Google Redirect / Ping.exe / High CPU Usage [Solved]

A few days ago I started getting occasional messages from my AV program, which is webroot, that something called alg10.job, alg3.job, alg7.job,etc. is trying to access the internet, and that the AV blocked it. When I call up my task manager, I see that ping.exe is opening every few seconds, even when I end the task, and is consuming about 200,000 kb of memory, which it has never done before. I updated and ran malware bytes, but while it found three things, it didn't fix this particular problem. In addition, all my google searches now redirect to 'threatening sites',' not sure if this is connected or not. I see several other topics related to this, but I figured it would be best to get some specific help so I don't screw anything up. Below is the contents of my DDS.txt. Thanks in advance for your help and time. ————– . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] on Tue 11/29/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.553 [GMT -5:00] . AV: Webroot Internet Security Essentials *Enabled/Updated* {77E10C7F-2CCA-4187-9394-BDBC267AD597} FW: Webroot Internet Security Essentials *Enabled* . ============== Running Processes =============== . C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\Explorer.EXE svchost.exe svchost.exe svchost.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe C:\Program Files\Stardock\SmartException\smartex.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox1.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\System32\ping.exe C:\Documents and Settings\\Desktop\dds.scr . ============== Pseudo HJT Report =============== . uSearch Bar = hxxp://home.peoplepc.com/search uStart Page = hxxp://www.altavista.com/ uInternet Connection Wizard,ShellNext = iexplore uURLSearchHooks: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\dvdvideosofttb\prxtbDVD0.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.2.8.7.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\dvdvideosofttb\prxtbDVD0.dll BHO: WebrootBHO Class: {d93ec24d-8741-4d41-b83d-a5793b998416} - c:\program files\webroot\security\current\plugins\browserextension\WebrootBHO.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Webroot Browser Helper Object: {e08861fe-8847-4b2a-8ec2-08edb20e4020} - c:\program files\webroot\security\install\products\wise\toolbar\LPBar.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\dvdvideosofttb\prxtbDVD0.dll TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll TB: Webroot Toolbar: {d84a64a0-f2b2-4975-b264-3a3bce8d57d6} - c:\program files\webroot\security\install\products\wise\toolbar\LPBar.dll TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: PeoplePal Toolbar: {a8fb8eb3-183b-4598-924d-86f0e5e37085} - c:\program files\peoplepc\toolbar\PPCToolbar.dll uRun: [SmartException] "c:\program files\stardock\smartexception\smartex.exe" uRun: [Google Update] "c:\documents and settings\\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [ctfmon.exe] "c:\windows\system32\ctfmon.exe" uRun: [Akamai NetSession Interface] "c:\documents and settings\\local settings\application data\akamai\netsession_win.exe" mRun: [SoundMAXPnP] "c:\program files\analog devices\core\smax4pnp.exe" mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe" mRun: [IntelMeM] "c:\program files\intel\modem event monitor\IntelMEM.exe" mRun: [ISUSPM Startup] "c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe" -startup mRun: [DMXLauncher] "c:\program files\dell\media experience\DMXLauncher.exe" mRun: [dla] "c:\windows\system32\dla\tfswctrl.exe" mRun: [IPHSend] "c:\program files\common files\aol\iphsend\IPHSend.exe" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [ShStatEXE] "c:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [KernelFaultCheck] "%systemroot%\system32\dumprep" 0 -k mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [WebrootTrayApp] "c:\program files\webroot\security\current\framework\WRTray.exe" mRun: [UserFaultCheck] "%systemroot%\system32\dumprep" 0 -u dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm IE: Free YouTube Download - c:\documents and settings\c\application data\dvdvideosoftiehelpers\youtubedownload.htm IE: Free YouTube to Mp3 Converter - c:\documents and settings\\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.2.8.7.dll/206 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll LSP: mswsock.dll Trusted Zone: internet Trusted Zone: mcafee.com DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125974962375 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} - hxxp://www.link-systems.com/sdkhtml/SDK/paste/lsiw2k.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - hxxp://fdl.msn.com/zone/datafiles/heartbeat.cab TCP: {9C0C9BA6-1D51-4645-B58A-5D5D2448678C} = 192.168.1.254 Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SSODL: noganenob - {f964269e-2024-485d-bee2-90ee5b80ee41} - c:\windows\system32\zelokore.dll SSODL: kesiheluy - {1f770441-af4b-40fb-afb8-d72431a25469} - c:\windows\system32\ligamosa.dll SSODL: sigonopir - {61725354-71ef-48f1-9e56-0196bf4fa267} - c:\windows\system32\vofehafi.dll STS: jugezatag: {f964269e-2024-485d-bee2-90ee5b80ee41} - c:\windows\system32\zelokore.dll STS: mujuzedij: {1f770441-af4b-40fb-afb8-d72431a25469} - c:\windows\system32\ligamosa.dll STS: gahurihor: {61725354-71ef-48f1-9e56-0196bf4fa267} - c:\windows\system32\vofehafi.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll LSA: Notification Packages = scecli hogumana.dll WMFMPRXY.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\chrisr~1\applic~1\mozilla\firefox\profiles\i8main9u.default\ FF - component: c:\program files\mozilla firefox\components\qfaservices.dll FF - plugin: c:\documents and settings\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\3.0.40624.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npagent.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll . ============= SERVICES / DRIVERS =============== . R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2007-4-8 58464] R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [2011-8-30 122696] R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2007-4-8 98304] R2 McShield;Network Associates McShield;c:\program files\network associates\virusscan\Mcshield.exe [2006-2-14 221191] R2 McTaskManager;Network Associates Task Manager;c:\program files\network associates\virusscan\VsTskMgr.exe [2006-6-8 29184] R2 SSFMONM;ssfmonm;c:\windows\system32\drivers\ssfmonm.sys [2011-8-30 45584] R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\security\current\framework\WRConsumerService.exe [2011-9-13 3381184] R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2007-4-8 116864] R3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?] R3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?] S2 timidity;FireDaemon Service: Timidity++;c:\program files\firedaemon\firedaemon.exe -s –> c:\program files\firedaemon\FireDaemon.exe -s [?] S2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\security\current\plugins\antimalware\AEI.exe [2011-8-30 3997912] S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?] S4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664] S4 SCManager;SafeConnect Manager;c:\program files\safeconnect\scmanager.sys servicestart –> c:\program files\safeconnect\scManager.sys servicestart [?] . =============== Created Last 30 ================ . 2011-11-27 06:47:52 ——– d—–w- c:\documents and settings\.gegl-0.0 2011-11-03 02:19:17 ——– d—–w- c:\docume~1\chrisr~1\locals~1\applic~1\Akamai . ==================== Find3M ==================== . 2011-10-03 04:18:03 99965 —-a-w- c:\windows\UninstallFirefox.exe 2011-09-14 02:11:55 6278328 —-a-w- c:\program files\common files\wruninstall.exe . ============= FINISH: 1:20:30.32 ===============

Hi,

Please run the following:

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

NEXT


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Ok, thanks for getting back to me, here are the two TDSS logs:

——————————–

22:07:36.0031 4528 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44
22:07:38.0031 4528 ============================================================
22:07:38.0031 4528 Current date / time: 2011/11/30 22:07:38.0031
22:07:38.0031 4528 SystemInfo:
22:07:38.0031 4528
22:07:38.0031 4528 OS Version: 5.1.2600 ServicePack: 2.0
22:07:38.0031 4528 Product type: Workstation
22:07:38.0031 4528 ComputerName: D6XXK981
22:07:38.0031 4528 UserName:
22:07:38.0031 4528 Windows directory: C:\WINDOWS
22:07:38.0031 4528 System windows directory: C:\WINDOWS
22:07:38.0031 4528 Processor architecture: Intel x86
22:07:38.0031 4528 Number of processors: 1
22:07:38.0031 4528 Page size: 0x1000
22:07:38.0031 4528 Boot type: Normal boot
22:07:38.0031 4528 ============================================================
22:07:41.0156 4528 Initialize success
22:08:06.0171 4488 Deinitialize success

