!

———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

GMER

Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries.
———-

In your next reply please post the logs created by DDS and GMER. Also…is your computer set up for a proxy server? Do you know?

aconnerty

Post #3November 5, 2011, 5:02 PM UTC

Thanks, Jeff, for taking the time to investigate this! I really appreciate it.

So first off -
No, this computer is not set up for a proxy server as far as I know.

Second, it took a little while to get all the information together. I wasn't running dds and gmer in safe mode at first.
When I ran gmer, Windows crashed on me a couple times:

'A problem has been detected and Windows has been shut down to prevent damage to your computer'.
A physical memory dump was done.
In case this is helpful, the error details listed were:

Address EC8623CB base at EC85E000 Date Stamp 4e21F298
uxlyapow.sys
PAGE_FAULT_IN_NONPAGED AREA

When I ran dds and gmer in safe mode, everything ran to completion. I don't know if safe mode is the way to go during fixing all these issues but I guess I'll do that unless I hear otherwise.

I'm going to break up the log files into separate posts, just in case it's easier to view that way.

dds
.
DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_29
Run by [removed] at 10:05:18 on 2011-11-05
.
============== Running Processes ===============
.
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.dell4me.com/myway
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://bfc.myway.com/search/de_srchlft.html
BHO: {00C6482D-C502-44C8-8409-FCE54AD9C208} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10o_Plugin.exe -update plugin
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
LSP: VLsp.dll
LSP: mswsock.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{DE34A3F5-EE46-4064-B8EF-171A40190D25} : DhcpNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: mwusbw32 - mwusbw32.dll
Notify: vmwusb - mwusbw32.dll
AppInit_DLLs: c:\windows\system32\guard32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\798ypy34.default\
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2011-11-05 14:05:06 ——– d-sh–w- c:\documents and settings\administrator\IETldCache
2011-11-04 22:01:38 ——– d—–w- c:\program files\Defraggler
2011-11-04 17:53:13 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-11-04 17:48:39 ——– d—–w- c:\documents and settings\all users\application data\Comodo Downloader
2011-11-04 16:55:36 161792 —-a-w- c:\windows\system32\vmusbw32.dll
.
==================== Find3M ====================
.
2011-11-04 17:52:43 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-08-31 21:00:50 22216 -c–a-w- c:\windows\system32\drivers\mbam.sys
2005-03-10 21:28:11 44011816 -c–a-w- c:\program files\iPodSetup.exe
.
============= FINISH: 10:06:07.37 ===============

aconnerty

Post #4November 5, 2011, 5:03 PM UTC

Here is attach: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . . ==== Disk Partitions ========================= . . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe Download Manager Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 8.1.2 Adobe Reader 8.1.2 Security Update 1 (KB403742) Adobe Shockwave Player Apple Application Support Apple Mobile Device Support Apple Software Update ATI Control Panel ATI Display Driver AudibleManager Bonjour BufferChm Business Contact Manager for Outlook 2003 Camedia Master 4.3 Canon Camera Access Library Canon Camera Support Core Library Canon G.726 WMP-Decoder Canon MovieEdit Task for ZoomBrowser EX Canon RAW Image Task for ZoomBrowser EX Canon Utilities CameraWindow Canon Utilities CameraWindow DC Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX Canon Utilities EOS Utility Canon Utilities MyCamera Canon Utilities MyCamera DC Canon Utilities PhotoStitch Canon Utilities RemoteCapture Task for ZoomBrowser EX Canon Utilities ZoomBrowser EX Canon ZoomBrowser EX Memory Card Utility CCleaner COMODO Internet Security Creative MediaSource Crystal Reports for .NET Framework 2.0 (x86) Defraggler Dell Driver Reset Tool Dell Media Experience Dell Media Experience Update Dell System Restore DellSupport Destinations DeviceFunctionQFolder DeviceManagementQFolder EarthLink setup files eSupportQFolder Free Window Registry Repair GdiplusUpgrade Google Chrome Google Toolbar for Internet Explorer Google Update Helper Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) HP Imaging Device Functions 5.0 HP Photosmart Essential HP Solution Center & Imaging Support Tools 5.0 Intel® 537EP V9x DF PCI Modem Intel® PRO Network Adapters and Drivers Intel® PROSet for Wired Connections Internet Explorer Default Page iPod for Windows 2005-02-22 iPod for Windows User Guide iPod System Software Updater 2.0.1 iTunes Jasc Paint Shop Photo Album Jasc Paint Shop Pro 8 Dell Edition Java Auto Updater Java™ 6 Update 29 Learn2 Player (Uninstall Only) Lexmark Toolbar Logitech QuickCam Software Logitech® Camera Driver Malwarebytes' Anti-Malware version 1.51.2.1300 MetaFrame Presentation Server Web Client for Win32 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2003 Web Components Microsoft Office Professional Edition 2003 Microsoft Office Word Viewer 2003 Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft User-Mode Driver Framework Feature Pack 1.0 MobileMe Control Panel Modem Event Monitor Modem Helper Modem On Hold Mozilla Firefox 7.0.1 (x86 en-US) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) My Way Search Assistant Netflix Movie Viewer OLYMPUS CAMEDIA Master 4.3 PowerDVD 5.3 Qualxserve Service Agreement QuickTime RCA Detective™ [removed] RCA easyRip [removed] RCA Updater 2.0.5.0 Safari Scientific-Atlanta WebSTAR 2000 series Cable Modem Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB960715) Skype™ 5.1 SolutionCenter Sonic DLA Sonic RecordNow! Sonic Update Manager Sound Blaster Live! 24-bit Status SUPERAntiSpyware Free Edition TrayApp Unload Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 11 Windows XP Service Pack 3 WordPerfect Office 12 Yahoo! Install Manager . ==== End Of File ===========================

aconnerty

Post #5November 5, 2011, 5:05 PM UTC

And here is GMER. Thanks again, Jeff!

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-05 12:39:02
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 ST3160023AS rev.8.12
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uxlyapow.sys

—- Kernel code sections - GMER 1.0.15 —-

? C:\WINDOWS\system32\DRIVERS\redbook.sys suspicious PE modification
? C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[180] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 00DFCE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 00E05680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 00DFCF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E026F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E03280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 00E01220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 00E01B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] USER32.dll!SetWindowLongA 7E42C29D 5 Bytes JMP 1069E349 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] USER32.dll!SetWindowLongW 7E42C2BB 5 Bytes JMP 1069E2DB C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] USER32.dll!GetWindowInfo 7E42C49C 5 Bytes JMP 104589A7 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 00E0DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 10458F65 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 00E0E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[436] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 00E0E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\winlogon.exe[580] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 5 Bytes JMP 10028AC0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 5 Bytes JMP 10028860 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\services.exe[624] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\savedump.exe[636] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\lsass.exe[644] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[804] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[876] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[984] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 013A000A
.text C:\WINDOWS\system32\svchost.exe[984] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 014D000A
.text C:\WINDOWS\system32\svchost.exe[984] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 0139000C
.text C:\WINDOWS\system32\svchost.exe[984] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[984] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[984] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[984] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[984] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1100] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\system32\svchost.exe[1204] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!NtClose 7C90CFD0 5 Bytes JMP 1001CE40 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 10025680 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 1001CF60 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100226F0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10023280 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ole32.dll!CoCreateInstanceEx 77500526 5 Bytes JMP 1002E410 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\WINDOWS\Explorer.EXE[1504] ole32.dll!CoGetClassObject 775156C5 5 Bytes JMP 1002E1D0 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\firefox.exe[1920] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 02AC000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[1920] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 0323000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[1920] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 02AB000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[1920] USER32.dll!EndTask 7E45A0A5 5 Bytes JMP 1002DF90 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\firefox.exe[1920] ADVAPI32.dll!CreateProcessAsUserW 77DEA889 5 Bytes JMP 10021220 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Mozilla Firefox\firefox.exe[1920] ADVAPI32.dll!CreateProcessAsUserA 77E10C80 5 Bytes JMP 10021B50 C:\WINDOWS\system32\guard32.dll (COMODO Internet Security/COMODO)

—- Modules - GMER 1.0.15 —-

Module (noname) (*** hidden *** ) F83EF000-F840F000 (131072 bytes)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\InprocServer32@ mscoree.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\InprocServer32@ThreadingModel Both
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\InprocServer32\1.1.4322
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\InprocServer32\1.1.4322@ImplementedInThisVersion
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\NotInsertable@
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\ProgID@ CorRegistration.CorIESecurityManager.1
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\Server@ mscorld.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{44A5F587-110C-7775-09E1-150D080F26AE}\VersionIndependentProgID@ CorRegistration.CorIESecurityManager

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I2A369FN\main[1].css 9945 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I2A369FN\MDClivemassiveheart261011033617[1].jpg 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I2A369FN\mdc_logo_big[1].gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I2A369FN\sliderarrows[1].png 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I2A369FN\slideshow[1].aspx 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I2A369FN\path-bg[1].gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UG79Y5HF\WD_massive_disco130711071011[1].jpg 60851 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UG79Y5HF\topps_s2_ep1_thumb291010122310[1].jpg 1588 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UG79Y5HF\player[1].js 0 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205 0 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\@ 2048 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\bckfg.tmp 781 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\cfg.ini 208 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\Desktop.ini 4608 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\keywords 8 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\kwrd.dll 208896 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\L 0 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\L\odetmngk 57600 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\lsflt7.ver 5176 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U 0 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U\00000001.@ 1536 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U\00000002.@ 209920 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U\00000004.@ 1024 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U\80000000.@ 1024 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U\80000004.@ 12800 bytes
File C:\WINDOWS\$NtUninstallKB24998$\3316360205\U\80000032.@ 75776 bytes
File C:\WINDOWS\$NtUninstallKB24998$\4176648125 0 bytes

