What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google Redirect to www.midllesearch.net

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi, I've been seeing this around in other places as well, but I just got hit with something that redirects me to http://www.midllesearch.net/cc.php?id=####### (it changes most times), then onto another page. I've run Spybot and Ad-Aware but they came up blank. I tried to run Emsisoft Anti-Malware but when I clicked on the shortcut it said "A major problem prevents application start. Anti-Malware can't connect to the service application. Please reboot your PC and try again or contact support if the problem remains." I've tried shutting down and restarting and it didn't work.

Any light that can be shed on this would be highly appreciated. :pullhair:

Here's my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:45:04 PM, on 11/12/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Microsoft IntelliPoint\IPoint.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Any_Password\AnyPass.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Kevin\Desktop\HiJackThis.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 94.63.240.129 www.google.com
O1 - Hosts: 94.63.240.130 www.bing.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: IE5BarLauncherBHO Class - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\vShare.tv plugin\BarLcher.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SearchCore for Browsers - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~1\SEARCH~1\SEARCH~1\BROWSE~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: VShareToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Microsoft Winrar Updater] Winrar32.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [volmgr] C:\Documents and Settings\Kevin\Application Data\volmgr.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [volmgr] C:\Documents and Settings\Kevin\Application Data\volmgr.exe
O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\Ereg\eReg.exe
O4 - Startup: OneNote Table Of Contents.onetoc2
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\Kevin\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\Kevin\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1238437709671
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - AppInit_DLLs: C:\PROGRA~1\SEARCH~1\SEARCH~1\datamngr.dll C:\PROGRA~1\SEARCH~1\SEARCH~1\IEBHO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

–
End of file - 10403 bytes
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

Please download DDS from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
———-

Please download DeFogger to your desktop.
Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • If it needs to, DeFogger may ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.
———-

GMER

Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries.
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
    Vista and Windows 7 users right click the icon and choose "Run as administrator".
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post the logs created by DDS, GMER and aswMBR. :)
Post #3
Hi Jeff, thanks for taking a look at this! Sorry for taking so long to respond, a couple of these scans must be quite thorough because they took quite some time (any my computer crashed once).

For the sake of posting all symptoms - Google Docs webpage won't load for me at all. Some friends and I are working on a project and they can load docs.google.com, but I can't. I don't know if this has anything to do with the problem we're looking for or if it's a stand alone problem.

Also, I when I was trying to get to Google Docs, the IMESH toolbar started interrupting websites that I typed into the top bar. I installed IMESH for about 3 minutes until I saw the problem with Firefox and Chrome (my two main browsers), and deleted the root program immediately. Sadly it still seems to be causing me problems. Again, I don't know if this is a part of the problem or just another stand alone problem, but it'd be nice if it could be fixed too.

The GMER.txt couldn't be attached because it's 1.29 MB, and can't be included in the main text because it makes the post too big. Is there another way I can get this output to you? The other outputs are formatted as requested:

Here's the DDS Log:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_25
Run by [removed] at 21:55:43 on 2011-11-12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.653 [GMT -5:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
FW: ZoneAlarm Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Microsoft IntelliPoint\IPoint.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Kevin\Application Data\Dropbox\bin\Dropbox.exe
C:\WINDOWS\Explorer.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://startsear.ch/?aff=1
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {53707962-6f74-2d53-2644-206d7942484f} - Spybot-S&D IE Protection
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: IE5BarLauncherBHO Class: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - c:\program files\vshare.tv plugin\BarLcher.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: SearchCore for Browsers: {be7a24f5-69cb-4708-b77b-b1eda6043b95} - c:\progra~1\search~1\search~1\BROWSE~1.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: VShareToolBar: {7ac3e13b-3bca-4158-b330-f66dbb03c1b5} - c:\program files\vshare.tv plugin\BarLcher.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [volmgr] c:\documents and settings\kevin\application data\volmgr.exe
mRun: [TpShocks] TpShocks.exe
mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe
mRun: [PWRMGRTR] rundll32 c:\progra~1\thinkpad\utilit~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [BLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BatLogEx.DLL,StartBattLog
mRun: [AwaySch] c:\program files\lenovo\awaytask\AwaySch.EXE
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [Microsoft Winrar Updater] Winrar32.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [volmgr] c:\documents and settings\kevin\application data\volmgr.exe
StartupFolder: c:\docume~1\kevin\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\kevin\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\kevin\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\ereg\eReg.exe
StartupFolder: c:\documents and settings\kevin\start menu\programs\startup\OneNote Table Of Contents.onetoc2
IE: E&xport to Microsoft Excel
IE: Free YouTube Download - c:\documents and settings\kevin\application data\dvdvideosoftiehelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\kevin\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: Open with WordPerfect
IE: Send to &Bluetooth Device…
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F}
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238437709671
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{9C05C29F-A9B2-4DA1-A296-26EC8A62E6AB} : DhcpNameServer = 192.168.0.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: tpfnf2 - c:\program files\lenovo\hotkey\notifyf2.dll
Notify: tphotkey - c:\program files\lenovo\hotkey\tphklock.dll
AppInit_DLLs: c:\progra~1\search~1\search~1\datamngr.dll c:\progra~1\search~1\search~1\IEBHO.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 94.63.240.129 www.google.com
Hosts: 94.63.240.130 www.bing.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\kevin\application data\mozilla\firefox\profiles\kb00h0ho.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\kevin\application data\mozilla\firefox\profiles\kb00h0ho.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\kevin\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npvsharetvplg.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPZoneSB.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - Ext: printpdf: [removed] - %profile%\extensions\[removed]
FF - Ext: Flashblock: {3d7eb24f-2740-49df-8937-200b1cc08f8a} - %profile%\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-9-18 64512]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2007-10-16 19504]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-10-30 232512]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-4-24 532224]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-11-3 2152152]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2007-2-8 569344]
R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2011-8-19 450848]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-11-3 15232]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2007-5-22 30336]
S3 Dell1110_FUService;Dell 1110 Status Monitor Service;"c:\program files\dell\dell laser printer 1110\localsm\ssmsrvc /service –> c:\program files\dell\dell laser printer 1110\localsm\ssmsrvc [?]
S3 gupdate;Google Update Service (gupdate);"c:\program files\google\update\googleupdate.exe" /svc –> c:\program files\google\update\GoogleUpdate.exe [?]
S4 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\emsisoft anti-malware\a2service.exe [2010-11-22 2855440]
.
=============== File Associations ===============
.
regfile="regedit.exe" "%1"
.txt=txt_auto_file
.
=============== Created Last 30 ================
.
2011-11-13 00:12:22 ——– d—–w- c:\documents and settings\kevin\application data\Dropbox
2011-11-12 00:54:03 72704 –sh–w- c:\documents and settings\kevin\application data\volmgr.exe
2011-11-12 00:54:03 26624 –sh–w- c:\documents and settings\kevin\application data\volmgr.dll
2011-11-08 01:01:14 ——– d—–w- c:\program files\Croteam
2011-11-07 20:10:54 ——– d—–w- c:\documents and settings\kevin\local settings\application data\Logitech® Webcam Software
2011-11-07 15:06:43 53248 —-a-r- c:\documents and settings\kevin\application data\microsoft\installer\{3ee9bcae-e9a9-45e5-9b1c-83a4d357e05c}\ARPPRODUCTICON.exe
2011-11-07 15:04:28 ——– d—–w- c:\program files\common files\LWS
2011-10-30 23:10:14 ——– d—–w- c:\program files\Call of Duty
2011-10-30 23:01:59 232512 —-a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-10-30 22:53:12 ——– d—–w- c:\program files\DAEMON Tools Lite
2011-10-22 20:04:01 ——– d—–w- c:\program files\vShare.tv plugin
2011-10-20 00:55:06 ——– d—–w- c:\program files\DAEMON Tools Pro
2011-10-20 00:52:50 ——– d—–w- c:\documents and settings\kevin\application data\DAEMON Tools Pro
2011-10-20 00:52:50 ——– d—–w- c:\documents and settings\all users\application data\DAEMON Tools Pro
2011-10-16 20:17:23 ——– d—–w- c:\documents and settings\kevin\application data\mediabarim
2011-10-16 20:16:54 ——– d—–w- c:\documents and settings\all users\application data\boost_interprocess
2011-10-16 20:16:52 ——– d—–w- c:\program files\SearchCore for Browsers
2011-10-16 20:15:07 ——– d—–w- c:\documents and settings\kevin\local settings\application data\PackageAware
.
==================== Find3M ====================
.
2011-11-03 17:06:56 64512 —-a-w- c:\windows\system32\drivers\Lbd.sys
2011-10-30 22:53:29 443448 —-a-w- c:\windows\system32\drivers\sptd.sys
2011-10-15 10:36:24 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-27 12:16:34 249856 ——w- c:\windows\Setup1.exe
2011-09-27 12:16:31 73216 —-a-w- c:\windows\ST6UNST.EXE
2011-09-26 15:41:20 611328 —-a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41:20 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41:14 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2011-09-18 15:56:25 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-09-18 15:56:24 16432 —-a-w- c:\windows\system32\lsdelete.exe
2011-09-09 09:12:13 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20:51 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-08-22 23:48:55 916480 —-a-w- c:\windows\system32\wininet.dll
2011-08-22 23:48:54 43520 ——w- c:\windows\system32\licmgr10.dll
2011-08-22 23:48:54 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-08-22 11:56:39 385024 ——w- c:\windows\system32\html.iec
2011-08-19 09:26:50 545056 —-a-w- c:\windows\system32\LVUI2.dll
2011-08-19 09:26:50 540960 —-a-w- c:\windows\system32\LVUI2RC.dll
2011-08-19 09:26:50 4334624 —-a-w- c:\windows\system32\drivers\lvuvc.sys
2011-08-19 09:26:46 315808 —-a-w- c:\windows\system32\drivers\lvrs.sys
2011-08-19 09:26:46 307488 —-a-w- c:\windows\system32\lvcodec2.dll
2011-08-19 09:26:46 196896 —-a-w- c:\windows\system32\lvci13301394.dll
2011-08-19 09:26:20 336408 —-a-w- c:\windows\system32\DevManagerCore.dll
2011-08-19 09:26:20 10898456 —-a-w- c:\windows\system32\LogiDPP.dll
2011-08-19 09:26:20 104472 —-a-w- c:\windows\system32\LogiDPPApp.exe
2011-08-17 13:49:54 138496 —-a-w- c:\windows\system32\drivers\afd.sys
.
============= FINISH: 21:56:48.96 ===============