—————————

22:08:13.0781 5140 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44
22:08:15.0781 5140 ============================================================
22:08:15.0781 5140 Current date / time: 2011/11/30 22:08:15.0781
22:08:15.0781 5140 SystemInfo:
22:08:15.0781 5140
22:08:15.0781 5140 OS Version: 5.1.2600 ServicePack: 2.0
22:08:15.0781 5140 Product type: Workstation
22:08:15.0781 5140 ComputerName: D6XXK981
22:08:15.0781 5140 UserName:
22:08:15.0781 5140 Windows directory: C:\WINDOWS
22:08:15.0781 5140 System windows directory: C:\WINDOWS
22:08:15.0781 5140 Processor architecture: Intel x86
22:08:15.0781 5140 Number of processors: 1
22:08:15.0781 5140 Page size: 0x1000
22:08:15.0781 5140 Boot type: Normal boot
22:08:15.0781 5140 ============================================================
22:08:21.0343 5140 Initialize success
22:08:23.0484 5320 ============================================================
22:08:23.0484 5320 Scan started
22:08:23.0484 5320 Mode: Manual;
22:08:23.0484 5320 ============================================================
22:08:26.0031 5320 Abiosdsk - ok
22:08:26.0671 5320 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
22:08:26.0734 5320 abp480n5 - ok
22:08:26.0953 5320 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:08:26.0953 5320 ACPI - ok
22:08:27.0171 5320 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
22:08:27.0171 5320 ACPIEC - ok
22:08:27.0359 5320 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
22:08:27.0375 5320 adpu160m - ok
22:08:27.0578 5320 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
22:08:27.0578 5320 aec - ok
22:08:27.0796 5320 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
22:08:27.0812 5320 AFD - ok
22:08:28.0031 5320 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
22:08:28.0031 5320 agp440 - ok
22:08:28.0265 5320 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
22:08:28.0265 5320 agpCPQ - ok
22:08:28.0500 5320 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
22:08:28.0562 5320 Aha154x - ok
22:08:28.0937 5320 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
22:08:28.0953 5320 aic78u2 - ok
22:08:29.0171 5320 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
22:08:29.0171 5320 aic78xx - ok
22:08:29.0359 5320 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
22:08:29.0375 5320 AliIde - ok
22:08:29.0531 5320 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
22:08:29.0546 5320 alim1541 - ok
22:08:29.0703 5320 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
22:08:29.0703 5320 amdagp - ok
22:08:29.0859 5320 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
22:08:29.0875 5320 amsint - ok
22:08:30.0093 5320 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
22:08:30.0109 5320 asc - ok
22:08:30.0328 5320 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
22:08:30.0343 5320 asc3350p - ok
22:08:30.0562 5320 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
22:08:30.0578 5320 asc3550 - ok
22:08:30.0812 5320 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:08:30.0828 5320 AsyncMac - ok
22:08:31.0078 5320 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
22:08:31.0078 5320 atapi - ok
22:08:31.0250 5320 Atdisk - ok
22:08:31.0421 5320 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:08:31.0421 5320 Atmarpc - ok
22:08:31.0718 5320 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
22:08:31.0718 5320 audstub - ok
22:08:31.0890 5320 bcm4sbxp (b60f57b4d9cdbc663cc03eb8af7ec34e) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
22:08:31.0890 5320 bcm4sbxp - ok
22:08:32.0062 5320 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
22:08:32.0062 5320 Beep - ok
22:08:32.0250 5320 bvrp_pci - ok
22:08:32.0453 5320 catchme - ok
22:08:32.0609 5320 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
22:08:32.0625 5320 cbidf - ok
22:08:32.0781 5320 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
22:08:32.0781 5320 cbidf2k - ok
22:08:33.0000 5320 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
22:08:33.0000 5320 cd20xrnt - ok
22:08:33.0234 5320 CdaC15BA (c4dfe77bd5977335d54aedd21cd9e6a9) C:\WINDOWS\system32\drivers\CDAC15BA.SYS
22:08:33.0312 5320 CdaC15BA - ok
22:08:33.0453 5320 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
22:08:33.0468 5320 Cdaudio - ok
22:08:33.0625 5320 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
22:08:33.0625 5320 Cdfs - ok
22:08:33.0859 5320 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:08:33.0859 5320 Cdrom - ok
22:08:34.0015 5320 Changer - ok
22:08:34.0281 5320 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
22:08:34.0296 5320 CmdIde - ok
22:08:34.0640 5320 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
22:08:34.0656 5320 Cpqarray - ok
22:08:34.0890 5320 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
22:08:34.0890 5320 dac2w2k - ok
22:08:35.0125 5320 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
22:08:35.0125 5320 dac960nt - ok
22:08:35.0390 5320 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
22:08:35.0390 5320 Disk - ok
22:08:35.0640 5320 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
22:08:35.0656 5320 dmboot - ok
22:08:35.0828 5320 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
22:08:35.0843 5320 dmio - ok
22:08:35.0968 5320 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
22:08:35.0968 5320 dmload - ok
22:08:36.0203 5320 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
22:08:36.0203 5320 DMusic - ok
22:08:36.0453 5320 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
22:08:36.0453 5320 dpti2o - ok
22:08:36.0687 5320 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
22:08:36.0687 5320 drmkaud - ok
22:08:36.0906 5320 drvmcdb (96bc8f872f0270c10edc3931f1c03776) C:\WINDOWS\system32\drivers\drvmcdb.sys
22:08:36.0921 5320 drvmcdb - ok
22:08:37.0140 5320 drvnddm (5afbec7a6ac61b211633dfdb1d9e0c89) C:\WINDOWS\system32\drivers\drvnddm.sys
22:08:37.0140 5320 drvnddm - ok
22:08:37.0359 5320 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
22:08:37.0359 5320 E100B - ok
22:08:37.0546 5320 EntDrv51 (4fc527253a40486e39046e2b7b75a8ca) C:\WINDOWS\system32\drivers\EntDrv51.sys
22:08:37.0609 5320 EntDrv51 - ok
22:08:37.0828 5320 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
22:08:37.0843 5320 Fastfat - ok
22:08:38.0078 5320 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
22:08:38.0078 5320 Fdc - ok
22:08:38.0296 5320 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
22:08:38.0312 5320 Fips - ok
22:08:38.0546 5320 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
22:08:38.0546 5320 Flpydisk - ok
22:08:38.0765 5320 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
22:08:38.0765 5320 FltMgr - ok
22:08:38.0937 5320 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:08:38.0953 5320 Fs_Rec - ok
22:08:39.0171 5320 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:08:39.0171 5320 Ftdisk - ok
22:08:39.0296 5320 giveio (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys
22:08:39.0312 5320 giveio - ok
22:08:39.0531 5320 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:08:39.0546 5320 Gpc - ok
22:08:39.0765 5320 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:08:39.0781 5320 HidUsb - ok
22:08:39.0984 5320 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
22:08:40.0000 5320 hpn - ok
22:08:40.0187 5320 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
22:08:40.0203 5320 HTTP - ok
22:08:40.0406 5320 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
22:08:40.0406 5320 i2omgmt - ok
22:08:40.0625 5320 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
22:08:40.0625 5320 i2omp - ok
22:08:40.0828 5320 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:08:40.0828 5320 i8042prt - ok
22:08:41.0062 5320 ialm (44b7d5a4f2bd9fe21aea0bb0bace38c4) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
22:08:41.0078 5320 ialm - ok
22:08:41.0312 5320 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
22:08:41.0328 5320 Imapi - ok
22:08:41.0515 5320 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
22:08:41.0515 5320 ini910u - ok
22:08:41.0765 5320 IntelC51 (7509c548400f4c9e0211e3f6e66abbe6) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
22:08:41.0781 5320 IntelC51 - ok
22:08:42.0031 5320 IntelC52 (9584ffdd41d37f2c239681d0dac2513e) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
22:08:42.0046 5320 IntelC52 - ok
22:08:42.0281 5320 IntelC53 (cf0b937710cec6ef39416edecd803cbb) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
22:08:42.0281 5320 IntelC53 - ok
22:08:42.0515 5320 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
22:08:42.0515 5320 IntelIde - ok
22:08:42.0734 5320 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
22:08:42.0734 5320 intelppm - ok
22:08:42.0953 5320 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
22:08:42.0953 5320 Ip6Fw - ok
22:08:43.0171 5320 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:08:43.0187 5320 IpFilterDriver - ok
22:08:43.0406 5320 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:08:43.0406 5320 IpInIp - ok
22:08:43.0625 5320 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:08:43.0640 5320 IpNat - ok
22:08:43.0843 5320 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:08:43.0843 5320 IPSec - ok
22:08:44.0062 5320 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
22:08:44.0062 5320 IRENUM - ok
22:08:44.0296 5320 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:08:44.0296 5320 isapnp - ok
22:08:44.0546 5320 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:08:44.0562 5320 Kbdclass - ok
22:08:44.0750 5320 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
22:08:44.0750 5320 kbdhid - ok
22:08:44.0968 5320 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
22:08:44.0984 5320 kmixer - ok
22:08:45.0171 5320 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
22:08:45.0187 5320 KSecDD - ok
22:08:45.0359 5320 lbrtfdc - ok
22:08:45.0687 5320 MBAMSwissArmy - ok
22:08:45.0984 5320 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
22:08:45.0984 5320 mnmdd - ok
22:08:46.0109 5320 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
22:08:46.0109 5320 Modem - ok
22:08:46.0203 5320 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
22:08:46.0203 5320 MODEMCSA - ok
22:08:46.0328 5320 mohfilt (59b8b11ff70728eec60e72131c58b716) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
22:08:46.0328 5320 mohfilt - ok
22:08:46.0515 5320 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:08:46.0515 5320 Mouclass - ok
22:08:46.0734 5320 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:08:46.0734 5320 mouhid - ok
22:08:46.0953 5320 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
22:08:46.0953 5320 MountMgr - ok
22:08:47.0171 5320 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
22:08:47.0171 5320 mraid35x - ok
22:08:47.0390 5320 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:08:47.0390 5320 MRxDAV - ok
22:08:47.0609 5320 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:08:47.0625 5320 MRxSmb - ok
22:08:47.0859 5320 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
22:08:47.0875 5320 Msfs - ok
22:08:48.0093 5320 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:08:48.0093 5320 MSKSSRV - ok
22:08:48.0312 5320 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:08:48.0312 5320 MSPCLOCK - ok
22:08:48.0703 5320 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
22:08:48.0718 5320 MSPQM - ok
22:08:48.0828 5320 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:08:48.0828 5320 mssmbios - ok
22:08:48.0953 5320 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
22:08:48.0953 5320 Mup - ok
22:08:49.0062 5320 NaiAvFilter1 (88623f3fc726368a5996e319b89c693d) C:\WINDOWS\system32\drivers\naiavf5x.sys
22:08:49.0078 5320 NaiAvFilter1 - ok
22:08:49.0171 5320 NaiAvTdi1 (dc2440edac9a177f3057ca4db6c8069c) C:\WINDOWS\system32\drivers\mvstdi5x.sys
22:08:49.0187 5320 NaiAvTdi1 - ok
22:08:49.0296 5320 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
22:08:49.0312 5320 NDIS - ok
22:08:49.0421 5320 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
22:08:49.0421 5320 NdisTapi - ok
22:08:49.0531 5320 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
22:08:49.0531 5320 Ndisuio - ok
22:08:49.0640 5320 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
22:08:49.0656 5320 NdisWan - ok