—- EOF - GMER 1.0.15 —-

jeffce

Post #6November 5, 2011, 7:50 PM UTC

Hi aconnerty,

If you are able could you run DDS in Normal Mode and post those logs that are created? If you are not able to do that please do the following and you can run this in Safe Mode if need be…

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

aconnerty

Post #7November 7, 2011, 6:37 PM UTC

DDS crashed on me again so I ran OTL.
Here is the OTL.Txt file first:

OTL logfile created on: 11/7/2011 1:07:39 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Adrian Connerty\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 303.48 Mb Available Physical Memory | 59.50% Memory free
1.22 Gb Paging File | 0.68 Gb Available in Paging File | 56.30% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 146.05 Gb Total Space | 107.68 Gb Free Space | 73.73% Space Free | Partition Type: NTFS

Computer Name: D8WQPX61 | User Name: Adrian Connerty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Adrian Connerty\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe (Audiovox Electronics Corp.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\mcuicnt.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation)
PRC - C:\WINDOWS\SYSTEM32\ping.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\SYSTEM32\LVCOMSX.EXE (Logitech Inc.)
PRC - C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\Video\FxSvr2.exe (Logitech Inc.)
PRC - C:\WINDOWS\SYSTEM32\UStorSrv.exe (OTi)
PRC - C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)

========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Adrian Connerty\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL ()
MOD - C:\Documents and Settings\Adrian Connerty\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\objc.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll ()
MOD - C:\Program Files\QuickTime\QTSystem\QTCF.dll ()
MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - \\.\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\WINDOWS\SYSTEM32\OPDSL.DLL ()
MOD - C:\WINDOWS\SYSTEM32\P17.dll ()

========== Win32 Services (SafeList) ==========

SRV - (lduqnist) – File not found
SRV - (AppMgmt) – File not found
SRV - (6to4) – File not found
SRV - (vmusb) – C:\WINDOWS\SYSTEM32\vmusbw32.dll (Intel Corporation )
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RetroExpLauncher) – C:\Program Files\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (UStorage Server Service) – C:\WINDOWS\System32\UStorSrv.exe (OTi)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (cmdGuard) – C:\WINDOWS\SYSTEM32\DRIVERS\cmdGuard.sys (COMODO)
DRV - (cmderd) – C:\WINDOWS\SYSTEM32\DRIVERS\cmderd.sys (COMODO)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (redbook) – C:\WINDOWS\SYSTEM32\DRIVERS\redbook.sys ()
DRV - (dsunidrv) – C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (PID_08A0) QuickCam IM(PID_08A0) – C:\WINDOWS\SYSTEM32\DRIVERS\LV302AV.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\WINDOWS\SYSTEM32\DRIVERS\lv302af.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\WINDOWS\SYSTEM32\DRIVERS\LVUSBSta.sys (Logitech Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (Afc) – C:\WINDOWS\SYSTEM32\DRIVERS\afc.sys (Arcsoft, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (IntelC53) – C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys (Intel Corporation)
DRV - (USBCM) – C:\WINDOWS\SYSTEM32\DRIVERS\Sacm2A.sys ( )
DRV - (P17) – C:\WINDOWS\SYSTEM32\DRIVERS\P17.sys (Creative Technology Ltd.)
DRV - (IntelC52) – C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) – C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys (Intel Corporation)
DRV - (ctsfm2k) – C:\WINDOWS\SYSTEM32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\SYSTEM32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (PfModNT) – C:\WINDOWS\SYSTEM32\DRIVERS\Pfmodnt.sys (Creative Technology Ltd.)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:52492

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com "
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {DEB033D4-1C8A-4173-9875-E4123DB41E5B}:1.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 52492
FF - prefs.js..network.proxy.no_proxies_on: "localhost,*.local"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.91: C:\Program Files\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/04 11:55:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/04 16:34:04 | 000,000,000 | —D | M]