And here's my aswMBR log:

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-12 22:22:07
—————————–
22:22:07.937 OS Version: Windows 5.1.2600 Service Pack 3
22:22:07.937 Number of processors: 2 586 0x1706
22:22:07.937 ComputerName: LENOVO-A997F3AB UserName: Kevin
22:22:10.671 Initialize success
22:22:20.656 AVAST engine defs: 11111201
22:22:37.750 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
22:22:37.750 Disk 0 Vendor: WDC_WD25 02.0 Size: 238475MB BusType: 3
22:22:37.781 Disk 0 MBR read successfully
22:22:37.781 Disk 0 MBR scan
22:22:37.828 Disk 0 unknown MBR code
22:22:37.828 Disk 0 scanning sectors +488391120
22:22:37.906 Disk 0 scanning C:\WINDOWS\system32\drivers
22:22:54.546 Service scanning
22:22:55.687 Service vsdatant C:\WINDOWS\System32\vsdatant.sys **LOCKED** 32
22:22:56.203 Modules scanning
22:23:01.078 Disk 0 trace - called modules:
22:23:01.109 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
22:23:01.109 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aa01738]
22:23:01.109 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000088[0x8aa16b58]
22:23:01.109 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8aa02030]
22:23:02.312 AVAST engine scan C:\WINDOWS
22:23:16.937 AVAST engine scan C:\WINDOWS\system32
22:25:27.281 AVAST engine scan C:\WINDOWS\system32\drivers
22:25:44.921 AVAST engine scan C:\Documents and Settings\Kevin
22:41:15.140 File: C:\Documents and Settings\Kevin\Application Data\volmgr.dll **HIDDEN**
22:41:15.250 File: C:\Documents and Settings\Kevin\Application Data\volmgr.exe **HIDDEN**
22:41:44.421 AVAST engine scan C:\Documents and Settings\All Users
22:44:47.015 Scan finished successfully
22:52:20.703 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Kevin\Desktop\MBR.dat"
22:52:20.703 The log file has been saved successfully to "C:\Documents and Settings\Kevin\Desktop\aswMBR.txt"

Attachments:

Post #4
Hi reciprical,

You can break the GMER post into different parts and post that. :) That would be more than fine to do.
——————-

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
———-

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
——————–

In your next reply please post the logs created by MBRCheck and TDSSKiller. :)
Post #8
And here are the following two output logs:

- MBRCheck output:

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 163):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA4BC000 compbatt.sys
0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xB9F4A000 pcmcia.sys
0xBA0B8000 MountMgr.sys
0xB9F2B000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F05000 dmio.sys
0xBA330000 PartMgr.sys
0xBA4C4000 ACPIEC.sys
0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xBA0C8000 VolSnap.sys
0xB9EED000 atapi.sys
0xB9E2F000 iaStor.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9E0F000 fltmgr.sys
0xB9DFD000 sr.sys
0xBA0F8000 Lbd.sys
0xB9DE7000 DRVMCDB.SYS
0xBA108000 PxHelp20.sys
0xB9DD0000 KSecDD.sys
0xB9D43000 Ntfs.sys
0xB9D16000 NDIS.sys
0xB9CFA000 Apsx86.sys
0xBA338000 ApsHM86.sys
0xBA118000 ohci1394.sys
0xBA128000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xB9CE0000 Mup.sys
0xBA158000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBA1A8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB7CFE000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xB7CEA000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA428000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB7CC6000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA430000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB7C9E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB7A83000 \SystemRoot\system32\DRIVERS\NETw4x32.sys
0xB7A58000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xB7A44000 \SystemRoot\system32\DRIVERS\sdbus.sys
0xB7A33000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0xBA1B8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA440000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB7A09000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xB798E000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xBA448000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA450000 \SystemRoot\system32\DRIVERS\atmeltpm.sys
0xB923E000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xB923A000 \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
0xBA1D8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA458000 \SystemRoot\system32\drivers\iviaspi.sys
0xBA5F2000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xBA1E8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA1F8000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB796B000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA460000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xB789B000 \SystemRoot\system32\DRIVERS\btkrnl.sys
0xBA753000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA208000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB922E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB7884000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA218000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA228000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA468000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xBA470000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA478000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB7854000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA238000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA480000 \SystemRoot\system32\DRIVERS\psadd.sys
0xBA488000 \SystemRoot\system32\DRIVERS\Tvti2c.sys
0xBA5F4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB77F6000 \SystemRoot\system32\DRIVERS\update.sys
0xBA5A0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB77B9000 \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
0xB97E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA268000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA61C000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA172E000 \SystemRoot\system32\drivers\CHDAudN.sys
0xA170A000 \SystemRoot\system32\drivers\portcls.sys
0xBA168000 \SystemRoot\system32\drivers\drmk.sys
0xA16D6000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
0xA15E4000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
0xA1531000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xA4957000 \SystemRoot\System32\Drivers\Modem.SYS
0x9BD77000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xBA61A000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x9B1AA000 \SystemRoot\System32\Drivers\Null.SYS
0xBA61E000 \SystemRoot\System32\Drivers\Beep.SYS
0x9B3E9000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
0x9B3E1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x9B3D1000 \SystemRoot\System32\drivers\vga.sys
0xBA620000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA622000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x9AD09000 \SystemRoot\System32\Drivers\Msfs.SYS
0x9AD01000 \SystemRoot\System32\Drivers\Npfs.SYS
0x9B69A000 \SystemRoot\system32\DRIVERS\rasacd.sys
0x99FA2000 \SystemRoot\system32\DRIVERS\ipsec.sys
0x9AF5D000 \SystemRoot\system32\DRIVERS\msgpc.sys
0x99F49000 \SystemRoot\system32\DRIVERS\tcpip.sys
0x99F21000 \SystemRoot\system32\DRIVERS\netbt.sys
0x99EFB000 \SystemRoot\system32\DRIVERS\ipnat.sys
0x9AF4D000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x99E7A000 \SystemRoot\System32\vsdatant.sys
0x99E58000 \SystemRoot\System32\drivers\afd.sys
0x9AF3D000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9ACF9000 \SystemRoot\System32\drivers\TSMAPIP.SYS
0x9ACF1000 \SystemRoot\System32\drivers\Tppwrif.sys
0x9ACE9000 \SystemRoot\system32\DRIVERS\TPHKDRV.sys
0x99E0D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x99D9D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA628000 \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
0x9AF0D000 \SystemRoot\System32\Drivers\Fips.SYS
0x9B676000 \SystemRoot\System32\drivers\ANC.SYS
0x9A903000 \SystemRoot\System32\Drivers\btwusb.sys
0x9A8F3000 \SystemRoot\System32\Drivers\Cdfs.SYS
0x9ACE1000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x99CDF000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x9A8A3000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x9A560000 \SystemRoot\System32\drivers\Dxapi.sys
0x9ACC9000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0x9E84E000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04E000 \SystemRoot\System32\igxpdv32.DLL
0xBF1F2000 \SystemRoot\System32\igxpdx32.DLL
0xBF48D000 \SystemRoot\System32\ATMFD.DLL
0xB82DE000 \SystemRoot\system32\DRIVERS\tvtfilter.sys
0xB82CE000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
0x9A295000 \SystemRoot\System32\DLA\DLADResN.SYS
0x99CC9000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
0x9D258000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
0x9B26A000 \SystemRoot\System32\DLA\DLAPoolM.SYS
0xA1EAB000 \SystemRoot\System32\DLA\DLABOIOM.SYS
0x99CB1000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
0x99C9B000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
0xBA348000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xB5660000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB5654000 \SystemRoot\system32\DRIVERS\s24trans.sys
0x9A3F0000 \SystemRoot\system32\DRIVERS\PROCDD.SYS
0x99B6B000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xBA5D4000 \??\C:\WINDOWS\System32\drivers\pmemnt.sys
0x99A63000 \SystemRoot\system32\DRIVERS\secdrv.sys
0x9966E000 \SystemRoot\system32\drivers\wdmaud.sys
0x99823000 \SystemRoot\system32\drivers\sysaudio.sys
0x992BC000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x990B3000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x995CE000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x989BB000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xA281C000 \SystemRoot\system32\DRIVERS\point32.sys
0x97678000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 75):
0 System Idle Process
4 System
448 C:\WINDOWS\system32\smss.exe
648 csrss.exe
672 C:\WINDOWS\system32\winlogon.exe
716 C:\WINDOWS\system32\services.exe
728 C:\WINDOWS\system32\lsass.exe
964 C:\WINDOWS\system32\ibmpmsvc.exe
992 C:\WINDOWS\system32\svchost.exe
1040 svchost.exe
1108 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
1200 C:\WINDOWS\system32\svchost.exe
1332 C:\WINDOWS\system32\ZoneLabs\vsmon.exe
1860 C:\WINDOWS\explorer.exe
504 C:\WINDOWS\system32\spoolsv.exe
488 C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
564 C:\WINDOWS\system32\IPSSVC.EXE
572 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
600 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
628 C:\Program Files\Bonjour\mDNSResponder.exe
184 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
1128 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
1148 C:\Program Files\Java\jre6\bin\jqs.exe
1364 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
784 sqlbrowser.exe
1548 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
1580 C:\WINDOWS\system32\svchost.exe
1648 C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
1704 C:\WINDOWS\system32\TPHDEXLG.exe
1776 C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
2008 C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
2040 C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
2144 wdfmgr.exe
2168 C:\WINDOWS\system32\searchindexer.exe
2212 C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
3580 HP1006MC.EXE
2156 wmiprvse.exe
2388 alg.exe
3104 C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
3536 C:\WINDOWS\system32\TpShocks.exe
3660 C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
3696 C:\WINDOWS\system32\rundll32.exe
1012 C:\WINDOWS\system32\igfxpers.exe
3712 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
3780 C:\WINDOWS\system32\igfxsrvc.exe
3816 C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
3812 C:\WINDOWS\system32\hkcmd.exe
3856 C:\PROGRA~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE
3652 C:\WINDOWS\system32\DLA\DLACTRLW.EXE
4016 C:\Program Files\Lenovo\ZOOM\TpScrex.exe
4084 C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
3760 C:\Program Files\Apoint2K\Apoint.exe
2792 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
1740 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1748 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
2676 C:\Program Files\iTunes\iTunesHelper.exe
2744 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
2948 C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
3068 C:\Program Files\Apoint2K\ApMsgFwd.exe
3320 C:\Documents and Settings\Kevin\Application Data\Dropbox\bin\Dropbox.exe
3352 C:\Program Files\Apoint2K\ApntEx.exe
3800 C:\Program Files\iPod\bin\iPodService.exe
3768 C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
1904 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
3096 C:\Program Files\Windows Live\Contacts\wlcomm.exe
2936 C:\Program Files\iTunes\iTunes.exe
1892 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
3176 C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
2000 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
3272 C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
5108 C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
4424 C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
5940 C:\WINDOWS\system32\searchprotocolhost.exe
5104 searchfilterhost.exe
1064 C:\Documents and Settings\Kevin\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\F: –> \\.\PhysicalDrive1 at offset 0x00000000`007e0000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-08UST0, Rev: 02.01A02
PhysicalDrive1 Model Number: HitachiHTS542525K9SA00, Rev:

Size Device Name MBR Status
——————————————–
232 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 89B412FA1E8D713152B0097AA30842FEDAD43BE0
232 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!


- And the TDSSKiller log is here:

10:46:42.0765 5332 TDSS rootkit removing tool [removed] Nov 11 2011 15:47:15
10:46:45.0062 5332 ============================================================
10:46:45.0062 5332 Current date / time: 2011/11/13 10:46:45.0062
10:46:45.0062 5332 SystemInfo:
10:46:45.0062 5332
10:46:45.0062 5332 OS Version: 5.1.2600 ServicePack: 3.0
10:46:45.0062 5332 Product type: Workstation
10:46:45.0062 5332 ComputerName: LENOVO-A997F3AB
10:46:45.0062 5332 UserName: Kevin
10:46:45.0062 5332 Windows directory: C:\WINDOWS
10:46:45.0062 5332 System windows directory: C:\WINDOWS
10:46:45.0062 5332 Processor architecture: Intel x86
10:46:45.0062 5332 Number of processors: 2
10:46:45.0062 5332 Page size: 0x1000
10:46:45.0062 5332 Boot type: Normal boot
10:46:45.0062 5332 ============================================================
10:46:49.0453 5332 Initialize success
10:46:58.0546 5432 ============================================================
10:46:58.0546 5432 Scan started
10:46:58.0546 5432 Mode: Manual;
10:46:58.0546 5432 ============================================================
10:47:00.0765 5432 Abiosdsk - ok
10:47:00.0796 5432 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
10:47:00.0796 5432 abp480n5 - ok
10:47:00.0796 5432 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
10:47:00.0812 5432 ac97intc - ok
10:47:00.0859 5432 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:47:00.0859 5432 ACPI - ok
10:47:00.0875 5432 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
10:47:00.0875 5432 ACPIEC - ok
10:47:01.0031 5432 adfs - ok
10:47:01.0171 5432 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
10:47:01.0203 5432 adpu160m - ok
10:47:01.0343 5432 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
10:47:01.0359 5432 aec - ok
10:47:01.0406 5432 AegisP (a1ad1a4a9f18d900ca9c93fa3efdcb56) C:\WINDOWS\system32\DRIVERS\AegisP.sys
10:47:01.0406 5432 AegisP - ok
10:47:01.0468 5432 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
10:47:01.0484 5432 AFD - ok
10:47:01.0500 5432 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
10:47:01.0500 5432 agp440 - ok
10:47:01.0531 5432 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
10:47:01.0531 5432 agpCPQ - ok
10:47:01.0546 5432 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
10:47:01.0546 5432 Aha154x - ok
10:47:01.0546 5432 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
10:47:01.0546 5432 aic78u2 - ok
10:47:01.0562 5432 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
10:47:01.0562 5432 aic78xx - ok
10:47:01.0578 5432 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
10:47:01.0578 5432 AliIde - ok
10:47:01.0593 5432 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
10:47:01.0593 5432 alim1541 - ok
10:47:01.0609 5432 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
10:47:01.0609 5432 amdagp - ok
10:47:01.0609 5432 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
10:47:01.0609 5432 amsint - ok
10:47:01.0656 5432 ANC (11ab185a7af224800bbfb5b836974a17) C:\WINDOWS\system32\drivers\ANC.SYS
10:47:01.0656 5432 ANC - ok
10:47:01.0703 5432 ApfiltrService (bb53e21960498ebacb7d2e676f034083) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
10:47:01.0703 5432 ApfiltrService - ok
10:47:01.0734 5432 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
10:47:01.0734 5432 Arp1394 - ok
10:47:01.0750 5432 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
10:47:01.0750 5432 asc - ok
10:47:01.0765 5432 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
10:47:01.0765 5432 asc3350p - ok
10:47:01.0765 5432 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
10:47:01.0765 5432 asc3550 - ok
10:47:01.0812 5432 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:47:01.0812 5432 AsyncMac - ok
10:47:01.0843 5432 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:47:01.0859 5432 atapi - ok
10:47:01.0859 5432 Atdisk - ok
10:47:01.0890 5432 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:47:01.0890 5432 Atmarpc - ok
10:47:01.0921 5432 atmeltpm (dbf0d7e2df33b469eb55406fea759350) C:\WINDOWS\system32\DRIVERS\atmeltpm.sys
10:47:01.0921 5432 atmeltpm - ok
10:47:01.0953 5432 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:47:01.0953 5432 audstub - ok
10:47:02.0000 5432 b57w2k (66dd574749c38153c6067ebba929befc) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
10:47:02.0000 5432 b57w2k - ok
10:47:02.0031 5432 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:47:02.0031 5432 Beep - ok
10:47:02.0109 5432 BTKRNL (9da09b5800b9de8336948664e3b9cc94) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
10:47:02.0140 5432 BTKRNL - ok
10:47:02.0156 5432 BTWUSB (57e91e9925976bbc98984eebaaf1d84c) C:\WINDOWS\system32\Drivers\btwusb.sys
10:47:02.0156 5432 BTWUSB - ok
10:47:02.0156 5432 catchme - ok
10:47:02.0203 5432 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
10:47:02.0203 5432 cbidf - ok
10:47:02.0203 5432 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:47:02.0203 5432 cbidf2k - ok
10:47:02.0250 5432 CCDECODE (fdc06e2ada8c468ebb161624e03976cf) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
10:47:02.0250 5432 CCDECODE - ok
10:47:02.0265 5432 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
10:47:02.0265 5432 cd20xrnt - ok
10:47:02.0281 5432 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:47:02.0281 5432 Cdaudio - ok
10:47:02.0312 5432 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
10:47:02.0328 5432 Cdfs - ok
10:47:02.0343 5432 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:47:02.0343 5432 Cdrom - ok
10:47:02.0359 5432 Changer - ok
10:47:02.0375 5432 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
10:47:02.0375 5432 CmBatt - ok
10:47:02.0406 5432 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
10:47:02.0406 5432 CmdIde - ok
10:47:02.0421 5432 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
10:47:02.0421 5432 Compbatt - ok
10:47:02.0437 5432 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
10:47:02.0437 5432 Cpqarray - ok
10:47:02.0468 5432 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
10:47:02.0468 5432 dac2w2k - ok
10:47:02.0500 5432 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
10:47:02.0500 5432 dac960nt - ok
10:47:02.0515 5432 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
10:47:02.0515 5432 Disk - ok
10:47:02.0593 5432 DLABOIOM (35cbc02546335ea41a5d516da6626c8a) C:\WINDOWS\system32\DLA\DLABOIOM.SYS
10:47:02.0593 5432 DLABOIOM - ok
10:47:02.0609 5432 DLACDBHM (ec6ae8bc9f773382d2eed49e4dfdae2a) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
10:47:02.0609 5432 DLACDBHM - ok
10:47:02.0640 5432 DLADResN (19e3db16de2bb3db81b172a78d140b03) C:\WINDOWS\system32\DLA\DLADResN.SYS
10:47:02.0640 5432 DLADResN - ok
10:47:02.0656 5432 DLAIFS_M (e4859ca5bd8412a9a60d62067a653522) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
10:47:02.0656 5432 DLAIFS_M - ok
10:47:02.0656 5432 DLAOPIOM (20c24a3d1cf0825487c93f806625805e) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
10:47:02.0656 5432 DLAOPIOM - ok
10:47:02.0671 5432 DLAPoolM (8a530da5dc81954bcf1966813f699b49) C:\WINDOWS\system32\DLA\DLAPoolM.SYS