22:08:49.0718 5320 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
22:08:49.0718 5320 NDProxy - ok
22:08:49.0828 5320 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
22:08:49.0828 5320 NetBIOS - ok
22:08:49.0937 5320 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
22:08:49.0937 5320 NetBT - ok
22:08:50.0093 5320 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
22:08:50.0109 5320 Npfs - ok
22:08:50.0234 5320 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
22:08:50.0296 5320 Ntfs - ok
22:08:50.0437 5320 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
22:08:50.0437 5320 Null - ok
22:08:50.0578 5320 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
22:08:50.0609 5320 nv - ok
22:08:50.0687 5320 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
22:08:50.0687 5320 NwlnkFlt - ok
22:08:50.0750 5320 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
22:08:50.0750 5320 NwlnkFwd - ok
22:08:50.0859 5320 omci (53d5f1278d9edb21689bbbcecc09108d) C:\WINDOWS\system32\DRIVERS\omci.sys
22:08:50.0859 5320 omci - ok
22:08:50.0921 5320 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
22:08:50.0921 5320 Parport - ok
22:08:51.0000 5320 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
22:08:51.0000 5320 PartMgr - ok
22:08:51.0078 5320 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
22:08:51.0078 5320 ParVdm - ok
22:08:51.0203 5320 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
22:08:51.0218 5320 PCI - ok
22:08:51.0281 5320 PCIDump - ok
22:08:51.0500 5320 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
22:08:51.0500 5320 PCIIde - ok
22:08:51.0640 5320 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
22:08:51.0640 5320 Pcmcia - ok
22:08:51.0718 5320 PDCOMP - ok
22:08:51.0765 5320 PDFRAME - ok
22:08:51.0812 5320 PDRELI - ok
22:08:51.0875 5320 PDRFRAME - ok
22:08:51.0953 5320 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
22:08:51.0953 5320 perc2 - ok
22:08:52.0156 5320 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
22:08:52.0171 5320 perc2hib - ok
22:08:52.0421 5320 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
22:08:52.0421 5320 PptpMiniport - ok
22:08:52.0656 5320 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
22:08:52.0656 5320 PSched - ok
22:08:52.0843 5320 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:08:52.0859 5320 Ptilink - ok
22:08:53.0062 5320 pwipf6 (6125ff06c1c625fe41c1152b2db5e7ff) C:\WINDOWS\system32\drivers\pwipf6.sys
22:08:53.0078 5320 pwipf6 - ok
22:08:53.0312 5320 PxHelp20 (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
22:08:53.0328 5320 PxHelp20 - ok
22:08:53.0531 5320 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
22:08:53.0546 5320 ql1080 - ok
22:08:54.0000 5320 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
22:08:54.0000 5320 Ql10wnt - ok
22:08:54.0187 5320 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
22:08:54.0187 5320 ql12160 - ok
22:08:54.0406 5320 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
22:08:54.0406 5320 ql1240 - ok
22:08:54.0750 5320 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
22:08:54.0750 5320 ql1280 - ok
22:08:54.0953 5320 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
22:08:54.0953 5320 RasAcd - ok
22:08:55.0187 5320 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
22:08:55.0187 5320 Rasl2tp - ok
22:08:55.0421 5320 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
22:08:55.0421 5320 RasPppoe - ok
22:08:55.0578 5320 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
22:08:55.0593 5320 Raspti - ok
22:08:55.0796 5320 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
22:08:55.0812 5320 Rdbss - ok
22:08:56.0015 5320 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:08:56.0031 5320 RDPCDD - ok
22:08:56.0265 5320 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
22:08:56.0281 5320 rdpdr - ok
22:08:56.0515 5320 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
22:08:56.0531 5320 RDPWD - ok
22:08:56.0765 5320 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
22:08:56.0765 5320 redbook - ok
22:08:57.0015 5320 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:08:57.0031 5320 Secdrv - ok
22:08:57.0218 5320 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
22:08:57.0234 5320 senfilt - ok
22:08:57.0484 5320 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
22:08:57.0484 5320 serenum - ok
22:08:57.0718 5320 Serial (7deafa5a019108d8c505483095898efd) C:\WINDOWS\system32\DRIVERS\serial.sys
22:08:57.0718 5320 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\serial.sys. Real md5: 7deafa5a019108d8c505483095898efd, Fake md5: cd9404d115a00d249f70a371b46d5a26
22:08:57.0718 5320 Serial ( Rootkit.Win32.ZAccess.k ) - infected
22:08:57.0718 5320 Serial - detected Rootkit.Win32.ZAccess.k (0)
22:08:57.0968 5320 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
22:08:57.0968 5320 Sfloppy - ok
22:08:58.0156 5320 Simbad - ok
22:08:58.0312 5320 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
22:08:58.0312 5320 sisagp - ok
22:08:58.0531 5320 smwdm (c6d9959e493682f872a639b6ec1b4a08) C:\WINDOWS\system32\drivers\smwdm.sys
22:08:58.0546 5320 smwdm - ok
22:08:58.0750 5320 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
22:08:58.0765 5320 Sparrow - ok
22:08:58.0890 5320 speedfan (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys
22:08:58.0890 5320 speedfan - ok
22:08:59.0109 5320 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
22:08:59.0109 5320 splitter - ok
22:08:59.0390 5320 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys
22:08:59.0390 5320 sptd - ok
22:08:59.0625 5320 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
22:08:59.0625 5320 sr - ok
22:08:59.0859 5320 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
22:08:59.0859 5320 Srv - ok
22:09:00.0078 5320 sscdbhk5 (98625722ad52b40305e74aaa83c93086) C:\WINDOWS\system32\drivers\sscdbhk5.sys
22:09:00.0078 5320 sscdbhk5 - ok
22:09:00.0296 5320 SSFMONM (fd5319e0cd62a10527dc8b5297bef7ff) C:\WINDOWS\system32\Drivers\SSFMONM.SYS
22:09:00.0296 5320 SSFMONM - ok
22:09:00.0500 5320 SSHRMD (51a68e41c77bf7ebeb0521027245b5f3) C:\WINDOWS\system32\Drivers\SSHRMD.SYS
22:09:00.0515 5320 SSHRMD - ok
22:09:00.0718 5320 SSIDRV (4b5a595dcce2eddd97b82532096c271e) C:\WINDOWS\system32\Drivers\SSIDRV.SYS
22:09:00.0718 5320 SSIDRV - ok
22:09:00.0937 5320 ssrtln (d79412e3942c8a257253487536d5a994) C:\WINDOWS\system32\drivers\ssrtln.sys
22:09:00.0937 5320 ssrtln - ok
22:09:01.0437 5320 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
22:09:01.0437 5320 swenum - ok
22:09:01.0906 5320 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
22:09:01.0921 5320 swmidi - ok
22:09:02.0140 5320 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
22:09:02.0140 5320 symc810 - ok
22:09:02.0343 5320 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
22:09:02.0343 5320 symc8xx - ok
22:09:02.0562 5320 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
22:09:02.0562 5320 sym_hi - ok
22:09:02.0750 5320 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
22:09:02.0765 5320 sym_u3 - ok
22:09:02.0953 5320 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
22:09:02.0953 5320 sysaudio - ok
22:09:03.0187 5320 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
22:09:03.0203 5320 Tcpip - ok
22:09:03.0406 5320 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
22:09:03.0406 5320 TDPIPE - ok
22:09:03.0609 5320 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
22:09:03.0625 5320 TDTCP - ok
22:09:03.0828 5320 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
22:09:03.0828 5320 TermDD - ok
22:09:04.0031 5320 tfsnboio (d0177776e11b0b3f272eebd262a69661) C:\WINDOWS\system32\dla\tfsnboio.sys
22:09:04.0031 5320 tfsnboio - ok
22:09:04.0250 5320 tfsncofs (599804bc938b8305a5422319774da871) C:\WINDOWS\system32\dla\tfsncofs.sys
22:09:04.0250 5320 tfsncofs - ok
22:09:04.0453 5320 tfsndrct (a1902c00adc11c4d83f8e3ed947a6a32) C:\WINDOWS\system32\dla\tfsndrct.sys
22:09:04.0453 5320 tfsndrct - ok
22:09:04.0656 5320 tfsndres (d8ddb3f2b1bef15cff6728d89c042c61) C:\WINDOWS\system32\dla\tfsndres.sys
22:09:04.0656 5320 tfsndres - ok
22:09:04.0859 5320 tfsnifs (c4f2dea75300971cdaee311007de138d) C:\WINDOWS\system32\dla\tfsnifs.sys
22:09:04.0875 5320 tfsnifs - ok
22:09:05.0062 5320 tfsnopio (272925be0ea919f08286d2ee6f102b0f) C:\WINDOWS\system32\dla\tfsnopio.sys
22:09:05.0062 5320 tfsnopio - ok
22:09:05.0281 5320 tfsnpool (7b7d955e5cebc2fb88b03ef875d52a2f) C:\WINDOWS\system32\dla\tfsnpool.sys
22:09:05.0296 5320 tfsnpool - ok
22:09:05.0500 5320 tfsnudf (e3d01263109d800c1967c12c10a0b018) C:\WINDOWS\system32\dla\tfsnudf.sys
22:09:05.0515 5320 tfsnudf - ok
22:09:05.0734 5320 tfsnudfa (b9e9c377906e3a65bc74598fff7f7458) C:\WINDOWS\system32\dla\tfsnudfa.sys
22:09:05.0734 5320 tfsnudfa - ok
22:09:06.0093 5320 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
22:09:06.0187 5320 TosIde - ok
22:09:06.0406 5320 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
22:09:06.0468 5320 TVICHW32 - ok
22:09:06.0640 5320 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
22:09:06.0656 5320 Udfs - ok
22:09:06.0859 5320 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
22:09:06.0859 5320 ultra - ok
22:09:07.0078 5320 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
22:09:07.0078 5320 Update - ok
22:09:07.0328 5320 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:09:07.0328 5320 usbccgp - ok
22:09:07.0562 5320 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:09:07.0562 5320 usbehci - ok
22:09:07.0750 5320 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:09:07.0750 5320 usbhub - ok
22:09:07.0984 5320 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
22:09:07.0984 5320 usbprint - ok
22:09:08.0218 5320 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
22:09:08.0218 5320 usbscan - ok
22:09:08.0421 5320 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:09:08.0421 5320 USBSTOR - ok
22:09:08.0656 5320 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
22:09:08.0671 5320 usbuhci - ok
22:09:08.0890 5320 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
22:09:08.0906 5320 VgaSave - ok
22:09:09.0109 5320 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
22:09:09.0125 5320 viaagp - ok
22:09:09.0312 5320 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
22:09:09.0312 5320 ViaIde - ok
22:09:09.0515 5320 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
22:09:09.0531 5320 VolSnap - ok
22:09:09.0750 5320 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:09:09.0765 5320 Wanarp - ok
22:09:09.0906 5320 wanatw - ok
22:09:10.0031 5320 WDICA - ok
22:09:10.0171 5320 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
22:09:10.0187 5320 wdmaud - ok
22:09:10.0484 5320 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
22:09:10.0484 5320 WpdUsb - ok
22:09:10.0703 5320 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
22:09:10.0718 5320 WS2IFSL - ok
22:09:10.0875 5320 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
22:09:10.0875 5320 WudfPf - ok
22:09:11.0109 5320 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
22:09:11.0109 5320 WudfRd - ok
22:09:11.0265 5320 xcpip - ok
22:09:11.0421 5320 xpsec - ok
22:09:11.0468 5320 MBR (0x1B8) (33acd7f96c8c543021d4b4a4c6afbe8a) \Device\Harddisk0\DR0
22:09:11.0468 5320 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - infected
22:09:11.0468 5320 \Device\Harddisk0\DR0 - detected Backdoor.Win32.Sinowal.knf (0)
22:09:11.0468 5320 Boot (0x1200) (af3c30f3ca1fd6a894a15878e085aaf1) \Device\Harddisk0\DR0\Partition0
22:09:11.0468 5320 \Device\Harddisk0\DR0\Partition0 - ok
22:09:11.0468 5320 ============================================================
22:09:11.0468 5320 Scan finished
22:09:11.0468 5320 ============================================================
22:09:11.0500 2992 Detected object count: 2
22:09:11.0500 2992 Actual detected object count: 2
22:09:41.0562 2992 Backup copy found, using it..
22:09:41.0875 2992 C:\WINDOWS\system32\DRIVERS\serial.sys - will be cured on reboot
22:09:56.0468 2992 Serial ( Rootkit.Win32.ZAccess.k ) - User select action: Cure
22:09:56.0515 2992 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - will be cured on reboot
22:09:56.0515 2992 \Device\Harddisk0\DR0 - ok
22:09:56.0515 2992 \Device\Harddisk0\DR0 ( Backdoor.Win32.Sinowal.knf ) - User select action: Cure
22:10:13.0234 4500 Deinitialize success