[2008/09/05 18:21:37 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Adrian Connerty\Application Data\Mozilla\Extensions
[2011/10/12 15:30:01 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Adrian Connerty\Application Data\Mozilla\Firefox\Profiles\iw6jn5v1.default\extensions
[2011/10/12 15:30:01 | 000,000,000 | -H-D | M] (Greasemonkey) – C:\Documents and Settings\Adrian Connerty\Application Data\Mozilla\Firefox\Profiles\iw6jn5v1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/05/18 13:56:56 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Adrian Connerty\Application Data\Mozilla\Firefox\Profiles\iw6jn5v1.default\extensions\nostmp
[2011/11/04 12:53:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/03 20:27:22 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/11/04 12:53:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/11/04 12:52:45 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/29 01:53:40 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/11/04 12:52:44 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2006/01/18 11:50:00 | 000,319,488 | —- | M] ( ) – C:\Program Files\mozilla firefox\plugins\npsnapfish.dll
[2011/09/28 19:26:50 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\SYSTEM32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe (Logitech Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\Adrian Connerty\Start Menu\Programs\Startup\RCA Detective.lnk = C:\Documents and Settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe (Audiovox Electronics Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\System32\VNsp.dll (V-ONE Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DE34A3F5-EE46-4064-B8EF-171A40190D25}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) -C:\WINDOWS\SYSTEM32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.dll) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\mwusbw32: DllName - (mwusbw32.dll) - File not found
O20 - Winlogon\Notify\vmwusb: DllName - (mwusbw32.dll) - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Adrian Connerty\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Adrian Connerty\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{2246d7d6-59f8-11dd-a8d8-001111d41aa0}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
O33 - MountPoints2\{ad66e28c-d379-11dd-a9c0-001111d41aa0}\Shell\AutoRun\command - "" = F:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/07 13:06:10 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Adrian Connerty\Desktop\OTL.exe
[2011/11/05 15:08:52 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Adrian Connerty\Recent
[2011/11/04 17:01:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Defraggler
[2011/11/04 17:01:38 | 000,000,000 | —D | C] – C:\Program Files\Defraggler
[2011/11/04 16:42:05 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Adrian Connerty\Desktop\HiJackThis.exe
[2011/11/04 12:53:13 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2011/11/04 12:53:12 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/11/04 12:53:12 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/11/04 12:53:12 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/11/04 12:48:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Comodo Downloader
[2011/11/04 11:55:36 | 000,161,792 | —- | C] (Intel Corporation ) – C:\WINDOWS\System32\vmusbw32.dll
[2011/11/03 13:02:30 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Real
[2011/10/20 19:13:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Adrian Connerty\Local Settings\Application Data\COMODO
[2006/12/30 12:26:38 | 000,015,429 | R— | C] ( ) – C:\WINDOWS\System32\drivers\Sacm2A.sys
[2005/03/10 15:59:10 | 044,011,816 | —- | C] (Apple Computer, Inc. ) – C:\Program Files\iPodSetup.exe
[1980/01/01 01:00:00 | 000,151,552 | —- | C] ( ) – C:\WINDOWS\System32\ATIDEMGR.dll
[1980/01/01 01:00:00 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\A3d.dll
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/07 13:30:00 | 000,000,442 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{A56FC824-4176-492E-952A-102EE8E80896}.job
[2011/11/07 13:27:16 | 000,000,904 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/11/07 13:21:18 | 001,474,832 | —- | M] () – C:\WINDOWS\System32\drivers\sfi.dat
[2011/11/07 13:06:12 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Adrian Connerty\Desktop\OTL.exe
[2011/11/07 13:00:05 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At38.job
[2011/11/07 13:00:03 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2011/11/07 12:55:46 | 000,428,404 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2011/11/07 12:55:46 | 000,072,694 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2011/11/07 12:52:04 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2011/11/07 12:51:33 | 000,000,900 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/11/07 12:51:16 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2011/11/07 12:51:14 | 534,925,312 | -HS- | M] () – C:\hiberfil.sys
[2011/11/05 15:00:02 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At41.job
[2011/11/05 15:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2011/11/05 12:14:45 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/11/05 09:15:50 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/05 09:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At35.job
[2011/11/05 09:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2011/11/05 08:35:04 | 000,294,216 | —- | M] () – C:\Documents and Settings\Adrian Connerty\Desktop\gmer.zip
[2011/11/04 19:00:00 | 000,000,432 | —- | M] () – C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (D8WQPX61-Jennifer Baffi).job
[2011/11/04 19:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At45.job
[2011/11/04 19:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2011/11/04 18:00:09 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At44.job
[2011/11/04 18:00:05 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2011/11/04 17:01:40 | 000,001,580 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2011/11/04 17:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At43.job
[2011/11/04 17:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2011/11/04 16:42:09 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Adrian Connerty\Desktop\HiJackThis.exe
[2011/11/04 16:28:58 | 000,000,434 | —- | M] () – C:\WINDOWS\tasks\At49.job
[2011/11/04 16:00:07 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At42.job
[2011/11/04 16:00:05 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2011/11/04 14:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At40.job
[2011/11/04 14:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2011/11/04 13:00:02 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At39.job
[2011/11/04 13:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2011/11/04 12:52:43 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2011/11/04 12:52:43 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/11/04 12:52:43 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/11/04 12:52:43 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/11/04 12:52:43 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2011/11/04 12:22:47 | 000,100,702 | —- | M] () – C:\WINDOWS\System32\itusbcore.dat
[2011/11/04 12:22:47 | 000,000,196 | —- | M] () – C:\WINDOWS\System32\itlsvc.dat
[2011/11/04 12:12:29 | 000,000,281 | RHS- | M] () – C:\BOOT.INI
[2011/11/04 11:55:51 | 000,000,742 | —- | M] () – C:\Documents and Settings\Adrian Connerty\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/11/04 11:55:51 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/11/04 11:55:36 | 000,161,792 | —- | M] (Intel Corporation ) – C:\WINDOWS\System32\vmusbw32.dll
[2011/11/04 10:50:07 | 000,000,272 | —- | M] () – C:\WINDOWS\reimage.ini
[2011/11/04 08:25:16 | 000,000,802 | —- | M] () – C:\Documents and Settings\Adrian Connerty\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/11/04 08:25:16 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/04 08:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At34.job
[2011/11/04 08:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2011/11/03 12:55:17 | 000,000,440 | —- | M] () – C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
[2011/11/03 12:35:03 | 000,000,857 | -H– | M] () – C:\Documents and Settings\Adrian Connerty\Application Data\Microsoft\Internet Explorer\Quick Launch\System Restore.lnk
[2011/11/03 11:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At37.job
[2011/11/03 11:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2011/10/28 10:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At36.job
[2011/10/28 10:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2011/10/20 21:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At47.job
[2011/10/20 21:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2011/10/20 20:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At46.job
[2011/10/20 20:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2011/10/16 02:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2011/10/16 02:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At28.job
[2011/10/16 01:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2011/10/16 01:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At27.job
[2011/10/16 00:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At26.job
[2011/10/16 00:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2011/10/15 23:47:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2011/10/15 23:11:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At25.job
[2011/10/15 22:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At48.job
[2011/10/15 22:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2011/10/15 19:05:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/10/11 07:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At9.job
[2011/10/11 07:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\tasks\At33.job
[2011/10/10 15:48:54 | 000,005,120 | -H– | M] () – C:\Documents and Settings\Adrian Connerty\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/05 14:34:09 | 534,925,312 | -HS- | C] () – C:\hiberfil.sys
[2011/11/05 09:15:49 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/05 08:34:52 | 000,294,216 | —- | C] () – C:\Documents and Settings\Adrian Connerty\Desktop\gmer.zip
[2011/11/04 17:01:40 | 000,001,580 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2011/11/04 12:22:47 | 000,100,702 | —- | C] () – C:\WINDOWS\System32\itusbcore.dat
[2011/11/04 12:22:47 | 000,000,196 | —- | C] () – C:\WINDOWS\System32\itlsvc.dat
[2011/11/04 11:55:51 | 000,000,742 | —- | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/11/04 11:55:51 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/11/04 11:55:50 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/11/04 10:49:56 | 000,000,272 | —- | C] () – C:\WINDOWS\reimage.ini
[2011/11/04 08:25:16 | 000,000,802 | —- | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/11/04 08:25:16 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/03 12:35:04 | 000,000,296 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~6DSS92c31Apgjk
[2011/11/03 12:35:04 | 000,000,192 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~6DSS92c31Apgjkr
[2011/11/03 12:35:03 | 000,000,857 | -H– | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\Microsoft\Internet Explorer\Quick Launch\System Restore.lnk
[2011/11/03 12:34:54 | 000,000,440 | —- | C] () – C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
[2010/12/03 15:17:49 | 000,001,404 | -H– | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\0E0A.FD1
[2009/07/27 15:09:43 | 000,000,130 | —- | C] () – C:\WINDOWS\cfplogvw.INI
[2009/07/10 10:25:39 | 001,474,832 | —- | C] () – C:\WINDOWS\System32\drivers\sfi.dat
[2009/05/08 15:38:30 | 000,117,248 | —- | C] () – C:\WINDOWS\vFind.exe
[2009/05/08 15:38:30 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/05/08 15:38:30 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/05/08 15:38:30 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/03/01 11:17:05 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2008/12/26 19:48:41 | 000,077,032 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2008/08/24 09:33:45 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2008/03/30 21:18:16 | 000,001,157 | —- | C] () – C:\WINDOWS\mozver.dat
[2008/02/18 17:51:31 | 000,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2008/02/05 22:41:13 | 000,000,037 | —- | C] () – C:\WINDOWS\ipixActivex.ini
[2008/01/16 08:21:28 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\LXF3PMRC.DLL
[2007/08/03 06:28:01 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\OPDSL.DLL
[2007/06/03 22:06:02 | 000,002,145 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/03/28 18:36:14 | 000,000,004 | -H– | C] () – C:\WINDOWS\uccspecb.sys
[2007/02/24 10:48:33 | 000,000,848 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2007/02/13 20:42:01 | 000,005,120 | -H– | C] () – C:\Documents and Settings\Adrian Connerty\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/11 19:11:04 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2006/12/30 12:26:38 | 000,135,168 | R— | C] () – C:\WINDOWS\UNDPX2A.exe
[2006/12/30 12:26:38 | 000,053,693 | R— | C] () – C:\WINDOWS\UNDPX2A.sys
[2006/12/08 22:21:14 | 000,000,000 | -H– | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\AVSDVDPlayer.m3u
[2006/12/08 22:18:25 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/12/08 22:18:25 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/09/18 18:57:50 | 000,079,669 | —- | C] () – C:\WINDOWS\hpfins05.dat.temp
[2006/09/18 18:57:50 | 000,001,350 | —- | C] () – C:\WINDOWS\hpfmdl05.dat.temp
[2006/08/20 08:02:05 | 000,118,784 | R— | C] () – C:\WINDOWS\bwUnin-7.2.0.157-8876480SL.exe
[2006/08/12 10:49:53 | 000,009,255 | R— | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/08/12 10:43:40 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\InstMed.exe
[2006/08/12 10:42:31 | 000,081,920 | R— | C] () – C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
[2006/06/17 11:48:44 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2006/05/17 12:04:19 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/05/17 11:45:09 | 000,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2006/04/15 13:15:54 | 000,061,678 | -H– | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\PFP120JPR.{PB
[2006/04/15 13:15:54 | 000,012,358 | -H– | C] () – C:\Documents and Settings\Adrian Connerty\Application Data\PFP120JCM.{PB
[2005/12/12 18:42:55 | 000,001,395 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/05/25 18:00:54 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2005/04/27 13:38:00 | 000,372,736 | —- | C] () – C:\WINDOWS\System32\hpzidi01.dll
[2005/04/27 13:37:49 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2005/03/14 22:40:01 | 000,000,193 | —- | C] () – C:\WINDOWS\hpc.ini
[2005/03/10 14:53:10 | 000,000,488 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/03/05 15:49:28 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/03/05 15:47:34 | 000,000,332 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/03/05 15:45:46 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/03/05 15:39:03 | 001,048,576 | —- | C] () – C:\WINDOWS\System32\SFMAN.DAT
[2005/03/05 15:39:03 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2005/03/05 15:38:54 | 000,003,278 | —- | C] () – C:\WINDOWS\System32\LudaP17.ini
[2005/03/05 15:38:54 | 000,000,029 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2005/03/05 15:38:48 | 000,000,072 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2005/03/05 15:29:46 | 000,002,048 | –S- | C] () – C:\WINDOWS\BOOTSTAT.DAT
[2005/03/05 15:28:14 | 000,428,404 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2005/03/05 15:28:14 | 000,072,694 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2005/03/05 15:10:34 | 000,000,370 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/09/15 23:03:14 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/10 14:13:12 | 000,000,780 | —- | C] () – C:\WINDOWS\ORUN32.INI
[2004/08/10 14:08:08 | 000,341,032 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 14:03:52 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/10 14:02:16 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:08:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/10 11:08:26 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/04 06:00:00 | 006,566,656 | —- | C] () – C:\WINDOWS\System32\vmipxcpy.dat
[2004/08/04 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2004/08/04 06:00:00 | 000,633,600 | —- | C] () – C:\WINDOWS\System32\otrjjizu.dat
[2004/08/04 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2004/08/04 06:00:00 | 000,218,880 | —- | C] () – C:\WINDOWS\System32\dwojncxi.dat
[2004/08/04 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2004/08/04 06:00:00 | 000,175,360 | —- | C] () – C:\WINDOWS\System32\mdhyrlah.dat
[2004/08/04 06:00:00 | 000,049,156 | —- | C] () – C:\WINDOWS\System32\certstore.dat
[2004/08/04 06:00:00 | 000,047,360 | —- | C] () – C:\WINDOWS\System32\fovhovme.dat
[2004/08/04 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2004/08/04 06:00:00 | 000,045,824 | —- | C] () – C:\WINDOWS\System32\mrgpmjcl.dat
[2004/08/04 06:00:00 | 000,036,608 | —- | C] () – C:\WINDOWS\System32\wwphultk.dat
[2004/08/04 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2004/08/04 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\SECUPD.DAT
[2004/08/04 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\FXSPERF.INI
[2004/08/04 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1999/01/27 12:39:06 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/06/13 06:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[1980/01/01 01:00:00 | 000,389,120 | —- | C] () – C:\WINDOWS\System32\ati2evxx.exe
[1980/01/01 01:00:00 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[1980/01/01 01:00:00 | 000,060,928 | —- | C] () – C:\WINDOWS\System32\P17.dll
[1980/01/01 01:00:00 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\P17CPI.dll
[1980/01/01 01:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2008/02/18 17:52:21 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\ICAClient
[2006/09/14 23:38:10 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Image Zone Express
[2009/01/28 14:40:20 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Leadertech
[2008/02/16 10:58:14 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Lexmark Productivity Studio
[2010/12/03 18:10:24 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Shutterfly
[2008/03/30 21:18:21 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Snapfish
[2008/08/15 23:24:25 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Uniblue
[2009/01/19 11:34:20 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Adrian Connerty\Application Data\Yahoo
[2008/01/14 12:54:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2010/12/14 18:51:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\nPoCp05302
[2006/02/02 18:26:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OLYMPUS
[2010/09/01 09:04:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RetroExp
[2010/09/05 15:32:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Retrospect
[2009/05/20 16:59:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/03/16 07:24:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/11/12 12:44:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/09 10:40:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/10/15 23:47:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2011/11/04 08:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At10.job
[2011/11/05 09:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At11.job
[2011/10/28 10:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At12.job
[2011/11/03 11:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At13.job
[2011/11/07 13:00:03 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At14.job
[2011/11/04 13:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At15.job
[2011/11/04 14:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At16.job
[2011/11/05 15:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At17.job
[2011/11/04 16:00:05 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At18.job
[2011/11/04 17:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At19.job
[2011/10/16 00:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2011/11/04 18:00:05 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At20.job
[2011/11/04 19:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At21.job
[2011/10/20 20:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At22.job
[2011/10/20 21:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At23.job
[2011/10/15 22:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At24.job
[2011/10/15 23:11:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At25.job
[2011/10/16 00:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At26.job
[2011/10/16 01:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At27.job
[2011/10/16 02:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At28.job
[2008/10/19 03:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At29.job
[2011/10/16 01:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2008/10/19 04:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At30.job
[2008/10/19 05:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At31.job
[2011/02/22 07:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At32.job
[2011/10/11 07:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At33.job
[2011/11/04 08:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At34.job
[2011/11/05 09:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At35.job
[2011/10/28 10:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At36.job
[2011/11/03 11:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At37.job
[2011/11/07 13:00:05 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At38.job
[2011/11/04 13:00:02 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At39.job
[2011/10/16 02:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2011/11/04 14:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At40.job
[2011/11/05 15:00:02 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At41.job
[2011/11/04 16:00:07 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At42.job
[2011/11/04 17:00:01 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At43.job
[2011/11/04 18:00:09 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At44.job
[2011/11/04 19:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At45.job
[2011/10/20 20:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At46.job
[2011/10/20 21:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At47.job
[2011/10/15 22:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At48.job
[2011/11/04 16:28:58 | 000,000,434 | —- | M] () – C:\WINDOWS\Tasks\At49.job
[2008/10/19 03:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At5.job
[2008/10/19 04:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At6.job
[2008/10/19 05:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At7.job
[2011/02/22 07:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At8.job
[2011/10/11 07:00:00 | 000,000,350 | —- | M] () – C:\WINDOWS\Tasks\At9.job
[2011/11/05 15:11:07 | 000,032,518 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT
[2011/11/07 13:30:00 | 000,000,442 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{A56FC824-4176-492E-952A-102EE8E80896}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CFE0B346
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