10:47:02.0671 5432 DLAPoolM - ok
10:47:02.0687 5432 DLARTL_N (0605b66052f82b6f07204dbdb61c13ff) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
10:47:02.0687 5432 DLARTL_N - ok
10:47:02.0703 5432 DLAUDFAM (7eda68af6a91bf64af6f301e39928ebf) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
10:47:02.0703 5432 DLAUDFAM - ok
10:47:02.0703 5432 DLAUDF_M (a18423bbc6d92b01fdf3c51e7510ee70) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
10:47:02.0718 5432 DLAUDF_M - ok
10:47:02.0750 5432 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
10:47:02.0781 5432 dmboot - ok
10:47:02.0796 5432 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
10:47:02.0796 5432 dmio - ok
10:47:02.0812 5432 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:47:02.0812 5432 dmload - ok
10:47:02.0843 5432 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
10:47:02.0843 5432 DMusic - ok
10:47:02.0875 5432 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
10:47:02.0875 5432 dpti2o - ok
10:47:02.0890 5432 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
10:47:02.0890 5432 drmkaud - ok
10:47:02.0906 5432 DRVMCDB (48c7008d23dcfce0d0232f49307efced) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
10:47:02.0906 5432 DRVMCDB - ok
10:47:02.0921 5432 DRVNDDM (05467e44a42c777dd1534bb4539b16d1) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
10:47:02.0921 5432 DRVNDDM - ok
10:47:02.0984 5432 dtsoftbus01 (c0c7ceccb6c85994c2bc92d58e52d3f2) C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys
10:47:02.0984 5432 dtsoftbus01 - ok
10:47:03.0031 5432 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
10:47:03.0031 5432 E100B - ok
10:47:03.0078 5432 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
10:47:03.0078 5432 Fastfat - ok
10:47:03.0109 5432 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
10:47:03.0109 5432 Fdc - ok
10:47:03.0156 5432 FilterService (b73ec688c29f81f9da0fcf63682b3ecb) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
10:47:03.0156 5432 FilterService - ok
10:47:03.0187 5432 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
10:47:03.0187 5432 Fips - ok
10:47:03.0203 5432 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
10:47:03.0218 5432 Flpydisk - ok
10:47:03.0250 5432 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
10:47:03.0250 5432 FltMgr - ok
10:47:03.0281 5432 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:47:03.0296 5432 Fs_Rec - ok
10:47:03.0296 5432 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:47:03.0296 5432 Ftdisk - ok
10:47:03.0359 5432 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
10:47:03.0359 5432 GEARAspiWDM - ok
10:47:03.0375 5432 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:47:03.0375 5432 Gpc - ok
10:47:03.0406 5432 HdAudAddService (8dc8b34992131eb4b4c71b1a47fdd21c) C:\WINDOWS\system32\drivers\CHDAudN.sys
10:47:03.0421 5432 HdAudAddService - ok
10:47:03.0453 5432 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
10:47:03.0453 5432 HDAudBus - ok
10:47:03.0468 5432 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
10:47:03.0468 5432 HidUsb - ok
10:47:03.0500 5432 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
10:47:03.0500 5432 hpn - ok
10:47:03.0515 5432 HSFHWAZL (26d99cb5d30f79e4459d855af690decd) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
10:47:03.0531 5432 HSFHWAZL - ok
10:47:03.0578 5432 HSF_DPV (491b8f394e56ff31d6740f7a34540716) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
10:47:03.0609 5432 HSF_DPV - ok
10:47:03.0656 5432 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
10:47:03.0671 5432 HTTP - ok
10:47:03.0703 5432 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
10:47:03.0718 5432 i2omgmt - ok
10:47:03.0750 5432 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
10:47:03.0750 5432 i2omp - ok
10:47:03.0796 5432 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:47:03.0796 5432 i8042prt - ok
10:47:04.0015 5432 ialm (06b71441957b48a4866de2fe27cb79c8) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
10:47:04.0187 5432 ialm - ok
10:47:04.0250 5432 iaStor (fd7f9d74c2b35dbda400804a3f5ed5d8) C:\WINDOWS\system32\DRIVERS\iaStor.sys
10:47:04.0250 5432 iaStor - ok
10:47:04.0281 5432 IBMPMDRV (bf648877413f6160e480814a24942b65) C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
10:47:04.0281 5432 IBMPMDRV - ok
10:47:04.0312 5432 IBMTPCHK (083d095fed4b01fff9d501b98d50db68) C:\WINDOWS\system32\Drivers\IBMBLDID.sys
10:47:04.0312 5432 IBMTPCHK - ok
10:47:04.0328 5432 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:47:04.0328 5432 Imapi - ok
10:47:04.0359 5432 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
10:47:04.0359 5432 ini910u - ok
10:47:04.0390 5432 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:47:04.0390 5432 IntelIde - ok
10:47:04.0421 5432 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:47:04.0421 5432 intelppm - ok
10:47:04.0484 5432 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
10:47:04.0484 5432 Ip6Fw - ok
10:47:04.0500 5432 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:47:04.0500 5432 IpFilterDriver - ok
10:47:04.0531 5432 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:47:04.0531 5432 IpInIp - ok
10:47:04.0593 5432 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:47:04.0609 5432 IpNat - ok
10:47:04.0625 5432 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:47:04.0625 5432 IPSec - ok
10:47:04.0656 5432 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:47:04.0656 5432 IRENUM - ok
10:47:04.0703 5432 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:47:04.0703 5432 isapnp - ok
10:47:04.0750 5432 Iviaspi (f59c3569a2f2c464bb78cb1bdcdca55e) C:\WINDOWS\system32\drivers\iviaspi.sys
10:47:04.0750 5432 Iviaspi - ok
10:47:04.0781 5432 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:47:04.0781 5432 Kbdclass - ok
10:47:04.0781 5432 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
10:47:04.0796 5432 kbdhid - ok
10:47:04.0812 5432 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
10:47:04.0828 5432 kmixer - ok
10:47:04.0843 5432 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
10:47:04.0859 5432 KSecDD - ok
10:47:04.0890 5432 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
10:47:04.0890 5432 Lbd - ok
10:47:04.0890 5432 lbrtfdc - ok
10:47:04.0937 5432 LVRS (7521c0c58ee91be90b6cc33e792d10c7) C:\WINDOWS\system32\DRIVERS\lvrs.sys
10:47:04.0953 5432 LVRS - ok
10:47:05.0109 5432 LVUVC (37e57c48af530df01cdd4e8a2ad77b51) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
10:47:05.0250 5432 LVUVC - ok
10:47:05.0312 5432 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
10:47:05.0312 5432 mdmxsdk - ok
10:47:05.0359 5432 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:47:05.0359 5432 mnmdd - ok
10:47:05.0406 5432 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
10:47:05.0406 5432 Modem - ok
10:47:05.0437 5432 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:47:05.0437 5432 Mouclass - ok
10:47:05.0484 5432 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