———————-

And here is the Combo Fix log:

———————–
ComboFix 11-11-30.03 - 11/30/2011 23:10:18.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.998 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\ \Application Data\PriceGong
c:\documents and settings\ \Application Data\PriceGong\Data\1.xml
c:\documents and settings\ \Application Data\PriceGong\Data\a.xml
c:\documents and settings\ \Application Data\PriceGong\Data\b.xml
c:\documents and settings\ \Application Data\PriceGong\Data\c.xml
c:\documents and settings\ \Application Data\PriceGong\Data\d.xml
c:\documents and settings\ \Application Data\PriceGong\Data\e.xml
c:\documents and settings\ \Application Data\PriceGong\Data\f.xml
c:\documents and settings\ \Application Data\PriceGong\Data\g.xml
c:\documents and settings\ \Application Data\PriceGong\Data\h.xml
c:\documents and settings\ \Application Data\PriceGong\Data\i.xml
c:\documents and settings\ \Application Data\PriceGong\Data\J.xml
c:\documents and settings\ \Application Data\PriceGong\Data\k.xml
c:\documents and settings\ \Application Data\PriceGong\Data\l.xml
c:\documents and settings\ \Application Data\PriceGong\Data\m.xml
c:\documents and settings\ \Application Data\PriceGong\Data\n.xml
c:\documents and settings\ \Application Data\PriceGong\Data\o.xml
c:\documents and settings\ \Application Data\PriceGong\Data\p.xml
c:\documents and settings\ \Application Data\PriceGong\Data\q.xml
c:\documents and settings\ \Application Data\PriceGong\Data\r.xml
c:\documents and settings\ \Application Data\PriceGong\Data\s.xml
c:\documents and settings\ \Application Data\PriceGong\Data\t.xml
c:\documents and settings\ \Application Data\PriceGong\Data\u.xml
c:\documents and settings\ \Application Data\PriceGong\Data\v.xml
c:\documents and settings\ \Application Data\PriceGong\Data\w.xml
c:\documents and settings\ \Application Data\PriceGong\Data\x.xml
c:\documents and settings\ \Application Data\PriceGong\Data\y.xml
c:\documents and settings\ \Application Data\PriceGong\Data\z.xml
c:\documents and settings\ \My Documents\~WRL0003.tmp
c:\documents and settings\ \My Documents\~WRL0004.tmp
c:\documents and settings\ \My Documents\qkmz.exe
c:\documents and settings\ \Recent\SYSTEM.CNF
c:\documents and settings\ \WINDOWS
c:\documents and settings\HelpAssistant\ntuser.tmp
c:\documents and settings\HelpAssistant\WINDOWS
C:\SymNRT.exe
c:\windows\$NtUninstallKB9128$
c:\windows\$NtUninstallKB9128$\368034911
c:\windows\$NtUninstallKB9128$\381367571\@
c:\windows\$NtUninstallKB9128$\381367571\bckfg.tmp
c:\windows\$NtUninstallKB9128$\381367571\cfg.ini
c:\windows\$NtUninstallKB9128$\381367571\Desktop.ini
c:\windows\$NtUninstallKB9128$\381367571\keywords
c:\windows\$NtUninstallKB9128$\381367571\kwrd.dll
c:\windows\$NtUninstallKB9128$\381367571\L\odetmngk
c:\windows\$NtUninstallKB9128$\381367571\lsflt7.ver
c:\windows\$NtUninstallKB9128$\381367571\U\00000001.@
c:\windows\$NtUninstallKB9128$\381367571\U\00000002.@
c:\windows\$NtUninstallKB9128$\381367571\U\00000004.@
c:\windows\$NtUninstallKB9128$\381367571\U\80000000.@
c:\windows\$NtUninstallKB9128$\381367571\U\80000004.@
c:\windows\$NtUninstallKB9128$\381367571\U\80000032.@
c:\windows\iun6002.exe
c:\windows\system32\bszip.dll
c:\windows\system32\drivers\fad.sys
c:\windows\system32\Thumbs.db
.
.
\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected
.
((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 )))))))))))))))))))))))))))))))
.
.
2011-12-01 04:55 . 2011-12-01 04:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-11-27 06:47 . 2011-11-27 06:48 ——– d—–w- c:\documents and settings\ \.gegl-0.0
2011-11-23 21:12 . 2011-11-23 21:12 ——– d-sh–w- c:\documents and settings\NetworkService\PrivacIE
2011-11-03 02:19 . 2011-11-18 04:35 ——– d—–w- c:\documents and settings\ \Local Settings\Application Data\Akamai
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-01 03:11 . 2004-08-04 04:15 64896 —-a-w- c:\windows\system32\drivers\serial.sys
2011-10-03 04:18 . 2005-09-06 04:49 99965 —-a-w- c:\windows\UninstallFirefox.exe
2011-09-14 02:11 . 2011-08-30 08:22 6278328 —-a-w- c:\program files\Common Files\wruninstall.exe
2005-03-17 23:02 . 2011-10-03 04:17 94208 —-a-w- c:\program files\mozilla firefox\components\BrandRes.dll
2011-08-12 05:57 . 2011-10-03 04:49 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-03-17 23:02 . 2011-10-03 04:17 150912 —-a-w- c:\program files\mozilla firefox\components\fullsoft.dll
2005-03-17 23:02 . 2011-10-03 04:17 41573 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2005-03-17 23:02 . 2011-10-03 04:17 48223 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2005-03-17 23:02 . 2011-10-03 04:17 8813 —-a-w- c:\program files\mozilla firefox\components\qfaservices.dll
2005-03-17 23:02 . 2011-10-03 04:17 158823 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54 175912 —-a-w- c:\program files\DVDVideoSoftTB\prxtbDVD0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{6B78A880-15CA-468f-8422-A7960AD6FBB9}"
[HKEY_CLASSES_ROOT\CLSID\{6B78A880-15CA-468f-8422-A7960AD6FBB9}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{4EE7A346-5845-471e-9FAB-002EAF83F8B0}"
[HKEY_CLASSES_ROOT\CLSID\{4EE7A346-5845-471e-9FAB-002EAF83F8B0}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}"
[HKEY_CLASSES_ROOT\CLSID\{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{493FC96E-B938-4924-9B38-C4088E9B8AC2}"
[HKEY_CLASSES_ROOT\CLSID\{493FC96E-B938-4924-9B38-C4088E9B8AC2}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartException"="c:\program files\Stardock\SmartException\smartex.exe" [2006-11-15 87728]
"Akamai NetSession Interface"="c:\documents and settings\ \Local Settings\Application Data\Akamai\netsession_win.exe" [2011-11-17 3303000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2005-12-07 131072]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-08-25 98304]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"WebrootTrayApp"="c:\program files\Webroot\Security\Current\Framework\WRTray.exe" [2011-09-14 1382984]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Install Webroot FF RunOnce.lnk - c:\program files\Common Files\wruninstall.exe [2011-8-30 6278328]
Install Webroot IE RunOnce.lnk - c:\program files\Common Files\wruninstall.exe [2011-8-30 6278328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI1"=myokent.dll
"MIDI2"=WGDRVR32.DLL
"WAVE2"=WGDRVR32.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SafeConnect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SafeConnect.lnk
backup=c:\windows\pss\SafeConnect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^ ^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\ \Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^ ^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=c:\documents and settings\ \Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=c:\windows\pss\Clean Access Agent.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bart Station]
c:\program files\ISP50\BIN\PPCOLink -STATION [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
2005-11-09 15:24 1196544 —-a-w- c:\program files\Ares\Ares.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Photo AIO Printer 922]
2004-03-29 19:12 290816 —-a-w- c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2005-05-15 07:04 332800 —-a-w- c:\progra~1\DELLSU~1\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1137646079\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-21 21:48 155648 —-a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 14:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50 53248 —-a-w- c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
2003-10-07 13:48 147514 —-a-w- c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPCRunonce]
2004-09-18 00:37 15872 —-a-w- c:\windows\system32\PPCRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Propel Accelerator]
2004-06-02 17:43 753309 —-a-w- c:\progra~1\PEOPLE~1\PropelAC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2005-08-25 12:34 98304 —-a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 21:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2005-09-09 13:02 24576 —-a-w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"SCManager"=2 (0x2)