aconnerty

Post #8November 7, 2011, 6:38 PM UTC

And here is teh Extras.txt file:

OTL Extras logfile created on: 11/7/2011 1:07:39 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Adrian Connerty\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 303.48 Mb Available Physical Memory | 59.50% Memory free
1.22 Gb Paging File | 0.68 Gb Available in Paging File | 56.30% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 146.05 Gb Total Space | 107.68 Gb Free Space | 73.73% Space Free | Partition Type: NTFS

Computer Name: D8WQPX61 | User Name: Adrian Connerty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL
"C:\Program Files\Lexmark 2500 Series\app4r.exe" = C:\Program Files\Lexmark 2500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SYSTEM32\lxddcoms.exe" = C:\WINDOWS\SYSTEM32\lxddcoms.exe:*:Enabled:Lexmark Communications System
"C:\Program Files\Lexmark 2500 Series\lxddamon.exe" = C:\Program Files\Lexmark 2500 Series\lxddamon.exe:*:Enabled:Lexmark Device Monitor
"C:\Program Files\Lexmark 2500 Series\App4R.exe" = C:\Program Files\Lexmark 2500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio
"C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxddpswx.exe" = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxddpswx.exe:*:Enabled:
"C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxddjswx.exe" = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxddjswx.exe:*:Enabled:
"C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxddtime.exe" = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxddtime.exe:*:Enabled:
"%windir%\system32\drivers\svchost.exe" = %windir%\system32\drivers\svchost.exe:*:Enabled:svchost
"C:\Program Files\Lexmark 2500 Series\lxddmon.exe" = C:\Program Files\Lexmark 2500 Series\lxddmon.exe:*:Enabled:
"C:\Program Files\Iomega\Home Storage Manager\Iomega Storage Manager.exe" = C:\Program Files\Iomega\Home Storage Manager\Iomega Storage Manager.exe:*:Enabled:Iomega Storage Manager
"C:\Program Files\Iomega\Home Storage Manager\Iomega Discovery.exe" = C:\Program Files\Iomega\Home Storage Manager\Iomega Discovery.exe:*:Enabled:Iomega Home Media Network Discover Application

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = Qualxserve Service Agreement
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel® PROSet for Wired Connections
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java™ 6 Update 29
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{30BB4D60-81DB-11D5-BB77-00400536ABAC}" = OLYMPUS CAMEDIA Master 4.3
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{56F3E1FF-54FE-4384-A153-6CCABA097814}" = Creative MediaSource
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder
"{66563AD8-637B-407F-BCA7-0233A16891AB}" = Business Contact Manager for Outlook 2003
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE}" = EarthLink setup files
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{78D944D7-A97B-4004-AB0A-B5AD06839940}" = My Way Search Assistant
"{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
"{7C05EEDD-E565-4E2B-ADE4-0C784C17311C}" = Crystal Reports for .NET Framework 2.0 (x86)
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{91E30409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{9BD91669-25C9-43CD-9367-BF60591B837B}" = Camedia Master 4.3
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Dell Media Experience
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"{B6ACFF51-248A-4290-B50B-E50C81F25B97}" = iPod for Windows 2005-02-22
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{B9987754-9A14-4B61-ABB3-73A79503238D}" = iPod for Windows User Guide
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CDE4CC8B-134B-421E-943C-90799E56F664}" = Dell Media Experience Update
"{CEB481CC-F57C-4397-81A0-DADD22257047}" = Sound Blaster Live! 24-bit
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}" = Safari
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{FA86DB6D-DD7B-46A2-8FB1-6B33460D03A4}" = iPod System Software Updater 2.0.1
"{FD8E178D-8B4E-42DA-B434-EFF270329B1C}" = COMODO Internet Security
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"ATI Display Driver" = ATI Display Driver
"AudibleManager" = AudibleManager
"CAL" = Canon Camera Access Library
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"CSCLIB" = Canon Camera Support Core Library
"Defraggler" = Defraggler
"EOS Utility" = Canon Utilities EOS Utility
"Free Window Registry Repair" = Free Window Registry Repair
"Google Chrome" = Google Chrome
"HP Imaging Device Functions" = HP Imaging Device Functions 5.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{B6ACFF51-248A-4290-B50B-E50C81F25B97}" = iPod for Windows 2005-02-22
"InstallShield_{B9987754-9A14-4B61-ABB3-73A79503238D}" = iPod for Windows User Guide
"InstallShield_{FA86DB6D-DD7B-46A2-8FB1-6B33460D03A4}" = iPod System Software Updater 2.0.1
"Intel® 537EP V9x DF PCI Modem" = Intel® 537EP V9x DF PCI Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"MetaFrame Presentation Server Web Client for Win32" = MetaFrame Presentation Server Web Client for Win32
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 7.0.1 (x86 en-US)" = Mozilla Firefox 7.0.1 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PhotoStitch" = Canon Utilities PhotoStitch
"PROSet" = Intel® PRO Network Adapters and Drivers
"QcDrv" = Logitech® Camera Driver
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RCA Detective™_is1" = RCA Detective™ [removed]
"RCA easyRip_is1" = RCA easyRip [removed]
"RCA Updater_is1" = RCA Updater 2.0.5.0
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"StreetPlugin" = Learn2 Player (Uninstall Only)
"WebSTAR DPC2100 Uninstall" = Scientific-Atlanta WebSTAR 2000 series Cable Modem
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"YInstHelper" = Yahoo! Install Manager
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/15/2011 2:51:43 PM | Computer Name = D8WQPX61 | Source = MSSOAP | ID = 16
Description = Soap error: The connector could not be created. There might be an
invalid endPoint specified in the WSDL file.