10:47:05.0484 5432 mouhid - ok
10:47:05.0500 5432 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
10:47:05.0500 5432 MountMgr - ok
10:47:05.0546 5432 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
10:47:05.0546 5432 mraid35x - ok
10:47:05.0578 5432 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:47:05.0578 5432 MRxDAV - ok
10:47:05.0625 5432 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:47:05.0640 5432 MRxSmb - ok
10:47:05.0656 5432 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
10:47:05.0656 5432 Msfs - ok
10:47:05.0703 5432 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:47:05.0703 5432 MSKSSRV - ok
10:47:05.0718 5432 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:47:05.0718 5432 MSPCLOCK - ok
10:47:05.0734 5432 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
10:47:05.0734 5432 MSPQM - ok
10:47:05.0796 5432 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:47:05.0796 5432 mssmbios - ok
10:47:05.0921 5432 MSTEE (d5059366b361f0e1124753447af08aa2) C:\WINDOWS\system32\drivers\MSTEE.sys
10:47:05.0921 5432 MSTEE - ok
10:47:05.0968 5432 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
10:47:05.0968 5432 Mup - ok
10:47:06.0015 5432 NABTSFEC (ac31b352ce5e92704056d409834beb74) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
10:47:06.0015 5432 NABTSFEC - ok
10:47:06.0062 5432 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
10:47:06.0062 5432 NDIS - ok
10:47:06.0109 5432 NdisIP (abd7629cf2796250f315c1dd0b6cf7a0) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
10:47:06.0109 5432 NdisIP - ok
10:47:06.0140 5432 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:47:06.0140 5432 NdisTapi - ok
10:47:06.0156 5432 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:47:06.0234 5432 Ndisuio - ok
10:47:06.0265 5432 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:47:06.0281 5432 NdisWan - ok
10:47:06.0312 5432 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
10:47:06.0312 5432 NDProxy - ok
10:47:06.0343 5432 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:47:06.0343 5432 NetBIOS - ok
10:47:06.0359 5432 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:47:06.0375 5432 NetBT - ok
10:47:06.0484 5432 NETw4x32 (18b2d3e11ed7a3c898ade6a6692b6929) C:\WINDOWS\system32\DRIVERS\NETw4x32.sys
10:47:06.0546 5432 NETw4x32 - ok
10:47:06.0562 5432 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
10:47:06.0562 5432 NIC1394 - ok
10:47:06.0578 5432 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
10:47:06.0578 5432 Npfs - ok
10:47:06.0609 5432 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
10:47:06.0625 5432 Ntfs - ok
10:47:06.0687 5432 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:47:06.0687 5432 Null - ok
10:47:06.0750 5432 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
10:47:06.0796 5432 nv - ok
10:47:06.0828 5432 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:47:06.0828 5432 NwlnkFlt - ok
10:47:06.0859 5432 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:47:06.0859 5432 NwlnkFwd - ok
10:47:06.0875 5432 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
10:47:06.0875 5432 ohci1394 - ok
10:47:06.0906 5432 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
10:47:06.0921 5432 Parport - ok
10:47:06.0921 5432 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
10:47:06.0921 5432 PartMgr - ok
10:47:06.0984 5432 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
10:47:06.0984 5432 ParVdm - ok
10:47:06.0984 5432 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
10:47:07.0000 5432 PCI - ok
10:47:07.0000 5432 PCIDump - ok
10:47:07.0015 5432 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
10:47:07.0015 5432 PCIIde - ok
10:47:07.0031 5432 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
10:47:07.0031 5432 Pcmcia - ok
10:47:07.0031 5432 PDCOMP - ok
10:47:07.0046 5432 PDFRAME - ok
10:47:07.0062 5432 PDRELI - ok
10:47:07.0062 5432 PDRFRAME - ok
10:47:07.0078 5432 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
10:47:07.0093 5432 perc2 - ok
10:47:07.0109 5432 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
10:47:07.0109 5432 perc2hib - ok
10:47:07.0156 5432 pmem (dedef40e1d05842639491365cb2c069e) C:\WINDOWS\System32\drivers\pmemnt.sys
10:47:07.0156 5432 pmem - ok
10:47:07.0203 5432 Point32 (b4f59a953ef9e507f0d00c3a68580b8b) C:\WINDOWS\system32\DRIVERS\point32.sys
10:47:07.0203 5432 Point32 - ok
10:47:07.0234 5432 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:47:07.0234 5432 PptpMiniport - ok
10:47:07.0281 5432 PROCDD (1d80309fed4babf8ea9e7b84a394348b) C:\WINDOWS\system32\DRIVERS\PROCDD.SYS
10:47:07.0281 5432 PROCDD - ok
10:47:07.0312 5432 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
10:47:07.0312 5432 Processor - ok
10:47:07.0328 5432 psadd (aac08defb15aaab00b30341c716efa35) C:\WINDOWS\system32\DRIVERS\psadd.sys
10:47:07.0328 5432 psadd - ok
10:47:07.0343 5432 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:47:07.0343 5432 Ptilink - ok
10:47:07.0406 5432 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
10:47:07.0406 5432 PxHelp20 - ok
10:47:07.0437 5432 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
10:47:07.0437 5432 ql1080 - ok
10:47:07.0468 5432 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
10:47:07.0468 5432 Ql10wnt - ok
10:47:07.0484 5432 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
10:47:07.0484 5432 ql12160 - ok
10:47:07.0500 5432 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
10:47:07.0500 5432 ql1240 - ok
10:47:07.0515 5432 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
10:47:07.0515 5432 ql1280 - ok
10:47:07.0546 5432 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:47:07.0546 5432 RasAcd - ok
10:47:07.0609 5432 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:47:07.0609 5432 Rasl2tp - ok
10:47:07.0625 5432 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:47:07.0625 5432 RasPppoe - ok
10:47:07.0625 5432 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:47:07.0625 5432 Raspti - ok
10:47:07.0687 5432 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:47:07.0703 5432 Rdbss - ok
10:47:07.0718 5432 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:47:07.0718 5432 RDPCDD - ok
10:47:07.0734 5432 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:47:07.0734 5432 rdpdr - ok
10:47:07.0796 5432 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
10:47:07.0796 5432 RDPWD - ok
10:47:07.0828 5432 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:47:07.0828 5432 redbook - ok
10:47:07.0890 5432 rimmptsk (c35ca13d3627ebd9dd12a23ce781bc3d) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
10:47:07.0890 5432 rimmptsk - ok
10:47:07.0906 5432 rimsptsk - ok
10:47:07.0906 5432 rismxdp - ok
10:47:07.0984 5432 s24trans (2220783b32a9f91df87f3e8315f091e7) C:\WINDOWS\system32\DRIVERS\s24trans.sys
10:47:07.0984 5432 s24trans - ok
10:47:08.0046 5432 sdbus (d3dc16b8d62d508a5c69c22b4e9871d1) C:\WINDOWS\system32\DRIVERS\sdbus.sys
10:47:08.0046 5432 sdbus - ok
10:47:08.0062 5432 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:47:08.0078 5432 Secdrv - ok