"C-DillaCdaC11BA"=2 (0x2)
"aawservice"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\StubInstaller.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1137646079\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Defcon\\defcon.exe"=
"c:\\Program Files\\SafeConnect\\SCClient.exe"=
"c:\\Program Files\\SafeConnect\\scManager.sys"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\mektek.net\\MTX\\mtx.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mektek.net\\Mechwarrior Mercenaries - Mektek Mekpak\\MW4Mercs.exe"=
"c:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=
"c:\\Documents and Settings\\ \\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6073:TCP"= 6073:TCP:Mechwarrior
"27999:TCP"= 27999:TCP:Mechwarrior
"28000:TCP"= 28000:TCP:Mechwarrior
"28805:TCP"= 28805:TCP:Mechwarrior
"28806:TCP"= 28806:TCP:Mechwarrior
"28807:TCP"= 28807:TCP:Mechwarrior
"28808:TCP"= 28808:TCP:Mechwarrior
"9999:TCP"= 9999:TCP:Mechwarrior
"47624:UDP"= 47624:UDP:Mechwarrior
"47624:TCP"= 47624:TCP:Mechwarrior
"23936:TCP"= 23936:TCP:BitComet 23936 TCP
"23936:UDP"= 23936:UDP:BitComet 23936 UDP
"3389:TCP"= 3389:TCP:Remote Desktop
"56738:TCP"= 56738:TCP:BitComet 56738 TCP
"56738:UDP"= 56738:UDP:BitComet 56738 UDP
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3366:TCP"= 3366:TCP:Services
"5232:TCP"= 5232:TCP:Services
"8259:TCP"= 8259:TCP:Services
"8260:TCP"= 8260:TCP:Services
"2395:TCP"= 2395:TCP:Services
"3290:TCP"= 3290:TCP:Services
"7242:TCP"= 7242:TCP:Services
"7243:TCP"= 7243:TCP:Services
"7664:TCP"= 7664:TCP:Services
"8898:TCP"= 8898:TCP:Services
"6086:TCP"= 6086:TCP:Services
"6508:TCP"= 6508:TCP:Services
"7148:TCP"= 7148:TCP:Services
"7633:TCP"= 7633:TCP:Services
"4804:TCP"= 4804:TCP:Services
"5289:TCP"= 5289:TCP:Services
"5242:TCP"= 5242:TCP:Services
"5773:TCP"= 5773:TCP:Services
"6195:TCP"= 6195:TCP:Services
"6289:TCP"= 6289:TCP:Services
"3082:TCP"= 3082:TCP:Services
"4820:TCP"= 4820:TCP:Services
"7117:TCP"= 7117:TCP:Services
"3114:TCP"= 3114:TCP:Services
"8929:TCP"= 8929:TCP:Services
"3555:TCP"= 3555:TCP:Services
"4040:TCP"= 4040:TCP:Services
"8601:TCP"= 8601:TCP:Services
"3587:TCP"= 3587:TCP:Services
"9554:TCP"= 9554:TCP:Services
"6929:TCP"= 6929:TCP:Services
"9789:TCP"= 9789:TCP:Services
"7915:TCP"= 7915:TCP:Services
"3180:TCP"= 3180:TCP:Services
"9695:TCP"= 9695:TCP:Services
"2321:TCP"= 2321:TCP:Services
"7883:TCP"= 7883:TCP:Services
"9867:TCP"= 9867:TCP:Services
"9164:TCP"= 9164:TCP:Services
"1571:TCP"= 1571:TCP:Services
"9023:TCP"= 9023:TCP:Services
"4726:TCP"= 4726:TCP:Services
"9226:TCP"= 9226:TCP:Services
"7227:TCP"= 7227:TCP:Services
"9398:TCP"= 9398:TCP:Services
"8367:TCP"= 8367:TCP:Services
"8554:TCP"= 8554:TCP:Services
"8539:TCP"= 8539:TCP:Services
"6914:TCP"= 6914:TCP:Services
"8836:TCP"= 8836:TCP:Services
"8695:TCP"= 8695:TCP:Services
"6304:TCP"= 6304:TCP:Services
"7851:TCP"= 7851:TCP:Services
"8273:TCP"= 8273:TCP:Services
"6023:TCP"= 6023:TCP:Services
"1618:TCP"= 1618:TCP:Services
"7789:TCP"= 7789:TCP:Services
"5961:TCP"= 5961:TCP:Services
"8758:TCP"= 8758:TCP:Services
"7336:TCP"= 7336:TCP:Services
"5944:TCP"= 5944:TCP:Services
"9039:TCP"= 9039:TCP:Services
"7054:TCP"= 7054:TCP:Services
"2790:TCP"= 2790:TCP:Services
"7086:TCP"= 7086:TCP:Services
"5601:TCP"= 5601:TCP:Services
"5539:TCP"= 5539:TCP:Services
"4571:TCP"= 4571:TCP:Services
"9601:TCP"= 9601:TCP:Services
"6320:TCP"= 6320:TCP:Services
"6586:TCP"= 6586:TCP:Services
"8851:TCP"= 8851:TCP:Services
"9289:TCP"= 9289:TCP:Services
"2542:TCP"= 2542:TCP:Services
"8008:TCP"= 8008:TCP:Services
"8586:TCP"= 8586:TCP:Services
"9851:TCP"= 9851:TCP:Services
"2759:TCP"= 2759:TCP:Services
"9773:TCP"= 9773:TCP:Services
"9617:TCP"= 9617:TCP:Services
"7492:TCP"= 7492:TCP:Services
"4879:TCP"= 4879:TCP:Services
"5039:TCP"= 5039:TCP:Services
"2399:TCP"= 2399:TCP:Services
"4783:TCP"= 4783:TCP:Services
"9443:TCP"= 9443:TCP:Services
"3636:TCP"= 3636:TCP:Services
"7724:TCP"= 7724:TCP:Services
"9350:TCP"= 9350:TCP:Services
"5146:TCP"= 5146:TCP:Services
"1071:TCP"= 1071:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [4/8/2007 11:38 PM 58464]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [8/30/2011 3:23 AM 122696]
R2 SSFMONM;ssfmonm;c:\windows\system32\drivers\ssfmonm.sys [8/30/2011 3:24 AM 45584]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Security\Current\Framework\WRConsumerService.exe [9/13/2011 9:11 PM 3381184]
S2 timidity;FireDaemon Service: Timidity++;c:\program files\FireDaemon\FireDaemon.exe -s –> c:\program files\FireDaemon\FireDaemon.exe -s [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?]
S4 SCManager;SafeConnect Manager;c:\program files\SafeConnect\scManager.sys servicestart –> c:\program files\SafeConnect\scManager.sys servicestart [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/17/2010 11:33 PM 691696]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ENTDRV51
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4112088102-2527765215-2234832989-1006Core.job
- c:\documents and settings\ \Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-20 05:18]
.
2011-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4112088102-2527765215-2234832989-1006UA.job
- c:\documents and settings\ \Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-20 05:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.altavista.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Free YouTube Download - c:\documents and settings\ \Application Data\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\documents and settings\ \Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: Interfaces\{9C0C9BA6-1D51-4645-B58A-5D5D2448678C}: NameServer = 192.168.1.254
DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} - hxxp://www.link-systems.com/sdkhtml/SDK/paste/lsiw2k.cab
FF - ProfilePath - c:\documents and settings\ \Application Data\Mozilla\Firefox\Profiles\i8main9u.default\
.
- - - - ORPHANS REMOVED - - - -
.
SharedTaskScheduler-{f964269e-2024-485d-bee2-90ee5b80ee41} - c:\windows\system32\zelokore.dll
SharedTaskScheduler-{1f770441-af4b-40fb-afb8-d72431a25469} - c:\windows\system32\ligamosa.dll
SharedTaskScheduler-{61725354-71ef-48f1-9e56-0196bf4fa267} - c:\windows\system32\vofehafi.dll
SSODL-noganenob-{f964269e-2024-485d-bee2-90ee5b80ee41} - c:\windows\system32\zelokore.dll
SSODL-kesiheluy-{1f770441-af4b-40fb-afb8-d72431a25469} - c:\windows\system32\ligamosa.dll
SSODL-sigonopir-{61725354-71ef-48f1-9e56-0196bf4fa267} - c:\windows\system32\vofehafi.dll
SafeBoot-57546112.sys
MSConfigStartUp-RealTray - c:\program files\Real\RealPlayer\RealPlay.exe
AddRemove-Emicsoft TOD Converter_is1 - c:\program files\Emicsoft Studio\Emicsoft TOD Converter\unins000.exe
AddRemove-MechWarrior Clan Pak - c:\program files\Microsoft Games\MechWarrior Vengeance\UNINSTALMPC.EXE
AddRemove-MechWarrior Mercenaries - c:\program files\Microsoft Games\Mechwarrior Mercenaries\UNINSTAL.EXE
AddRemove-Steam App 2800 - c:\program files\Steam\steam.exe
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-30 23:58
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(752)
c:\windows\system32\EntApi.dll
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2632)
c:\windows\system32\WININET.dll
c:\windows\system32\EntApi.dll
c:\program files\Webroot\Security\Current\plugins\antispam\WRASHooks.dll
c:\program files\Webroot\Security\Current\plugins\antispam\AntiSpamInterface.dll
c:\program files\Webroot\Security\Current\plugins\antispam\WINSPAMCATCHER.dll
c:\program files\Stardock\SmartException\SmartEx.DLL
c:\program files\Webroot\Security\current\plugins\sync\WebRootShellExt.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\program files\Network Associates\Common Framework\naPrdMgr.exe
c:\program files\Webroot\Security\current\plugins\antimalware\AEI.exe
c:\windows\system32\wscntfy.exe
c:\program files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe
c:\progra~1\Webroot\Security\Current\plugins\cleanup\WRCLEA~1.EXE
.
**************************************************************************
.
Completion time: 2011-12-01 00:13:03 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-01 05:12
.
Pre-Run: 3,633,020,928 bytes free
Post-Run: 8,115,281,920 bytes free
.
- - End Of File - - CE0F66CB957A857637B48E4F27F9C564


———————–

Thanks again for helping me out.

Ok, it said that it didn't detect anything, so I followed the second set of instructions you posted and got this log:

——————————

C:\Documents and Settings\\Desktop\HelpAsst_mebroot_fix.exe
Thu 12/01/2011 at 22:13:36.20

HelpAssistant account is Active ~ attempting to de-activate

Account active Yes
Local Group Memberships *Administrators

HelpAssistant successfully set Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll present! ~ attempting to remove
termsrv32.dll successfully removed

~~ Checking firewall ports ~~

backing up DomainProfile\GloballyOpenPorts\List registry key
closing rogue ports

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"3366:TCP"=-
"5232:TCP"=-
"8259:TCP"=-
"8260:TCP"=-
"2395:TCP"=-
"3290:TCP"=-
"7242:TCP"=-
"7243:TCP"=-
"7664:TCP"=-
"8898:TCP"=-
"6086:TCP"=-
"6508:TCP"=-
"7148:TCP"=-
"7633:TCP"=-
"4804:TCP"=-
"5289:TCP"=-
"5242:TCP"=-
"5773:TCP"=-
"6195:TCP"=-
"6289:TCP"=-
"3082:TCP"=-
"4820:TCP"=-
"7117:TCP"=-
"3114:TCP"=-
"8929:TCP"=-
"3555:TCP"=-
"4040:TCP"=-
"8601:TCP"=-
"3587:TCP"=-
"9554:TCP"=-
"6929:TCP"=-
"9789:TCP"=-
"7915:TCP"=-
"3180:TCP"=-
"9695:TCP"=-
"2321:TCP"=-
"7883:TCP"=-
"9867:TCP"=-
"9164:TCP"=-
"1571:TCP"=-
"9023:TCP"=-
"4726:TCP"=-
"9226:TCP"=-
"7227:TCP"=-
"9398:TCP"=-
"8367:TCP"=-
"8554:TCP"=-
"8539:TCP"=-
"6914:TCP"=-
"8836:TCP"=-
"8695:TCP"=-
"6304:TCP"=-
"7851:TCP"=-
"8273:TCP"=-
"6023:TCP"=-
"1618:TCP"=-
"7789:TCP"=-
"5961:TCP"=-
"8758:TCP"=-
"7336:TCP"=-
"5944:TCP"=-
"9039:TCP"=-
"7054:TCP"=-
"2790:TCP"=-
"7086:TCP"=-
"5601:TCP"=-
"5539:TCP"=-
"4571:TCP"=-
"9601:TCP"=-
"6320:TCP"=-
"6586:TCP"=-
"8851:TCP"=-
"9289:TCP"=-
"2542:TCP"=-
"8008:TCP"=-
"8586:TCP"=-
"9851:TCP"=-
"2759:TCP"=-
"9773:TCP"=-
"9617:TCP"=-
"7492:TCP"=-
"4879:TCP"=-
"5039:TCP"=-
"2399:TCP"=-
"4783:TCP"=-
"9443:TCP"=-
"3636:TCP"=-
"7724:TCP"=-
"9350:TCP"=-
"5146:TCP"=-

backing up StandardProfile\GloballyOpenPorts\List registry key
closing rogue ports

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"3366:TCP"=-
"5232:TCP"=-
"8259:TCP"=-
"8260:TCP"=-
"2395:TCP"=-
"3290:TCP"=-
"7242:TCP"=-
"7243:TCP"=-
"7664:TCP"=-
"8898:TCP"=-
"6086:TCP"=-
"6508:TCP"=-
"7148:TCP"=-
"7633:TCP"=-
"4804:TCP"=-
"5289:TCP"=-
"5242:TCP"=-
"5773:TCP"=-
"6195:TCP"=-
"6289:TCP"=-
"3082:TCP"=-
"4820:TCP"=-
"7117:TCP"=-
"3114:TCP"=-
"8929:TCP"=-
"3555:TCP"=-
"4040:TCP"=-
"8601:TCP"=-
"3587:TCP"=-
"9554:TCP"=-
"6929:TCP"=-
"9789:TCP"=-
"7915:TCP"=-
"3180:TCP"=-
"9695:TCP"=-
"2321:TCP"=-
"7883:TCP"=-
"9867:TCP"=-
"9164:TCP"=-
"1571:TCP"=-
"9023:TCP"=-
"4726:TCP"=-
"9226:TCP"=-
"7227:TCP"=-
"9398:TCP"=-
"8367:TCP"=-
"8554:TCP"=-
"8539:TCP"=-
"6914:TCP"=-
"8836:TCP"=-
"8695:TCP"=-
"6304:TCP"=-
"7851:TCP"=-
"8273:TCP"=-
"6023:TCP"=-
"1618:TCP"=-
"7789:TCP"=-
"5961:TCP"=-
"8758:TCP"=-
"7336:TCP"=-
"5944:TCP"=-
"9039:TCP"=-
"7054:TCP"=-
"2790:TCP"=-
"7086:TCP"=-
"5601:TCP"=-
"5539:TCP"=-
"4571:TCP"=-
"9601:TCP"=-
"6320:TCP"=-
"6586:TCP"=-
"8851:TCP"=-
"9289:TCP"=-
"2542:TCP"=-
"8008:TCP"=-
"8586:TCP"=-
"9851:TCP"=-
"2759:TCP"=-
"9773:TCP"=-
"9617:TCP"=-
"7492:TCP"=-
"4879:TCP"=-
"5039:TCP"=-
"2399:TCP"=-
"4783:TCP"=-
"9443:TCP"=-
"3636:TCP"=-
"7724:TCP"=-
"9350:TCP"=-
"5146:TCP"=-

~~ Checking profile list ~~

HelpAssistant profile found in registry ~ backing up and removing S-1-5-21-4112088102-2527765215-2234832989-1005
HelpAssistant profile directory exists at C:\Documents and Settings\HelpAssistant ~ attempting to remove
~ All C:\Documents and Settings\HelpAssistant files successfully removed ~

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Fri 12/02/2011 at 2:44:42.76

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x094FE9BD
malicious code @ sector 0x094FE9C0 !
PE file found in sector at 0x094FE9D6 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~

Things are running much more smoothly now, and ping.exe has stopped appearing at all. I did like you said, and here are the two logs:

HelpAsst:

C:\Documents and Settings\\Desktop\HelpAsst_mebroot_fix.exe
Thu 12/01/2011 at 22:13:36.20

HelpAssistant account is Active ~ attempting to de-activate

Account active Yes
Local Group Memberships *Administrators

HelpAssistant successfully set Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll present! ~ attempting to remove
termsrv32.dll successfully removed

~~ Checking firewall ports ~~

backing up DomainProfile\GloballyOpenPorts\List registry key
closing rogue ports

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"3366:TCP"=-
"5232:TCP"=-
"8259:TCP"=-
"8260:TCP"=-
"2395:TCP"=-
"3290:TCP"=-
"7242:TCP"=-
"7243:TCP"=-
"7664:TCP"=-
"8898:TCP"=-
"6086:TCP"=-
"6508:TCP"=-
"7148:TCP"=-
"7633:TCP"=-
"4804:TCP"=-
"5289:TCP"=-
"5242:TCP"=-
"5773:TCP"=-
"6195:TCP"=-
"6289:TCP"=-
"3082:TCP"=-
"4820:TCP"=-
"7117:TCP"=-
"3114:TCP"=-
"8929:TCP"=-
"3555:TCP"=-
"4040:TCP"=-
"8601:TCP"=-
"3587:TCP"=-
"9554:TCP"=-
"6929:TCP"=-
"9789:TCP"=-
"7915:TCP"=-
"3180:TCP"=-
"9695:TCP"=-
"2321:TCP"=-
"7883:TCP"=-
"9867:TCP"=-
"9164:TCP"=-
"1571:TCP"=-
"9023:TCP"=-
"4726:TCP"=-
"9226:TCP"=-
"7227:TCP"=-
"9398:TCP"=-
"8367:TCP"=-
"8554:TCP"=-
"8539:TCP"=-
"6914:TCP"=-
"8836:TCP"=-
"8695:TCP"=-
"6304:TCP"=-
"7851:TCP"=-
"8273:TCP"=-
"6023:TCP"=-
"1618:TCP"=-
"7789:TCP"=-
"5961:TCP"=-
"8758:TCP"=-
"7336:TCP"=-
"5944:TCP"=-
"9039:TCP"=-
"7054:TCP"=-
"2790:TCP"=-
"7086:TCP"=-
"5601:TCP"=-
"5539:TCP"=-
"4571:TCP"=-
"9601:TCP"=-
"6320:TCP"=-
"6586:TCP"=-
"8851:TCP"=-
"9289:TCP"=-
"2542:TCP"=-
"8008:TCP"=-
"8586:TCP"=-
"9851:TCP"=-
"2759:TCP"=-
"9773:TCP"=-
"9617:TCP"=-
"7492:TCP"=-
"4879:TCP"=-
"5039:TCP"=-
"2399:TCP"=-
"4783:TCP"=-
"9443:TCP"=-
"3636:TCP"=-
"7724:TCP"=-
"9350:TCP"=-
"5146:TCP"=-

backing up StandardProfile\GloballyOpenPorts\List registry key
closing rogue ports

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"3366:TCP"=-
"5232:TCP"=-
"8259:TCP"=-
"8260:TCP"=-
"2395:TCP"=-
"3290:TCP"=-
"7242:TCP"=-
"7243:TCP"=-
"7664:TCP"=-
"8898:TCP"=-
"6086:TCP"=-
"6508:TCP"=-
"7148:TCP"=-
"7633:TCP"=-
"4804:TCP"=-
"5289:TCP"=-
"5242:TCP"=-
"5773:TCP"=-
"6195:TCP"=-
"6289:TCP"=-
"3082:TCP"=-
"4820:TCP"=-
"7117:TCP"=-
"3114:TCP"=-
"8929:TCP"=-
"3555:TCP"=-
"4040:TCP"=-
"8601:TCP"=-
"3587:TCP"=-
"9554:TCP"=-
"6929:TCP"=-
"9789:TCP"=-
"7915:TCP"=-
"3180:TCP"=-
"9695:TCP"=-
"2321:TCP"=-
"7883:TCP"=-
"9867:TCP"=-
"9164:TCP"=-
"1571:TCP"=-
"9023:TCP"=-
"4726:TCP"=-
"9226:TCP"=-
"7227:TCP"=-
"9398:TCP"=-
"8367:TCP"=-
"8554:TCP"=-
"8539:TCP"=-
"6914:TCP"=-
"8836:TCP"=-
"8695:TCP"=-
"6304:TCP"=-
"7851:TCP"=-
"8273:TCP"=-
"6023:TCP"=-
"1618:TCP"=-
"7789:TCP"=-
"5961:TCP"=-
"8758:TCP"=-
"7336:TCP"=-
"5944:TCP"=-
"9039:TCP"=-
"7054:TCP"=-
"2790:TCP"=-
"7086:TCP"=-
"5601:TCP"=-
"5539:TCP"=-
"4571:TCP"=-
"9601:TCP"=-
"6320:TCP"=-
"6586:TCP"=-
"8851:TCP"=-
"9289:TCP"=-
"2542:TCP"=-
"8008:TCP"=-
"8586:TCP"=-
"9851:TCP"=-
"2759:TCP"=-
"9773:TCP"=-
"9617:TCP"=-
"7492:TCP"=-
"4879:TCP"=-
"5039:TCP"=-
"2399:TCP"=-
"4783:TCP"=-
"9443:TCP"=-
"3636:TCP"=-
"7724:TCP"=-
"9350:TCP"=-
"5146:TCP"=-

~~ Checking profile list ~~

HelpAssistant profile found in registry ~ backing up and removing S-1-5-21-4112088102-2527765215-2234832989-1005
HelpAssistant profile directory exists at C:\Documents and Settings\HelpAssistant ~ attempting to remove
~ All C:\Documents and Settings\HelpAssistant files successfully removed ~

~~ Checking mbr ~~

user & kernel MBR OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Fri 12/02/2011 at 2:44:42.76

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x094FE9BD
malicious code @ sector 0x094FE9C0 !
PE file found in sector at 0x094FE9D6 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Folder removal routine ~ Fri 12/02/2011 at 22:42:43.48

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking for HelpAssistant directories ~~

none found

~~ EOF ~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Status check on Fri 12/02/2011 at 22:44:28.42

Account active No
Local Group Memberships

~~ Checking mbr ~~

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x094FE9BD
malicious code @ sector 0x094FE9C0 !
PE file found in sector at 0x094FE9D6 !

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found


HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %systemroot%\System32\termsrv.dll

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking for HelpAssistant directories ~~

none found

~~ Checking firewall ports ~~

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]


~~ EOF ~~


and, here is the ComboFix:

ComboFix 11-11-30.03 - 12/02/2011 22:55:15.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.857 [GMT -5:00]
Running from: c:\documents and settings\\Desktop\ComboFix.exe
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
.
.
((((((((((((((((((((((((( Files Created from 2011-11-03 to 2011-12-03 )))))))))))))))))))))))))))))))
.
.
2011-12-02 03:13 . 2011-12-02 03:14 ——– d—–w- C:\HelpAsst_backup
2011-11-27 06:47 . 2011-11-27 06:48 ——– d—–w- c:\documents and settings\\.gegl-0.0
2011-11-23 21:12 . 2011-11-23 21:12 ——– d-sh–w- c:\documents and settings\NetworkService\PrivacIE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-01 03:11 . 2004-08-04 04:15 64896 —-a-w- c:\windows\system32\drivers\serial.sys
2011-10-03 04:18 . 2005-09-06 04:49 99965 —-a-w- c:\windows\UninstallFirefox.exe
2011-09-14 02:11 . 2011-08-30 08:22 6278328 —-a-w- c:\program files\Common Files\wruninstall.exe
2005-03-17 23:02 . 2011-10-03 04:17 94208 —-a-w- c:\program files\mozilla firefox\components\BrandRes.dll
2011-08-12 05:57 . 2011-10-03 04:49 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-03-17 23:02 . 2011-10-03 04:17 150912 —-a-w- c:\program files\mozilla firefox\components\fullsoft.dll
2005-03-17 23:02 . 2011-10-03 04:17 41573 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2005-03-17 23:02 . 2011-10-03 04:17 48223 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2005-03-17 23:02 . 2011-10-03 04:17 8813 —-a-w- c:\program files\mozilla firefox\components\qfaservices.dll
2005-03-17 23:02 . 2011-10-03 04:17 158823 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-01_04.55.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-03 03:25 . 2011-12-03 03:25 16384 c:\windows\Temp\Perflib_Perfdata_d0.dat
+ 2005-09-04 02:14 . 2011-12-03 03:25 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2005-09-04 02:14 . 2011-12-01 04:54 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-09-04 02:14 . 2011-12-03 03:25 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-09-04 02:14 . 2011-12-01 04:54 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-09-04 02:14 . 2011-12-03 03:25 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-09-04 02:14 . 2011-12-01 04:54 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-02-10 03:08 . 2011-10-28 03:04 50295240 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54 175912 —-a-w- c:\program files\DVDVideoSoftTB\prxtbDVD0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{6B78A880-15CA-468f-8422-A7960AD6FBB9}"
[HKEY_CLASSES_ROOT\CLSID\{6B78A880-15CA-468f-8422-A7960AD6FBB9}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{4EE7A346-5845-471e-9FAB-002EAF83F8B0}"
[HKEY_CLASSES_ROOT\CLSID\{4EE7A346-5845-471e-9FAB-002EAF83F8B0}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}"
[HKEY_CLASSES_ROOT\CLSID\{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{493FC96E-B938-4924-9B38-C4088E9B8AC2}"
[HKEY_CLASSES_ROOT\CLSID\{493FC96E-B938-4924-9B38-C4088E9B8AC2}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartException"="c:\program files\Stardock\SmartException\smartex.exe" [2006-11-15 87728]
"Akamai NetSession Interface"="c:\documents and settings\\Local Settings\Application Data\Akamai\netsession_win.exe" [2011-11-17 3303000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2005-12-07 131072]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-08-25 98304]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"WebrootTrayApp"="c:\program files\Webroot\Security\Current\Framework\WRTray.exe" [2011-09-14 1382984]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Install Webroot FF RunOnce.lnk - c:\program files\Common Files\wruninstall.exe [2011-8-30 6278328]
Install Webroot IE RunOnce.lnk - c:\program files\Common Files\wruninstall.exe [2011-8-30 6278328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI1"=myokent.dll
"MIDI2"=WGDRVR32.DLL
"WAVE2"=WGDRVR32.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SafeConnect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SafeConnect.lnk
backup=c:\windows\pss\SafeConnect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=c:\documents and settings\\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=c:\windows\pss\Clean Access Agent.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bart Station]
c:\program files\ISP50\BIN\PPCOLink -STATION [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
2005-11-09 15:24 1196544 —-a-w- c:\program files\Ares\Ares.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Photo AIO Printer 922]
2004-03-29 19:12 290816 —-a-w- c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2005-05-15 07:04 332800 —-a-w- c:\progra~1\DELLSU~1\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1137646079\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-21 21:48 155648 —-a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 14:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50 53248 —-a-w- c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
2003-10-07 13:48 147514 —-a-w- c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPCRunonce]
2004-09-18 00:37 15872 —-a-w- c:\windows\system32\PPCRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Propel Accelerator]
2004-06-02 17:43 753309 —-a-w- c:\progra~1\PEOPLE~1\PropelAC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2005-08-25 12:34 98304 —-a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 21:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2005-09-09 13:02 24576 —-a-w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"SCManager"=2 (0x2)
"C-DillaCdaC11BA"=2 (0x2)
"aawservice"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\StubInstaller.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1137646079\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Defcon\\defcon.exe"=
"c:\\Program Files\\SafeConnect\\SCClient.exe"=
"c:\\Program Files\\SafeConnect\\scManager.sys"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\mektek.net\\MTX\\mtx.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mektek.net\\Mechwarrior Mercenaries - Mektek Mekpak\\MW4Mercs.exe"=
"c:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=
"c:\\Documents and Settings\\\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6073:TCP"= 6073:TCP:Mechwarrior
"27999:TCP"= 27999:TCP:Mechwarrior
"28000:TCP"= 28000:TCP:Mechwarrior
"28805:TCP"= 28805:TCP:Mechwarrior
"28806:TCP"= 28806:TCP:Mechwarrior
"28807:TCP"= 28807:TCP:Mechwarrior
"28808:TCP"= 28808:TCP:Mechwarrior
"9999:TCP"= 9999:TCP:Mechwarrior
"47624:UDP"= 47624:UDP:Mechwarrior
"47624:TCP"= 47624:TCP:Mechwarrior
"23936:TCP"= 23936:TCP:BitComet 23936 TCP
"23936:UDP"= 23936:UDP:BitComet 23936 UDP
"56738:TCP"= 56738:TCP:BitComet 56738 TCP
"56738:UDP"= 56738:UDP:BitComet 56738 UDP
"1049:TCP"= 1049:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [4/8/2007 11:38 PM 58464]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [8/30/2011 3:23 AM 122696]
R2 SSFMONM;ssfmonm;c:\windows\system32\drivers\ssfmonm.sys [8/30/2011 3:24 AM 45584]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Security\Current\Framework\WRConsumerService.exe [9/13/2011 9:11 PM 3381184]
S2 timidity;FireDaemon Service: Timidity++;c:\program files\FireDaemon\FireDaemon.exe -s –> c:\program files\FireDaemon\FireDaemon.exe -s [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?]
S4 SCManager;SafeConnect Manager;c:\program files\SafeConnect\scManager.sys servicestart –> c:\program files\SafeConnect\scManager.sys servicestart [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/17/2010 11:33 PM 691696]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4112088102-2527765215-2234832989-1006Core.job
- c:\documents and settings\\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-20 05:18]
.
2011-12-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4112088102-2527765215-2234832989-1006UA.job
- c:\documents and settings\\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-20 05:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.altavista.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Free YouTube Download - c:\documents and settings\\Application Data\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\documents and settings\\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: Interfaces\{9C0C9BA6-1D51-4645-B58A-5D5D2448678C}: NameServer = 192.168.1.254
DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} - hxxp://www.link-systems.com/sdkhtml/SDK/paste/lsiw2k.cab
FF - ProfilePath - c:\documents and settings\\Application Data\Mozilla\Firefox\Profiles\i8main9u.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-02 23:34
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(748)
c:\windows\system32\EntApi.dll
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(1360)
c:\windows\system32\WININET.dll
c:\windows\system32\EntApi.dll
c:\program files\Webroot\Security\Current\plugins\antispam\WRASHooks.dll
c:\program files\Webroot\Security\Current\plugins\antispam\AntiSpamInterface.dll
c:\program files\Webroot\Security\Current\plugins\antispam\WINSPAMCATCHER.dll
c:\program files\Webroot\Security\current\plugins\sync\WebRootShellExt.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-12-02 23:47:05
ComboFix-quarantined-files.txt 2011-12-03 04:46
ComboFix2.txt 2011-12-01 05:29
.
Pre-Run: 7,880,929,280 bytes free
Post-Run: 7,857,827,840 bytes free
.
- - End Of File - - 352729AA58D1F6ED9ED8A6B442DC38ED

Thanks again for your time

Ok, ran combofix again. Said I had a zero access rootkit infection which is difficult to remove? Here is the log:

ComboFix 11-11-30.03 - 12/04/2011 15:06:17.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.980 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\fIJsmsUwPvQ.exe
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\$NtUninstallKB9128$
c:\windows\$NtUninstallKB9128$\2332301226
c:\windows\$NtUninstallKB9128$\381367571\@
c:\windows\$NtUninstallKB9128$\381367571\bckfg.tmp
c:\windows\$NtUninstallKB9128$\381367571\cfg.ini
c:\windows\$NtUninstallKB9128$\381367571\Desktop.ini
c:\windows\$NtUninstallKB9128$\381367571\keywords
c:\windows\$NtUninstallKB9128$\381367571\kwrd.dll
c:\windows\$NtUninstallKB9128$\381367571\L\odetmngk
c:\windows\$NtUninstallKB9128$\381367571\U\00000001.@
c:\windows\$NtUninstallKB9128$\381367571\U\00000002.@
c:\windows\$NtUninstallKB9128$\381367571\U\00000004.@
c:\windows\$NtUninstallKB9128$\381367571\U\80000000.@
c:\windows\$NtUninstallKB9128$\381367571\U\80000004.@
c:\windows\$NtUninstallKB9128$\381367571\U\80000032.@
.
Infected copy of c:\windows\system32\drivers\i8042prt.sys was found and disinfected
Restored copy from - The cat found it
.
((((((((((((((((((((((((( Files Created from 2011-11-04 to 2011-12-04 )))))))))))))))))))))))))))))))
.
.
2011-12-04 20:52 . 2011-12-04 20:52 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-12-04 19:59 . 2004-08-04 10:00 52736 —-a-w- c:\windows\system32\drivers\i8042prt.sys
2011-12-04 08:02 . 2011-12-04 08:02 ——– d—–w- c:\documents and settings\Administrator\Application Data\Sonic
2011-12-04 08:02 . 2011-12-04 08:02 ——– d—–w- c:\documents and settings\Administrator\Application Data\Leadertech
2011-11-27 06:47 . 2011-11-27 06:48 ——– d—–w- c:\documents and settings\ \.gegl-0.0
2011-11-23 21:12 . 2011-11-23 21:12 ——– d-sh–w- c:\documents and settings\NetworkService\PrivacIE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-01 03:11 . 2004-08-04 04:15 64896 —-a-w- c:\windows\system32\drivers\serial.sys
2011-10-03 04:18 . 2005-09-06 04:49 99965 —-a-w- c:\windows\UninstallFirefox.exe
2011-09-14 02:11 . 2011-08-30 08:22 6278328 —-a-w- c:\program files\Common Files\wruninstall.exe
2005-03-17 23:02 . 2011-10-03 04:17 94208 —-a-w- c:\program files\mozilla firefox\components\BrandRes.dll
2011-08-12 05:57 . 2011-10-03 04:49 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-03-17 23:02 . 2011-10-03 04:17 150912 —-a-w- c:\program files\mozilla firefox\components\fullsoft.dll
2005-03-17 23:02 . 2011-10-03 04:17 41573 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2005-03-17 23:02 . 2011-10-03 04:17 48223 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2005-03-17 23:02 . 2011-10-03 04:17 8813 —-a-w- c:\program files\mozilla firefox\components\qfaservices.dll
2005-03-17 23:02 . 2011-10-03 04:17 158823 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-01_04.55.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-04 20:51 . 2011-12-04 20:51 16384 c:\windows\Temp\Perflib_Perfdata_2d0.dat
+ 2011-12-04 19:59 . 2004-08-04 10:00 52736 c:\windows\system32\dllcache\i8042prt.sys
- 2004-08-04 04:14 . 2004-08-04 10:00 52736 c:\windows\system32\dllcache\i8042prt.sys
+ 2005-09-04 02:14 . 2011-12-04 19:44 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-09-04 02:14 . 2011-12-01 04:54 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-09-04 02:14 . 2011-12-04 19:44 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-09-04 02:14 . 2011-12-01 04:54 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-02-10 03:08 . 2011-10-28 03:04 50295240 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54 175912 —-a-w- c:\program files\DVDVideoSoftTB\prxtbDVD0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{6B78A880-15CA-468f-8422-A7960AD6FBB9}"
[HKEY_CLASSES_ROOT\CLSID\{6B78A880-15CA-468f-8422-A7960AD6FBB9}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{4EE7A346-5845-471e-9FAB-002EAF83F8B0}"
[HKEY_CLASSES_ROOT\CLSID\{4EE7A346-5845-471e-9FAB-002EAF83F8B0}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}"
[HKEY_CLASSES_ROOT\CLSID\{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{493FC96E-B938-4924-9B38-C4088E9B8AC2}"
[HKEY_CLASSES_ROOT\CLSID\{493FC96E-B938-4924-9B38-C4088E9B8AC2}]
2011-07-21 20:04 326928 —-a-w- c:\program files\Webroot\Security\Current\plugins\sync\WebRootShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartException"="c:\program files\Stardock\SmartException\smartex.exe" [2006-11-15 87728]
"Akamai NetSession Interface"="c:\documents and settings\ \Local Settings\Application Data\Akamai\netsession_win.exe" [2011-11-17 3303000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2005-12-07 131072]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-08-25 98304]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"WebrootTrayApp"="c:\program files\Webroot\Security\Current\Framework\WRTray.exe" [2011-09-14 1382984]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Install Webroot FF RunOnce.lnk - c:\program files\Common Files\wruninstall.exe [2011-8-30 6278328]
Install Webroot IE RunOnce.lnk - c:\program files\Common Files\wruninstall.exe [2011-8-30 6278328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI1"=myokent.dll
"MIDI2"=WGDRVR32.DLL
"WAVE2"=WGDRVR32.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SafeConnect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SafeConnect.lnk
backup=c:\windows\pss\SafeConnect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^ ^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\ \Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^ ^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=c:\documents and settings\ \Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=c:\windows\pss\Clean Access Agent.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bart Station]
c:\program files\ISP50\BIN\PPCOLink -STATION [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
2005-11-09 15:24 1196544 —-a-w- c:\program files\Ares\Ares.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Photo AIO Printer 922]
2004-03-29 19:12 290816 —-a-w- c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2005-05-15 07:04 332800 —-a-w- c:\progra~1\DELLSU~1\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 —-a-w- c:\program files\Common Files\AOL\1137646079\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-21 21:48 155648 —-a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 14:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 13:50 53248 —-a-w- c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
2003-10-07 13:48 147514 —-a-w- c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPCRunonce]
2004-09-18 00:37 15872 —-a-w- c:\windows\system32\PPCRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Propel Accelerator]
2004-06-02 17:43 753309 —-a-w- c:\progra~1\PEOPLE~1\PropelAC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2005-08-25 12:34 98304 —-a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 21:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2005-09-09 13:02 24576 —-a-w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"SCManager"=2 (0x2)
"C-DillaCdaC11BA"=2 (0x2)
"aawservice"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\StubInstaller.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1137646079\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Defcon\\defcon.exe"=
"c:\\Program Files\\SafeConnect\\SCClient.exe"=
"c:\\Program Files\\SafeConnect\\scManager.sys"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\mektek.net\\MTX\\mtx.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mektek.net\\Mechwarrior Mercenaries - Mektek Mekpak\\MW4Mercs.exe"=
"c:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=
"c:\\Documents and Settings\\ \\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6073:TCP"= 6073:TCP:Mechwarrior
"27999:TCP"= 27999:TCP:Mechwarrior
"28000:TCP"= 28000:TCP:Mechwarrior
"28805:TCP"= 28805:TCP:Mechwarrior
"28806:TCP"= 28806:TCP:Mechwarrior
"28807:TCP"= 28807:TCP:Mechwarrior
"28808:TCP"= 28808:TCP:Mechwarrior
"9999:TCP"= 9999:TCP:Mechwarrior
"47624:UDP"= 47624:UDP:Mechwarrior
"47624:TCP"= 47624:TCP:Mechwarrior
"23936:TCP"= 23936:TCP:BitComet 23936 TCP
"23936:UDP"= 23936:UDP:BitComet 23936 UDP
"56738:TCP"= 56738:TCP:BitComet 56738 TCP
"56738:UDP"= 56738:UDP:BitComet 56738 UDP
.
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [4/8/2007 11:38 PM 58464]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [8/30/2011 3:23 AM 122696]
R2 SSFMONM;ssfmonm;c:\windows\system32\drivers\ssfmonm.sys [8/30/2011 3:24 AM 45584]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\Security\Current\Framework\WRConsumerService.exe [9/13/2011 9:11 PM 3381184]
S2 timidity;FireDaemon Service: Timidity++;c:\program files\FireDaemon\FireDaemon.exe -s –> c:\program files\FireDaemon\FireDaemon.exe -s [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?]
S3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?]
S4 SCManager;SafeConnect Manager;c:\program files\SafeConnect\scManager.sys servicestart –> c:\program files\SafeConnect\scManager.sys servicestart [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/17/2010 11:33 PM 691696]
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4112088102-2527765215-2234832989-1006Core.job
- c:\documents and settings\ \Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-20 05:18]
.
2011-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4112088102-2527765215-2234832989-1006UA.job
- c:\documents and settings\ \Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-05-20 05:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.altavista.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: &D;&ownload; &with; BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D;&ownload; all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D;&ownload; all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Free YouTube Download - c:\documents and settings\ \Application Data\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\documents and settings\ \Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: Interfaces\{9C0C9BA6-1D51-4645-B58A-5D5D2448678C}: NameServer = 192.168.1.254
DPF: {C228AEDD-FC47-11D3-AF87-D128A9381404} - hxxp://www.link-systems.com/sdkhtml/SDK/paste/lsiw2k.cab
FF - ProfilePath - c:\documents and settings\ \Application Data\Mozilla\Firefox\Profiles\i8main9u.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-fIJsmsUwPvQ.exe - c:\documents and settings\All Users\Application Data\fIJsmsUwPvQ.exe
SafeBoot-WinDefend
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-04 15:54
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(564)
c:\windows\system32\EntApi.dll
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3484)
c:\windows\system32\WININET.dll
c:\windows\system32\EntApi.dll
c:\program files\Webroot\Security\Current\plugins\antispam\WRASHooks.dll
c:\program files\Webroot\Security\Current\plugins\antispam\AntiSpamInterface.dll
c:\program files\Webroot\Security\Current\plugins\antispam\WINSPAMCATCHER.dll
c:\program files\Webroot\Security\current\plugins\sync\WebRootShellExt.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\Mcshield.exe
c:\program files\Network Associates\VirusScan\VsTskMgr.exe
c:\program files\Network Associates\Common Framework\naPrdMgr.exe
c:\program files\Webroot\Security\current\plugins\antimalware\AEI.exe
c:\windows\system32\wscntfy.exe
c:\program files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe
c:\progra~1\Webroot\Security\Current\plugins\cleanup\WRCLEA~1.EXE
c:\program files\Webroot\Security\current\plugins\antimalware\SSU.EXE
.
**************************************************************************
.
Completion time: 2011-12-04 16:10:26 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-04 21:10
ComboFix2.txt 2011-12-03 04:47
ComboFix3.txt 2011-12-01 05:29
.
Pre-Run: 12,397,527,040 bytes free
Post-Run: 12,452,073,472 bytes free
.
- - End Of File - - D39A0D98D744C105106CE403F8375C92