Error - 6/15/2011 3:47:23 PM | Computer Name = D8WQPX61 | Source = Application Error | ID = 1000
Description = Faulting application camedia master.exe, version 4.3.0.4, faulting
module olyuifrw.dll, version 4.2.1.2, fault address 0x00019c46.

Error - 8/17/2011 4:22:26 PM | Computer Name = D8WQPX61 | Source = Application Hang | ID = 1002
Description = Hanging application iTunes.exe, version 9.0.2.25, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/31/2011 6:59:27 PM | Computer Name = D8WQPX61 | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 6.0.1.4259, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 11/4/2011 8:57:26 AM | Computer Name = D8WQPX61 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 11.0.6359.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/4/2011 8:59:10 AM | Computer Name = D8WQPX61 | Source = Application Hang | ID = 1002
Description = Hanging application ATF-Cleaner.exe, version 3.0.0.2, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/4/2011 8:59:48 AM | Computer Name = D8WQPX61 | Source = Application Hang | ID = 1002
Description = Hanging application ATF-Cleaner.exe, version 3.0.0.2, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/4/2011 5:29:54 PM | Computer Name = D8WQPX61 | Source = EventSystem | ID = 4610
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 80040154 from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
This may indicate that the COM+ Event System is not properly installed. Please
try reinstalling the COM+ Event Syste

Error - 11/4/2011 5:29:54 PM | Computer Name = D8WQPX61 | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 11/4/2011 8:36:41 PM | Computer Name = D8WQPX61 | Source = Application Hang | ID = 1002
Description = Hanging application Defraggler.exe, version 2.7.0.346, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 11/7/2011 1:55:53 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 1:57:18 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 1:59:24 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 1:59:59 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 2:00:04 PM | Computer Name = D8WQPX61 | Source = Schedule | ID = 7901
Description = The At14.job command failed to start due to the following error: %%2147942405

Error - 11/7/2011 2:00:05 PM | Computer Name = D8WQPX61 | Source = Schedule | ID = 7901
Description = The At38.job command failed to start due to the following error: %%2147942405

Error - 11/7/2011 2:01:42 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 2:05:32 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 2:05:52 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/7/2011 2:27:14 PM | Computer Name = D8WQPX61 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

< End of report >

jeffce

Post #9November 7, 2011, 8:10 PM UTC

Hi aconnerty,

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
———-

aconnerty

Post #10November 7, 2011, 9:24 PM UTC

A couple things to mention regarding ComboFix-

1. As it was running, a message was displayed that read: You are infected with Rootkit.ZeroAccess. It has inserted itself into the tcp/ip stack'. hooray
2. No pop up messages were ever displayed about the Microsoft Windows Recovery Console.

Here is the log file:

ComboFix 11-11-07.03 - Adrian Connerty 11/07/2011 15:46:07.1.2 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Adrian Connerty\Application Data\0E0A.FD1
c:\documents and settings\Adrian Connerty\Application Data\Adobe\usanaz.exe
c:\documents and settings\Adrian Connerty\SendTo\RemoveOnReboot.exe
c:\documents and settings\Adrian Connerty\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\DFC5A2B2.TMP
c:\documents and settings\All Users\SPL15B.tmp
c:\documents and settings\Jennifer Baffi\WINDOWS
c:\windows\$NtUninstallKB24998$\3316360205\@
c:\windows\$NtUninstallKB24998$\3316360205\bckfg.tmp
c:\windows\$NtUninstallKB24998$\3316360205\cfg.ini
c:\windows\$NtUninstallKB24998$\3316360205\Desktop.ini
c:\windows\$NtUninstallKB24998$\3316360205\keywords
c:\windows\$NtUninstallKB24998$\3316360205\kwrd.dll
c:\windows\$NtUninstallKB24998$\3316360205\L\odetmngk
c:\windows\$NtUninstallKB24998$\3316360205\lsflt7.ver
c:\windows\$NtUninstallKB24998$\3316360205\U\00000001.@
c:\windows\$NtUninstallKB24998$\3316360205\U\00000002.@
c:\windows\$NtUninstallKB24998$\3316360205\U\00000004.@
c:\windows\$NtUninstallKB24998$\3316360205\U\80000000.@
c:\windows\$NtUninstallKB24998$\3316360205\U\80000004.@
c:\windows\$NtUninstallKB24998$\3316360205\U\80000032.@
c:\windows\$NtUninstallKB24998$\4176648125
c:\windows\bwUnin-6.1.4.68-8876480L.exe
c:\windows\bwUnin-7.2.0.157-8876480SL.exe
c:\windows\$NtUninstallKB24998$ . . . . Failed to delete
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_6TO4
——-\Service_6to4
.
.
((((((((((((((((((((((((( Files Created from 2011-10-07 to 2011-11-07 )))))))))))))))))))))))))))))))
.
.
2011-11-05 14:05 . 2011-11-05 14:05 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-11-04 22:01 . 2011-11-04 22:01 ——– d—–w- c:\program files\Defraggler
2011-11-04 17:53 . 2011-11-04 17:52 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-11-04 17:48 . 2011-11-04 17:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2011-11-04 16:55 . 2011-11-04 16:55 161792 —-a-w- c:\windows\system32\vmusbw32.dll
2011-11-03 17:41 . 2011-11-03 17:41 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2011-10-21 00:13 . 2011-10-21 00:13 ——– d–h–w- c:\documents and settings\Adrian Connerty\Local Settings\Application Data\COMODO
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-04 17:52 . 2010-12-04 01:27 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-08-31 21:00 . 2009-01-19 18:37 22216 -c–a-w- c:\windows\system32\drivers\mbam.sys
2005-03-10 21:28 . 2005-03-10 20:59 44011816 -c–a-w- c:\program files\iPodSetup.exe
2011-09-29 06:53 . 2011-05-18 18:56 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-15 1576176]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-12-04 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"P17Helper"="P17.dll" [2004-06-10 60928]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-07-25 2554696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\Adrian Connerty\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Adrian Connerty\My Documents\RCA Detective\RCADetective.exe [2011-9-8 804352]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 20:28 352256 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SYSTEM32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 zealtoje;zealtoje;c:\windows\system32\drivers\zlhozbqo.sys [x]
R0 zgzz;zgzz;c:\windows\system32\drivers\zwicm.sys [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 135664]
R2 lduqnist;Terminal Device Support;c:\windows\System32\svchost.exe [2008-04-14 14336]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 135664]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2008-04-14 14336]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2011-07-25 17416]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-07-25 242600]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-08-15 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-08-15 55024]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-08-15 7408]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
vmwareusb REG_MULTI_SZ vmusb
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
lduqnist
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]
.
2011-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 01:49]
.
2011-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 01:49]
.
2011-11-07 c:\windows\Tasks\User_Feed_Synchronization-{A56FC824-4176-492E-952A-102EE8E80896}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:52492
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
LSP: VLsp.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Adrian Connerty\Application Data\Mozilla\Firefox\Profiles\iw6jn5v1.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 52492
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Notify-mwusbw32 - mwusbw32.dll
Notify-vmwusb - mwusbw32.dll
SafeBoot-dwshd.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-07 16:08
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
- - - - - - - > 'lsass.exe'(728)
c:\windows\system32\guard32.dll
c:\windows\system32\VLsp.dll
c:\windows\system32\VNSP.DLL
.
- - - - - - - > 'explorer.exe'(3056)
c:\windows\system32\guard32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
c:\windows\system32\HPZipm12.exe
c:\progra~1\RETROS~1\RETROS~1.5\retrorun.exe
c:\windows\system32\UStorSrv.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\Rundll32.exe
c:\windows\system32\imapi.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-11-07 16:19:24 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-07 21:19
.
Pre-Run: 115,915,759,616 bytes free
Post-Run: 116,170,133,504 bytes free
.
- - End Of File - - 21E5849FFC1330C7257B7248BE4EEA1E

jeffce

Post #11November 7, 2011, 11:16 PM UTC

Hi aconnerty,

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

You do have the ZeroAccess rootkit on your system. This is an especially nasty virus that has infected your system.

If you would like to format and reinstall your Operating System please let me know and I can assist you with that.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.

———-

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

aconnerty

Post #12November 9, 2011, 4:36 PM UTC

Here's the log file, Jeff. Thanks! BTW, I re=ran TDSS after the reboot and no malicious items were detected this time: 11:19:34.0865 3600 TDSS rootkit removing tool 2.6.16.0 Nov 7 2011 16:26:51 11:19:35.0021 3600 ============================================================ 11:19:35.0021 3600 Current date / time: 2011/11/09 11:19:35.0021 11:19:35.0021 3600 SystemInfo: 11:19:35.0021 3600 11:19:35.0021 3600 OS Version: 5.1.2600 ServicePack: 3.0 11:19:35.0021 3600 Product type: Workstation 11:19:35.0021 3600 ComputerName: D8WQPX61 11:19:35.0021 3600 UserName: Adrian Connerty 11:19:35.0021 3600 Windows directory: C:\WINDOWS 11:19:35.0021 3600 System windows directory: C:\WINDOWS 11:19:35.0021 3600 Processor architecture: Intel x86 11:19:35.0021 3600 Number of processors: 2 11:19:35.0021 3600 Page size: 0x1000 11:19:35.0021 3600 Boot type: Normal boot 11:19:35.0021 3600 ============================================================ 11:19:36.0709 3600 Initialize success 11:19:38.0912 0408 ============================================================ 11:19:38.0912 0408 Scan started 11:19:38.0912 0408 Mode: Manual; 11:19:38.0912 0408 ============================================================ 11:19:40.0631 0408 Abiosdsk - ok 11:19:40.0678 0408 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS 11:19:40.0693 0408 abp480n5 - ok 11:19:40.0740 0408 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 11:19:40.0756 0408 ACPI - ok 11:19:40.0803 0408 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 11:19:40.0818 0408 ACPIEC - ok 11:19:40.0849 0408 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys 11:19:40.0849 0408 adpu160m - ok 11:19:40.0912 0408 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 11:19:40.0912 0408 aec - ok 11:19:40.0959 0408 Afc (a7b8a3a79d35215d798a300df49ed23f) C:\WINDOWS\system32\drivers\Afc.sys 11:19:40.0974 0408 Afc - ok 11:19:41.0037 0408 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys 11:19:41.0068 0408 AFD - ok 11:19:41.0099 0408 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys 11:19:41.0115 0408 agp440 - ok 11:19:41.0146 0408 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys 11:19:41.0146 0408 agpCPQ - ok 11:19:41.0162 0408 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys 11:19:41.0162 0408 Aha154x - ok 11:19:41.0178 0408 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys 11:19:41.0209 0408 aic78u2 - ok 11:19:41.0256 0408 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys 11:19:41.0303 0408 aic78xx - ok 11:19:41.0474 0408 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys 11:19:41.0553 0408 AliIde - ok 11:19:41.0599 0408 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys 11:19:41.0615 0408 alim1541 - ok 11:19:41.0646 0408 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys 11:19:41.0646 0408 amdagp - ok 11:19:41.0662 0408 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys 11:19:41.0678 0408 amsint - ok 11:19:41.0709 0408 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys 11:19:41.0709 0408 asc - ok 11:19:41.0724 0408 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys 11:19:41.0740 0408 asc3350p - ok 11:19:41.0740 0408 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys 11:19:41.0756 0408 asc3550 - ok 11:19:41.0787 0408 Aspi32 - ok 11:19:41.0818 0408 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 11:19:41.0834 0408 AsyncMac - ok 11:19:41.0881 0408 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 11:19:41.0881 0408 atapi - ok 11:19:41.0912 0408 Atdisk - ok 11:19:41.0974 0408 ati2mtag (f0d0b0cdec0be32d775f404cac2604bf) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 11:19:42.0240 0408 ati2mtag - ok 11:19:42.0349 0408 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 11:19:42.0349 0408 Atmarpc - ok 11:19:42.0396 0408 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 11:19:42.0396 0408 audstub - ok 11:19:42.0428 0408 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 11:19:42.0443 0408 Beep - ok 11:19:42.0474 0408 bvrp_pci - ok 11:19:42.0490 0408 catchme - ok 11:19:42.0521 0408 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys 11:19:42.0521 0408 cbidf - ok 11:19:42.0537 0408 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 11:19:42.0537 0408 cbidf2k - ok 11:19:42.0584 0408 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 11:19:42.0615 0408 CCDECODE - ok 11:19:42.0646 0408 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys 11:19:42.0646 0408 cd20xrnt - ok 11:19:42.0678 0408 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 11:19:42.0678 0408 Cdaudio - ok 11:19:42.0709 0408 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 11:19:42.0724 0408 Cdfs - ok 11:19:42.0740 0408 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 11:19:42.0756 0408 Cdrom - ok 11:19:42.0771 0408 Changer - ok 11:19:42.0834 0408 cmderd (d58b707f3d12ae410ca07d257fd28098) C:\WINDOWS\system32\DRIVERS\cmderd.sys 11:19:42.0849 0408 cmderd - ok 11:19:42.0881 0408 cmdGuard (251f906328af49e7927a1ad12b543a2f) C:\WINDOWS\system32\DRIVERS\cmdguard.sys 11:19:42.0912 0408 cmdGuard - ok 11:19:42.0943 0408 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys 11:19:42.0959 0408 CmdIde - ok 11:19:43.0021 0408 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys 11:19:43.0021 0408 Cpqarray - ok 11:19:43.0084 0408 ctsfm2k (b459ae4afca570088adddbe55eabbc92) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys 11:19:43.0084 0408 ctsfm2k - ok 11:19:43.0115 0408 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys 11:19:43.0131 0408 dac2w2k - ok 11:19:43.0178 0408 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys 11:19:43.0178 0408 dac960nt - ok 11:19:43.0240 0408 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 11:19:43.0256 0408 Disk - ok 11:19:43.0303 0408 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 11:19:43.0318 0408 dmboot - ok 11:19:43.0349 0408 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 11:19:43.0349 0408 dmio - ok 11:19:43.0381 0408 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 11:19:43.0381 0408 dmload - ok 11:19:43.0412 0408 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 11:19:43.0443 0408 DMusic - ok 11:19:43.0474 0408 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys 11:19:43.0506 0408 dpti2o - ok 11:19:43.0537 0408 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 11:19:43.0553 0408 drmkaud - ok 11:19:43.0599 0408 drvmcdb (e814854e6b246ccf498874839ab64d77) C:\WINDOWS\system32\drivers\drvmcdb.sys 11:19:43.0756 0408 drvmcdb - ok 11:19:43.0849 0408 drvnddm (ee83a4ebae70bc93cf14879d062f548b) C:\WINDOWS\system32\drivers\drvnddm.sys 11:19:43.0974 0408 drvnddm - ok 11:19:44.0068 0408 DSproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys 11:19:44.0084 0408 DSproct - ok 11:19:44.0193 0408 dsunidrv (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys 11:19:44.0193 0408 dsunidrv - ok 11:19:44.0224 0408 dwshd - ok 11:19:44.0256 0408 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys 11:19:44.0271 0408 E100B - ok 11:19:44.0349 0408 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 11:19:44.0349 0408 Fastfat - ok 11:19:44.0396 0408 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 11:19:44.0412 0408 Fdc - ok 11:19:44.0428 0408 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 11:19:44.0428 0408 Fips - ok 11:19:44.0459 0408 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 11:19:44.0474 0408 Flpydisk - ok 11:19:44.0521 0408 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 11:19:44.0521 0408 FltMgr - ok 11:19:44.0553 0408 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 11:19:44.0568 0408 Fs_Rec - ok 11:19:44.0599 0408 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 11:19:44.0615 0408 Ftdisk - ok 11:19:44.0646 0408 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 11:19:44.0662 0408 GEARAspiWDM - ok 11:19:44.0693 0408 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 11:19:44.0693 0408 Gpc - ok 11:19:44.0756 0408 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 11:19:44.0771 0408 HidUsb - ok 11:19:44.0803 0408 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys 11:19:44.0818 0408 hpn - ok 11:19:44.0849 0408 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 11:19:44.0959 0408 HPZid412 - ok 11:19:44.0974 0408 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 11:19:45.0099 0408 HPZipr12 - ok 11:19:45.0193 0408 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 11:19:45.0318 0408 HPZius12 - ok 11:19:45.0365 0408 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys 11:19:45.0381 0408 HTTP - ok 11:19:45.0428 0408 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys 11:19:45.0443 0408 i2omgmt - ok 11:19:45.0474 0408 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys 11:19:45.0490 0408 i2omp - ok 11:19:45.0521 0408 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 11:19:45.0537 0408 i8042prt - ok 11:19:45.0599 0408 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 11:19:45.0615 0408 Imapi - ok 11:19:45.0662 0408 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys 11:19:45.0678 0408 ini910u - ok 11:19:45.0756 0408 IntelC51 (7509c548400f4c9e0211e3f6e66abbe6) C:\WINDOWS\system32\DRIVERS\IntelC51.sys 11:19:45.0974 0408 IntelC51 - ok 11:19:46.0099 0408 IntelC52 (9584ffdd41d37f2c239681d0dac2513e) C:\WINDOWS\system32\DRIVERS\IntelC52.sys 11:19:46.0224 0408 IntelC52 - ok 11:19:46.0256 0408 IntelC53 (cf0b937710cec6ef39416edecd803cbb) C:\WINDOWS\system32\DRIVERS\IntelC53.sys 11:19:46.0381 0408 IntelC53 - ok 11:19:46.0412 0408 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 11:19:46.0428 0408 IntelIde - ok 11:19:46.0474 0408 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 11:19:46.0490 0408 intelppm - ok 11:19:46.0537 0408 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 11:19:46.0537 0408 Ip6Fw - ok 11:19:46.0553 0408 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 11:19:46.0568 0408 IpFilterDriver - ok 11:19:46.0615 0408 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 11:19:46.0631 0408 IpInIp - ok 11:19:46.0662 0408 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 11:19:46.0693 0408 IpNat - ok 11:19:46.0724 0408 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 11:19:46.0740 0408 IPSec - ok 11:19:46.0771 0408 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 11:19:46.0771 0408 IRENUM - ok 11:19:46.0818 0408 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 11:19:46.0834 0408 isapnp - ok 11:19:46.0881 0408 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 11:19:46.0881 0408 Kbdclass - ok 11:19:46.0912 0408 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 11:19:46.0912 0408 kbdhid - ok 11:19:46.0959 0408 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 11:19:46.0959 0408 kmixer - ok 11:19:47.0006 0408 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys 11:19:47.0006 0408 KSecDD - ok 11:19:47.0037 0408 lbrtfdc - ok 11:19:47.0146 0408 LVUSBSta (c5efbd05a5195402121711a6ebbb271f) C:\WINDOWS\system32\drivers\lvusbsta.sys 11:19:47.0256 0408 LVUSBSta - ok 11:19:47.0287 0408 MBAMSwissArmy - ok 11:19:47.0334 0408 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 11:19:47.0349 0408 mnmdd - ok 11:19:47.0396 0408 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 11:19:47.0396 0408 Modem - ok 11:19:47.0428 0408 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys 11:19:47.0428 0408 MODEMCSA - ok 11:19:47.0459 0408 mohfilt (59b8b11ff70728eec60e72131c58b716) C:\WINDOWS\system32\DRIVERS\mohfilt.sys 11:19:47.0584 0408 mohfilt - ok 11:19:47.0599 0408 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 11:19:47.0599 0408 Mouclass - ok 11:19:47.0646 0408 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 11:19:47.0662 0408 mouhid - ok 11:19:47.0693 0408 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 11:19:47.0709 0408 MountMgr - ok 11:19:47.0756 0408 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys 11:19:47.0756 0408 mraid35x - ok 11:19:47.0818 0408 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 11:19:47.0849 0408 MRxDAV - ok 11:19:47.0896 0408 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 11:19:47.0928 0408 MRxSmb - ok 11:19:47.0990 0408 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 11:19:47.0990 0408 Msfs - ok 11:19:48.0053 0408 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 11:19:48.0068 0408 MSKSSRV - ok 11:19:48.0099 0408 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 11:19:48.0099 0408 MSPCLOCK - ok 11:19:48.0146 0408 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 11:19:48.0162 0408 MSPQM - ok 11:19:48.0209 0408 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 11:19:48.0209 0408 mssmbios - ok 11:19:48.0256 0408 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 11:19:48.0256 0408 MSTEE - ok 11:19:48.0287 0408 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 11:19:48.0318 0408 Mup - ok 11:19:48.0349 0408 MxlW2k (63d074073d5fda93163517c2a8f2ba5a) C:\WINDOWS\system32\drivers\MxlW2k.sys 11:19:48.0474 0408 MxlW2k - ok 11:19:48.0521 0408 