10:47:08.0109 5432 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
10:47:08.0109 5432 serenum - ok
10:47:08.0140 5432 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
10:47:08.0140 5432 Serial - ok
10:47:08.0187 5432 sffdisk (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
10:47:08.0187 5432 sffdisk - ok
10:47:08.0218 5432 sffp_sd (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
10:47:08.0218 5432 sffp_sd - ok
10:47:08.0234 5432 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
10:47:08.0250 5432 Sfloppy - ok
10:47:08.0296 5432 Shockprf (a3aee791db8c73882f4503bfaacd8c9e) C:\WINDOWS\system32\DRIVERS\Apsx86.sys
10:47:08.0296 5432 Shockprf - ok
10:47:08.0296 5432 Simbad - ok
10:47:08.0328 5432 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
10:47:08.0328 5432 sisagp - ok
10:47:08.0359 5432 SLIP (1ffc44d6787ec1ea9a2b1440a90fa5c1) C:\WINDOWS\system32\DRIVERS\SLIP.sys
10:47:08.0359 5432 SLIP - ok
10:47:08.0390 5432 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
10:47:08.0406 5432 Sparrow - ok
10:47:08.0421 5432 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
10:47:08.0421 5432 splitter - ok
10:47:08.0421 5432 sptd - ok
10:47:08.0468 5432 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
10:47:08.0468 5432 sr - ok
10:47:08.0515 5432 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
10:47:08.0531 5432 Srv - ok
10:47:08.0562 5432 streamip (a9f9fd0212e572b84edb9eb661f6bc04) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
10:47:08.0562 5432 streamip - ok
10:47:08.0609 5432 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:47:08.0609 5432 swenum - ok
10:47:08.0625 5432 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
10:47:08.0625 5432 swmidi - ok
10:47:08.0671 5432 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
10:47:08.0671 5432 symc810 - ok
10:47:08.0687 5432 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
10:47:08.0687 5432 symc8xx - ok
10:47:08.0703 5432 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
10:47:08.0703 5432 sym_hi - ok
10:47:08.0734 5432 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
10:47:08.0734 5432 sym_u3 - ok
10:47:08.0765 5432 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
10:47:08.0765 5432 sysaudio - ok
10:47:08.0828 5432 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:47:08.0843 5432 Tcpip - ok
10:47:08.0875 5432 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:47:08.0875 5432 TDPIPE - ok
10:47:08.0906 5432 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
10:47:08.0906 5432 TDTCP - ok
10:47:08.0937 5432 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:47:08.0937 5432 TermDD - ok
10:47:08.0968 5432 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
10:47:08.0968 5432 TosIde - ok
10:47:09.0031 5432 TPDIGIMN (639ba7b37f25054cf5e82604e736d250) C:\WINDOWS\system32\DRIVERS\ApsHM86.sys
10:47:09.0031 5432 TPDIGIMN - ok
10:47:09.0078 5432 TPHKDRV (542770c8925e13b29b1ba63f05898058) C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys
10:47:09.0078 5432 TPHKDRV - ok
10:47:09.0125 5432 TPPWRIF (44672de6cea9569c21c4b7a8d2560750) C:\WINDOWS\system32\drivers\Tppwrif.sys
10:47:09.0140 5432 TPPWRIF - ok
10:47:09.0187 5432 TSMAPIP (f2aba3066d7921d7fcdbd66dea88be11) C:\WINDOWS\system32\drivers\TSMAPIP.SYS
10:47:09.0187 5432 TSMAPIP - ok
10:47:09.0218 5432 tvtfilter (49258a02a1e8d304ed88b0f1c56b1738) C:\WINDOWS\system32\DRIVERS\tvtfilter.sys
10:47:09.0218 5432 tvtfilter - ok
10:47:09.0234 5432 TVTI2C (8ab24d4b7da715c2c80455137910e792) C:\WINDOWS\system32\DRIVERS\Tvti2c.sys
10:47:09.0234 5432 TVTI2C - ok
10:47:09.0250 5432 TVTPktFilter - ok
10:47:09.0281 5432 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
10:47:09.0281 5432 Udfs - ok
10:47:09.0328 5432 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
10:47:09.0328 5432 ultra - ok
10:47:09.0359 5432 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
10:47:09.0375 5432 Update - ok
10:47:09.0421 5432 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys
10:47:09.0421 5432 USBAAPL - ok
10:47:09.0468 5432 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
10:47:09.0468 5432 usbaudio - ok
10:47:09.0515 5432 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:47:09.0515 5432 usbccgp - ok
10:47:09.0546 5432 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:47:09.0546 5432 usbehci - ok
10:47:09.0593 5432 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:47:09.0609 5432 usbhub - ok
10:47:09.0656 5432 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:47:09.0656 5432 usbprint - ok
10:47:09.0687 5432 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:47:09.0687 5432 USBSTOR - ok
10:47:09.0718 5432 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:47:09.0718 5432 usbuhci - ok
10:47:09.0750 5432 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
10:47:09.0765 5432 usbvideo - ok
10:47:09.0812 5432 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
10:47:09.0812 5432 VgaSave - ok
10:47:09.0843 5432 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
10:47:09.0843 5432 viaagp - ok
10:47:09.0859 5432 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
10:47:09.0859 5432 ViaIde - ok
10:47:09.0890 5432 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
10:47:09.0890 5432 VolSnap - ok
10:47:09.0953 5432 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys
10:47:10.0031 5432 vsdatant - ok
10:47:10.0093 5432 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:47:10.0093 5432 Wanarp - ok
10:47:10.0156 5432 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
10:47:10.0171 5432 Wdf01000 - ok
10:47:10.0171 5432 WDICA - ok
10:47:10.0203 5432 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
10:47:10.0203 5432 wdmaud - ok
10:47:10.0265 5432 winachsf (458b2e703b210683194158d639770588) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
10:47:10.0281 5432 winachsf - ok
10:47:10.0359 5432 WpdUsb (1385e5aa9c9821790d33a9563b8d2dd0) C:\WINDOWS\system32\Drivers\wpdusb.sys
10:47:10.0359 5432 WpdUsb - ok
10:47:10.0406 5432 WSTCODEC (233cdd1c06942115802eb7ce6669e099) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
10:47:10.0406 5432 WSTCODEC - ok
10:47:10.0437 5432 MBR (0x1B8) (6bee899d620ee4858afe54340fa75693) \Device\Harddisk0\DR0
10:47:10.0453 5432 \Device\Harddisk0\DR0 - ok
10:47:10.0453 5432 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR5
10:47:10.0453 5432 \Device\Harddisk1\DR5 - ok
10:47:10.0453 5432 Boot (0x1200) (702dec8c9d88f2d53e44b4e7ab10f3da) \Device\Harddisk0\DR0\Partition0
10:47:10.0453 5432 \Device\Harddisk0\DR0\Partition0 - ok
10:47:10.0453 5432 Boot (0x1200) (cd96fc112ed615a34144cffce7a144c9) \Device\Harddisk1\DR5\Partition0
10:47:10.0468 5432 \Device\Harddisk1\DR5\Partition0 - ok
10:47:10.0468 5432 ============================================================
10:47:10.0468 5432 Scan finished
10:47:10.0468 5432 ============================================================
10:47:10.0468 5208 Detected object count: 0
10:47:10.0468 5208 Actual detected object count: 0