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 11:19:48.0521 0408 NABTSFEC - ok 11:19:48.0584 0408 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 11:19:48.0615 0408 NDIS - ok 11:19:48.0646 0408 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 11:19:48.0646 0408 NdisIP - ok 11:19:48.0662 0408 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 11:19:48.0678 0408 NdisTapi - ok 11:19:48.0724 0408 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 11:19:48.0724 0408 Ndisuio - ok 11:19:48.0756 0408 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 11:19:48.0771 0408 NdisWan - ok 11:19:48.0803 0408 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys 11:19:48.0803 0408 NDProxy - ok 11:19:48.0834 0408 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 11:19:48.0834 0408 NetBIOS - ok 11:19:48.0865 0408 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 11:19:48.0881 0408 NetBT - ok 11:19:48.0974 0408 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 11:19:49.0006 0408 Npfs - ok 11:19:49.0053 0408 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 11:19:49.0084 0408 Ntfs - ok 11:19:49.0131 0408 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 11:19:49.0146 0408 Null - ok 11:19:49.0490 0408 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 11:19:49.0568 0408 nv - ok 11:19:49.0599 0408 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 11:19:49.0631 0408 NwlnkFlt - ok 11:19:49.0662 0408 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 11:19:49.0678 0408 NwlnkFwd - ok 11:19:49.0709 0408 omci (53d5f1278d9edb21689bbbcecc09108d) C:\WINDOWS\system32\DRIVERS\omci.sys 11:19:49.0849 0408 omci - ok 11:19:49.0912 0408 ossrv (c720c25b2d0c93dc425155f5b6a707f3) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys 11:19:49.0928 0408 ossrv - ok 11:19:50.0053 0408 P17 (3a7290f2c423b80ba95becae015b9b1b) C:\WINDOWS\system32\drivers\P17.sys 11:19:50.0209 0408 P17 - ok 11:19:50.0334 0408 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 11:19:50.0334 0408 Parport - ok 11:19:50.0365 0408 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 11:19:50.0365 0408 PartMgr - ok 11:19:50.0396 0408 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 11:19:50.0396 0408 ParVdm - ok 11:19:50.0412 0408 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 11:19:50.0428 0408 PCI - ok 11:19:50.0443 0408 PCIDump - ok 11:19:50.0506 0408 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 11:19:50.0506 0408 PCIIde - ok 11:19:50.0553 0408 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 11:19:50.0568 0408 Pcmcia - ok 11:19:50.0584 0408 PDCOMP - ok 11:19:50.0599 0408 PDFRAME - ok 11:19:50.0631 0408 PDRELI - ok 11:19:50.0646 0408 PDRFRAME - ok 11:19:50.0693 0408 pepifilter (2a3efd6c3f116675d149da5e36a010a4) C:\WINDOWS\system32\DRIVERS\lv302af.sys 11:19:50.0849 0408 pepifilter - ok 11:19:50.0974 0408 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys 11:19:50.0990 0408 perc2 - ok 11:19:51.0021 0408 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys 11:19:51.0037 0408 perc2hib - ok 11:19:51.0115 0408 PfModNT (c8a2d6ff660ac601b7bb9a9b16a5c25e) C:\WINDOWS\system32\drivers\PfModNT.sys 11:19:51.0115 0408 PfModNT - ok 11:19:51.0193 0408 PID_08A0 (cebefeae6156f4fee41f56be89ea9c96) C:\WINDOWS\system32\DRIVERS\LV302AV.SYS 11:19:51.0428 0408 PID_08A0 - ok 11:19:51.0474 0408 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 11:19:51.0490 0408 PptpMiniport - ok 11:19:51.0553 0408 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 11:19:51.0553 0408 PSched - ok 11:19:51.0568 0408 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 11:19:51.0599 0408 Ptilink - ok 11:19:51.0631 0408 PxHelp20 (30cbae0a34359f1cd19d1576245149ed) C:\WINDOWS\system32\Drivers\PxHelp20.sys 11:19:51.0740 0408 PxHelp20 - ok 11:19:51.0771 0408 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys 11:19:51.0771 0408 ql1080 - ok 11:19:51.0803 0408 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys 11:19:51.0803 0408 Ql10wnt - ok 11:19:51.0849 0408 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys 11:19:51.0849 0408 ql12160 - ok 11:19:51.0865 0408 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys 11:19:51.0881 0408 ql1240 - ok 11:19:51.0912 0408 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys 11:19:51.0912 0408 ql1280 - ok 11:19:51.0943 0408 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 11:19:51.0974 0408 RasAcd - ok 11:19:52.0021 0408 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 11:19:52.0021 0408 Rasl2tp - ok 11:19:52.0068 0408 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 11:19:52.0068 0408 RasPppoe - ok 11:19:52.0099 0408 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 11:19:52.0099 0408 Raspti - ok 11:19:52.0146 0408 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 11:19:52.0162 0408 Rdbss - ok 11:19:52.0209 0408 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 11:19:52.0224 0408 RDPCDD - ok 11:19:52.0271 0408 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 11:19:52.0271 0408 rdpdr - ok 11:19:52.0318 0408 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 11:19:52.0318 0408 RDPWD - ok 11:19:52.0365 0408 redbook (5cd57ec10503bbdb583ebbd734b40e67) C:\WINDOWS\system32\DRIVERS\redbook.sys 11:19:52.0474 0408 redbook ( Rootkit.Win32.ZAccess.j ) - infected 11:19:52.0474 0408 redbook - detected Rootkit.Win32.ZAccess.j (0) 11:19:52.0631 0408 SASDIFSV (c030c9a39e85b6f04a8dd25d1a50258a) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 11:19:52.0646 0408 SASDIFSV - ok 11:19:52.0678 0408 SASENUM (e9c2d75c748c3f0a4c34d6cf2ae1d754) C:\Program Files\SUPERAntiSpyware\SASENUM.SYS 11:19:52.0693 0408 SASENUM - ok 11:19:52.0724 0408 SASKUTIL (64c100dbf57c6cb6e7d5d24153f5e444) C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys 11:19:52.0724 0408 SASKUTIL - ok 11:19:52.0865 0408 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 11:19:52.0881 0408 Secdrv - ok 11:19:52.0943 0408 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 11:19:52.0943 0408 serenum - ok 11:19:52.0974 0408 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 11:19:52.0990 0408 Serial - ok 11:19:53.0021 0408 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 11:19:53.0037 0408 Sfloppy - ok 11:19:53.0068 0408 Simbad - ok 11:19:53.0099 0408 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys 11:19:53.0115 0408 sisagp - ok 11:19:53.0162 0408 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 11:19:53.0178 0408 SLIP - ok 11:19:53.0224 0408 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys 11:19:53.0224 0408 Sparrow - ok 11:19:53.0256 0408 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 11:19:53.0256 0408 splitter - ok 11:19:53.0318 0408 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 11:19:53.0334 0408 sr - ok 11:19:53.0396 0408 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys 11:19:53.0428 0408 Srv - ok 11:19:53.0459 0408 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys 11:19:53.0615 0408 sscdbhk5 - ok 11:19:53.0709 0408 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys 11:19:53.0818 0408 ssrtln - ok 11:19:53.0881 0408 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 11:19:53.0881 0408 streamip - ok 11:19:53.0912 0408 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 11:19:53.0928 0408 swenum - ok 11:19:53.0943 0408 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 11:19:53.0959 0408 swmidi - ok 11:19:54.0006 0408 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys 11:19:54.0021 0408 symc810 - ok 11:19:54.0053 0408 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys 11:19:54.0068 0408 symc8xx - ok 11:19:54.0115 0408 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys 11:19:54.0115 0408 sym_hi - ok 11:19:54.0131 0408 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys 11:19:54.0146 0408 sym_u3 - ok 11:19:54.0178 0408 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 11:19:54.0209 0408 sysaudio - ok 11:19:54.0287 0408 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 11:19:54.0303 0408 Tcpip - ok 11:19:54.0349 0408 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 11:19:54.0365 0408 TDPIPE - ok 11:19:54.0412 0408 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 11:19:54.0428 0408 TDTCP - ok 11:19:54.0459 0408 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 11:19:54.0474 0408 TermDD - ok 11:19:54.0568 0408 tfsnboio (75b30b9ea32fe7d8bbc332d3b944ad46) C:\WINDOWS\system32\dla\tfsnboio.sys 11:19:54.0693 0408 tfsnboio - ok 11:19:54.0724 0408 tfsncofs (b811a431b14694d88eb5befaa55b4501) C:\WINDOWS\system32\dla\tfsncofs.sys 11:19:54.0818 0408 tfsncofs - ok 11:19:54.0865 0408 tfsndrct (f5e2cf2144f1fe51dadd6e9063d311eb) C:\WINDOWS\system32\dla\tfsndrct.sys 11:19:54.0959 0408 tfsndrct - ok 11:19:55.0006 0408 tfsndres (e32b32045b6b914fd4caae8be6ca7e8a) C:\WINDOWS\system32\dla\tfsndres.sys 11:19:55.0115 0408 tfsndres - ok 11:19:55.0146 0408 tfsnifs (43034b10a94d1c6f13a1a0e848f51226) C:\WINDOWS\system32\dla\tfsnifs.sys 11:19:55.0303 0408 tfsnifs - ok 11:19:55.0334 0408 tfsnopio (f5ee0faafde37326ea35acbfa5defd3d) C:\WINDOWS\system32\dla\tfsnopio.sys 11:19:55.0459 0408 tfsnopio - ok 11:19:55.0553 0408 tfsnpool (597348eb65b3e19709e9a45ca2b30b61) C:\WINDOWS\system32\dla\tfsnpool.sys 11:19:55.0646 0408 tfsnpool - ok 11:19:55.0787 0408 tfsnudf (767affd52432a0f7e7d39f6ff64401f4) C:\WINDOWS\system32\dla\tfsnudf.sys 11:19:55.0912 0408 tfsnudf - ok 11:19:55.0943 0408 tfsnudfa (2806b2fd00263ccd90cc0638c6139eb0) C:\WINDOWS\system32\dla\tfsnudfa.sys 11:19:56.0068 0408 tfsnudfa - ok 11:19:56.0162 0408 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys 11:19:56.0178 0408 TosIde - ok 11:19:56.0240 0408 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 11:19:56.0240 0408 Udfs - ok 11:19:56.0271 0408 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys 11:19:56.0287 0408 ultra - ok 11:19:56.0349 0408 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 11:19:56.0381 0408 Update - ok 11:19:56.0443 0408 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys 11:19:56.0459 0408 USBAAPL - ok 11:19:56.0506 0408 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys 11:19:56.0506 0408 usbaudio - ok 11:19:56.0553 0408 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 11:19:56.0568 0408 usbccgp - ok 11:19:56.0615 0408 USBCM (d21cde1c635bcc5053463579eee453cf) C:\WINDOWS\system32\DRIVERS\Sacm2A.sys 11:19:56.0740 0408 USBCM - ok 11:19:56.0787 0408 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 11:19:56.0803 0408 usbehci - ok 11:19:56.0849 0408 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 11:19:56.0865 0408 usbhub - ok 11:19:56.0912 0408 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 11:19:56.0912 0408 usbprint - ok 11:19:56.0959 0408 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 11:19:56.0959 0408 usbscan - ok 11:19:56.0990 0408 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 11:19:57.0006 0408 USBSTOR - ok 11:19:57.0037 0408 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 11:19:57.0037 0408 usbuhci - ok 11:19:57.0084 0408 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 11:19:57.0084 0408 VgaSave - ok 11:19:57.0131 0408 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys 11:19:57.0131 0408 viaagp - ok 11:19:57.0162 0408 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys 11:19:57.0193 0408 ViaIde - ok 11:19:57.0240 0408 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 11:19:57.0271 0408 VolSnap - ok 11:19:57.0365 0408 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 11:19:57.0381 0408 Wanarp - ok 11:19:57.0396 0408 wanatw - ok 11:19:57.0428 0408 WDICA - ok 11:19:57.0474 0408 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 11:19:57.0474 0408 wdmaud - ok 11:19:57.0646 0408 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 11:19:57.0646 0408 WS2IFSL - ok 11:19:57.0693 0408 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 11:19:57.0709 0408 WSTCODEC - ok 11:19:57.0756 0408 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 11:19:57.0771 0408 WudfPf - ok 11:19:57.0803 0408 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 11:19:57.0803 0408 WudfRd - ok 11:19:57.0881 0408 zealtoje - ok 11:19:57.0912 0408 zgzz - ok 11:19:57.0959 0408 MBR (0x1B8) (b16a2359f4962b0c622d81a1c1f4b703) \Device\Harddisk0\DR0 11:19:57.0974 0408 \Device\Harddisk0\DR0 - ok 11:19:57.0990 0408 Boot (0x1200) (097e9b2800609f38f28791a52063195e) \Device\Harddisk0\DR0\Partition0 11:19:57.0990 0408 \Device\Harddisk0\DR0\Partition0 - ok 11:19:57.0990 0408 ============================================================ 11:19:57.0990 0408 Scan finished 11:19:57.0990 0408 ============================================================ 11:19:58.0006 1676 Detected object count: 1 11:19:58.0006 1676 Actual detected object count: 1 11:20:32.0631 1676 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\redbook.sys) error 1813 11:20:35.0974 1676 Backup copy found, using it.. 11:20:36.0193 1676 C:\WINDOWS\system32\DRIVERS\redbook.sys - will be cured on reboot 11:20:36.0193 1676 redbook ( Rootkit.Win32.ZAccess.j ) - User select action: Cure 11:20:39.0724 2800 Deinitialize success

jeffce

Post #13November 9, 2011, 9:04 PM UTC

Hi aconnerty,

Please download Junction.zip and save it to your desktop.
Unzip it and put junction.exe in the Windows directory (C:\Windows) so you have C:\Windows\Junction.exe
Now go to Start > Run to open a run box > Copy and paste the following command in the open run box and click OK:

cmd /c junction -s c:\ >log.txt&log.txt& del log.txt

A command window will open and the system will be scanned.
Wait until a log file opens.
Copy and paste log in your next reply

aconnerty

Post #14November 9, 2011, 9:34 PM UTC

I think I'm doing something incorrectly. Here is the log file that is returned: Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com Failed to open \\?\c:\\hiberfil.sys: The process cannot access the file because it is being used by another process. Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. Failed to open \\?\c:\\Program Files\Audible\Admin: Access is denied. Failed to open \\?\c:\\Program Files\COMODO\COMODO Internet Security\Quarantine: Access is denied. … Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied. .\\?\c:\\WINDOWS\ASSEMBLY\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 \\?\c:\\WINDOWS\ASSEMBLY\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a: JUNCTION Print Name : C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e Substitute Name: C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e .. …

jeffce

Post #15November 10, 2011, 2:45 AM UTC

Hi aconnerty,

Please download GrantPerms.zip and save it to your desktop.
Unzip the file and depending on the system run GrantPerms.exe
Copy and paste the following in the edit box:

c:\Program Files\Audible\Admin
c:\Program Files\COMODO\COMODO Internet Security\Quarantine
c:\Qoobox\BackEnv
…
Click Unlock. When it is done click "OK".
Click List Permissions and post the result (Perms.txt) that pops up. A copy of Perms.txt will be saved in the same directory the tool is run.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Hodgepode - Slow Processing/Google Redirect/Trojan - mwusvw32.dll/ping

✨ Ask AI

Ask AI