Post #9
Hi reciprical,

Thanks for getting me those. :)

Re-run MBRCheck again.
When prompted, enter Y
Then enter 1 to dump the MBR to physical disk
Name the dumped file as Dump.dat

Enter -1 to exit

A log file named "dump.dat" will be located in the same folder as MBRCheck was saved, please zip it up and attach in your next reply.
Post #10
Hey Jeff,

How do I get the dump.dat file? The DOS looking window is open, and when I press 1 to "dump the MBR of a physical disc to file", I'm told to 'Enter the physical disc number to dump (0-99, -1 to exit)". The Log's below:

Is there a step that I'm missing here?

Thanks again!

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 163):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA4BC000 compbatt.sys
0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xB9F4A000 pcmcia.sys
0xBA0B8000 MountMgr.sys
0xB9F2B000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F05000 dmio.sys
0xBA330000 PartMgr.sys
0xBA4C4000 ACPIEC.sys
0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xBA0C8000 VolSnap.sys
0xB9EED000 atapi.sys
0xB9E2F000 iaStor.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9E0F000 fltmgr.sys
0xB9DFD000 sr.sys
0xBA0F8000 Lbd.sys
0xB9DE7000 DRVMCDB.SYS
0xBA108000 PxHelp20.sys
0xB9DD0000 KSecDD.sys
0xB9D43000 Ntfs.sys
0xB9D16000 NDIS.sys
0xB9CFA000 Apsx86.sys
0xBA338000 ApsHM86.sys
0xBA118000 ohci1394.sys
0xBA128000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xB9CE0000 Mup.sys
0xBA158000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBA1A8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB7CFE000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xB7CEA000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA428000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB7CC6000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA430000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB7C9E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB7A83000 \SystemRoot\system32\DRIVERS\NETw4x32.sys
0xB7A58000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xB7A44000 \SystemRoot\system32\DRIVERS\sdbus.sys
0xB7A33000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0xBA1B8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA440000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB7A09000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xB798E000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xBA448000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA450000 \SystemRoot\system32\DRIVERS\atmeltpm.sys
0xB923E000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xB923A000 \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
0xBA1D8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA458000 \SystemRoot\system32\drivers\iviaspi.sys
0xBA5F2000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xBA1E8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA1F8000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB796B000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA460000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xB789B000 \SystemRoot\system32\DRIVERS\btkrnl.sys
0xBA753000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA208000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB922E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB7884000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA218000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA228000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA468000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xBA470000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA478000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB7854000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA238000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA480000 \SystemRoot\system32\DRIVERS\psadd.sys
0xBA488000 \SystemRoot\system32\DRIVERS\Tvti2c.sys
0xBA5F4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB77F6000 \SystemRoot\system32\DRIVERS\update.sys
0xBA5A0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB77B9000 \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
0xB97E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA268000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA61C000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA172E000 \SystemRoot\system32\drivers\CHDAudN.sys
0xA170A000 \SystemRoot\system32\drivers\portcls.sys
0xBA168000 \SystemRoot\system32\drivers\drmk.sys
0xA16D6000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
0xA15E4000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
0xA1531000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xA4957000 \SystemRoot\System32\Drivers\Modem.SYS
0x9BD77000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xBA61A000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x9B1AA000 \SystemRoot\System32\Drivers\Null.SYS
0xBA61E000 \SystemRoot\System32\Drivers\Beep.SYS
0x9B3E9000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
0x9B3E1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x9B3D1000 \SystemRoot\System32\drivers\vga.sys
0xBA620000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA622000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x9AD09000 \SystemRoot\System32\Drivers\Msfs.SYS
0x9AD01000 \SystemRoot\System32\Drivers\Npfs.SYS
0x9B69A000 \SystemRoot\system32\DRIVERS\rasacd.sys
0x99FA2000 \SystemRoot\system32\DRIVERS\ipsec.sys
0x9AF5D000 \SystemRoot\system32\DRIVERS\msgpc.sys
0x99F49000 \SystemRoot\system32\DRIVERS\tcpip.sys
0x99F21000 \SystemRoot\system32\DRIVERS\netbt.sys
0x99EFB000 \SystemRoot\system32\DRIVERS\ipnat.sys
0x9AF4D000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x99E7A000 \SystemRoot\System32\vsdatant.sys
0x99E58000 \SystemRoot\System32\drivers\afd.sys
0x9AF3D000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9ACF9000 \SystemRoot\System32\drivers\TSMAPIP.SYS
0x9ACF1000 \SystemRoot\System32\drivers\Tppwrif.sys
0x9ACE9000 \SystemRoot\system32\DRIVERS\TPHKDRV.sys
0x99E0D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x99D9D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA628000 \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
0x9AF0D000 \SystemRoot\System32\Drivers\Fips.SYS
0x9B676000 \SystemRoot\System32\drivers\ANC.SYS
0x9A903000 \SystemRoot\System32\Drivers\btwusb.sys
0x9A8F3000 \SystemRoot\System32\Drivers\Cdfs.SYS
0x99CDF000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x9A8A3000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x9A560000 \SystemRoot\System32\drivers\Dxapi.sys
0x9ACC9000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0x9E84E000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04E000 \SystemRoot\System32\igxpdv32.DLL
0xBF1F2000 \SystemRoot\System32\igxpdx32.DLL
0xBF48D000 \SystemRoot\System32\ATMFD.DLL
0xB82DE000 \SystemRoot\system32\DRIVERS\tvtfilter.sys
0xB82CE000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
0x9A295000 \SystemRoot\System32\DLA\DLADResN.SYS
0x99CC9000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
0x9D258000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
0x9B26A000 \SystemRoot\System32\DLA\DLAPoolM.SYS
0xA1EAB000 \SystemRoot\System32\DLA\DLABOIOM.SYS
0x99CB1000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
0x99C9B000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
0xBA348000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xB5660000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB5654000 \SystemRoot\system32\DRIVERS\s24trans.sys
0x9A3F0000 \SystemRoot\system32\DRIVERS\PROCDD.SYS
0x99B6B000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xBA5D4000 \??\C:\WINDOWS\System32\drivers\pmemnt.sys
0x99A63000 \SystemRoot\system32\DRIVERS\secdrv.sys
0x9966E000 \SystemRoot\system32\drivers\wdmaud.sys
0x99823000 \SystemRoot\system32\drivers\sysaudio.sys
0x992BC000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x990B3000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x995CE000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x989BB000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xA281C000 \SystemRoot\system32\DRIVERS\point32.sys
0x97678000 \SystemRoot\system32\drivers\kmixer.sys
0xA2804000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 76):
0 System Idle Process
4 System
448 C:\WINDOWS\system32\smss.exe
648 csrss.exe
672 C:\WINDOWS\system32\winlogon.exe
716 C:\WINDOWS\system32\services.exe
728 C:\WINDOWS\system32\lsass.exe
964 C:\WINDOWS\system32\ibmpmsvc.exe
992 C:\WINDOWS\system32\svchost.exe
1040 svchost.exe
1108 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
1200 C:\WINDOWS\system32\svchost.exe
1332 C:\WINDOWS\system32\ZoneLabs\vsmon.exe
1860 C:\WINDOWS\explorer.exe
504 C:\WINDOWS\system32\spoolsv.exe
488 C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
564 C:\WINDOWS\system32\IPSSVC.EXE
572 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
600 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
628 C:\Program Files\Bonjour\mDNSResponder.exe
184 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
1128 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
1148 C:\Program Files\Java\jre6\bin\jqs.exe
1364 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
784 sqlbrowser.exe
1548 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
1580 C:\WINDOWS\system32\svchost.exe
1648 C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
1704 C:\WINDOWS\system32\TPHDEXLG.exe
1776 C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
2008 C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
2040 C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
2144 wdfmgr.exe
2168 C:\WINDOWS\system32\searchindexer.exe
2212 C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
3580 HP1006MC.EXE
2388 alg.exe
3104 C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
3536 C:\WINDOWS\system32\TpShocks.exe
3660 C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
3696 C:\WINDOWS\system32\rundll32.exe
1012 C:\WINDOWS\system32\igfxpers.exe
3712 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
3780 C:\WINDOWS\system32\igfxsrvc.exe
3816 C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
3812 C:\WINDOWS\system32\hkcmd.exe
3856 C:\PROGRA~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE
3652 C:\WINDOWS\system32\DLA\DLACTRLW.EXE
4016 C:\Program Files\Lenovo\ZOOM\TpScrex.exe
4084 C:\Program Files\Lenovo\AwayTask\AwaySch.EXE
3760 C:\Program Files\Apoint2K\Apoint.exe
2792 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
1740 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1748 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
2676 C:\Program Files\iTunes\iTunesHelper.exe
2744 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
2948 C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
3068 C:\Program Files\Apoint2K\ApMsgFwd.exe
3320 C:\Documents and Settings\Kevin\Application Data\Dropbox\bin\Dropbox.exe
3352 C:\Program Files\Apoint2K\ApntEx.exe
3800 C:\Program Files\iPod\bin\iPodService.exe
1904 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
3096 C:\Program Files\Windows Live\Contacts\wlcomm.exe
2936 C:\Program Files\iTunes\iTunes.exe
1892 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
3176 C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
2000 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
3272 C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
2980 C:\Program Files\Mozilla Firefox\firefox.exe
1340 C:\Program Files\Mozilla Firefox\plugin-container.exe
5788 C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
5948 C:\Documents and Settings\Kevin\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
4444 C:\WINDOWS\system32\wuauclt.exe
2152 C:\WINDOWS\system32\searchprotocolhost.exe
2420 searchfilterhost.exe
4596 C:\Documents and Settings\Kevin\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\F: –> \\.\PhysicalDrive1 at offset 0x00000000`007e0000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-08UST0, Rev: 02.01A02
PhysicalDrive1 Model Number: HitachiHTS542525K9SA00, Rev:

Size Device Name MBR Status
——————————————–
232 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 89B412FA1E8D713152B0097AA30842FEDAD43BE0
232 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): -1

Done!

Post #11
Hi reciprical,

Sorry about that…

Re-run MBRCheck again.
When prompted, enter Y
Then enter 1 to dump the MBR to physical disk
Enter the physical disk number to fix (0-99, -1 to cancel): 0
Name the dumped file as Dump.dat

Enter -1 to exit

A log file named "dump.dat" will be located in the same folder as MBRCheck was saved, please zip it up and attach in your next reply.
Post #13
Hi reciprical,

:thumbup: Good job.
————

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
———-
Post #15
Hi reciprical,

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

If you would like to format and reinstall your Operating System please let me know and I can assist you with that.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help. :)
———-

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    KillAll::

DDS::
mStart Page = hxxp://startsear.ch/?aff=1
BHO: IE5BarLauncherBHO Class: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - c:\program files\vshare.tv plugin\BarLcher.dll
BHO: SearchCore for Browsers: {be7a24f5-69cb-4708-b77b-b1eda6043b95} - c:\progra~1\search~1\search~1\BROWSE~1.DLL
TB: VShareToolBar: {7ac3e13b-3bca-4158-b330-f66dbb03c1b5} - c:\program files\vshare.tv plugin\BarLcher.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [volmgr] c:\documents and settings\kevin\application data\volmgr.exe
mRun: [Microsoft Winrar Updater] Winrar32.exe
mRun: [volmgr] c:\documents and settings\kevin\application data\volmgr.exe

File::
c:\documents and settings\kevin\application data\volmgr.exe
c:\documents and settings\kevin\application data\volmgr.dll
c:\program files\vShare.tv plugin

Folder::
c:\program files\SearchCore for Browsers

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4ecbdbfe-ab94-443c-a0c1-aafe15e74438}]

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|	–Ôw*]

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"=-

[-HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[-HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[-HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[-HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"=-

[-HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[-HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[-HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[-HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI