Spyware / Malware / Virus Removal

spontaneous odd behaviours: voices, web pages... [Solved]

53 min read

Looking for the outcome? Ask AI

symbiosis7 Topic Starter

Post #1August 19, 2012, 10:14 PM UTC

hi! i've used WTT in the past for a few problems, and have reason to be grateful! right now i am getting the following oddd behaviours:

1. voices from ????, even when no browser window open. most sound like the tv show E! (entertainment news, movie stars, mansions, etc.).

2. clicking on legitimate links often takes me where i do not want to go (car adverts, taoofbadass.com, random stuff).

3. after a day of use, my computer runs very sloooooowly.

4. web pages launch spontaneously, usually in conjunction with clicking a link.

5. more virus warnings than usual (AVG) (downloading DDS.scr triggered a trojan horse warning).

here is the post from DDS.txt.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 15:07:37 on 2012-08-19
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.238 [GMT -7:00]
.
AV: AVG Anti-Virus *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
"C:\WINDOWS\System32\svchost.exe" -k LocalServiceDns
C:\WINDOWS\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
uWindow Title = Humboldt Internet
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.12\AVG Secure Search_toolbar.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.12\AVG Secure Search_toolbar.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Intel AppUp(SM) center] "c:\program files\intel\intelappstore\bin\serviceManager.lnk"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10m_ActiveX.exe -update activex
StartupFolder: c:\docume~1\t5a5e~1.car\startm~1\programs\startup\avgtra~1.lnk - c:\program files\avg\avg9\avgtray.exe
StartupFolder: c:\docume~1\t5a5e~1.car\startm~1\programs\startup\intern~1.lnk - c:\program files\internet explorer\iexplore.exe
StartupFolder: c:\docume~1\t5a5e~1.car\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\billmi~1.lnk - c:\quickenw\BILLMIND.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quicke~1.lnk - c:\quickenw\QWDLLS.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
LSP: mswsock.dll
Trusted Zone: intuit.com\ttlc
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{124E9C0C-7263-4DDD-A928-3A79B1179208} : DhcpNameServer = [removed] [removed]
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\11.2.0\ViProtocol.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-4-20 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-4-20 216400]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-1-5 29712]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-4-20 243152]
R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-6-24 308136]
R2 mrtRate;mrtRate;c:\windows\system32\drivers\MrtRate.sys [2004-11-29 34916]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-26 167264]
.
=============== Created Last 30 ================
.
2012-08-07 16:09:02 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09:02 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 16:09:02 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-08-07 06:07:17 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05:27 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05:27 ——– d—–w- c:\program files\common files\ODBC
2012-08-07 06:05:27 ——– d—–w- c:\documents and settings\all users\Microsoft
2012-08-07 06:03:13 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01:34 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00:41 ——– d—–w- c:\documents and settings\t. carlberg\local settings\application data\Microsoft Help
2012-07-22 22:14:46 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-22 22:14:46 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
.
==================== Find3M ====================
.
2012-07-06 13:58:51 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40:15 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49:33 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49:52 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50:25 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50:25 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32:08 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 22:19:44 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19:38 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19:38 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19:34 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19:30 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 13:22:09 599040 —-a-w- c:\windows\system32\crypt32.dll
2006-10-10 21:09:36 1053198 —-a-w- c:\program files\freemahjongg.exe
.
============= FINISH: 15:10:14.67 ===============

JonTom

Post #2August 19, 2012, 10:48 PM UTC

Hello symbiosis7 and

My name is JonTom

Malware Logs can sometimes take a lot of time to research and interpret.
Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

There is evidence of a very serious infection on this machine. If you use this machine for any kind of financial transaction please go to an uninfected computer and change all of your passwords as soon as you can.

It would also be very wise to back up all of your important data before we begin since if the infection cannot be cleaned, a reformat and reinstallation of the operating system will be the best course of action.

When you ran DDS two logs would have been produced. You have posted the DDS.txt but I also need to see the attach.txt log.

In addition, I would also like to see the logs from the following tools:

aswMBR
- Download aswMBR.exe to your desktop.
- Double click the aswMBR.exe to run it.
- When asked if you want to download Avast's virus definitions please select Yes.
- Click the "Scan" button to start scan.
[external image: Posted Image]
- On completion of the scan click save log, save it to your desktop and post in your next reply.
[external image: Posted Image]
MBRCheck
- Please download MBRCheck by clicking here and save it to your desktop.
- Be sure to disable your security programs.
- Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt).
- A window will open on your desktop.
- If an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
- If nothing unusual is found just press Enter.
- A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
- Please post the contents of that file in your next reply.
  
  Please post the DDS attach.txt log, the aswMBR log and the MBRCheck log in your next reply.

symbiosis7

Post #3August 20, 2012, 3:34 AM UTC

hi jontom, and thanks for your prompt response. the backup is in progress to an external drive - do i need to worry about backing up the infection, too? here are the three files: attach.txt, aswmbr.txt, mbrcheck_081920012. i put a lot of carriage returns between each. . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 11/29/2004 2:23:46 PM System Uptime: 8/19/2012 10:11:52 AM (5 hours ago) . Motherboard: Dell Inc. | | 0M3918 Processor: Intel® Pentium® 4 CPU 3.00GHz | Microprocessor | 2992/800mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 71 GiB total, 9.281 GiB free. D: is CDROM () E: is CDROM () F: is FIXED (NTFS) - 1863 GiB total, 1377.01 GiB free. . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . . Adobe AIR Adobe Flash Player 11 ActiveX Adobe Reader 9.4.1 Apple Application Support ArcSoft Software Suite ArcView GIS 3.2 AVG 9.0 Bejeweled 2 Deluxe Bonjour Conexant D850 56K V.9x DFVc Modem Critical Update for Windows Media Player 11 (KB959772) DAO 3.5 Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Dell Driver Reset Tool Dell Media Experience Dell ResourceCD Dell Support 5.0.0 (630) Dell System Restore Digital Line Detect ER Mapper imagery plugin for ArcView® 3.1 Onwards v2.4 ERUNT 1.1j ESRI ArcPad 7.0.1 FileZilla (remove only) Garmin TOPO U.S. 2008 Glucofacts Deluxe Updater 2.0 Google Earth Google Update Helper GoToMeeting 5.1.0.880 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) hp deskjet 990c series (Remove only) HyperNiche v.1 beta Intel AppUp(SM) center Intel® Graphics Media Accelerator Driver Intel® PRO Network Adapters and Drivers Intel® PROSet for Wired Connections Internet Explorer Default Page iTunes Java Auto Updater Java™ 6 Update 29 Learn2 Player (Uninstall Only) LG USB Modem Driver Malwarebytes' Anti-Malware version 1.51.2.1300 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB2656370) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft ActiveSync Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2000 Premium Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Plus! Digital Media Edition Installer Microsoft Software Update for Web Folders (English) 14 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Modem Helper MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) NetWaiting OpenOffice.org 3.2 Personal Ancestral File 5 PowerDVD 5.3 Quicken Basic 2000 Quicken Lawyer 2003 Personal QuickTime Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2553431) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589337) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition Security Update for Microsoft Windows (KB2564958) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB2183461) Security Update for Windows Internet Explorer 7 (KB2360131) Security Update for Windows Internet Explorer 7 (KB2416400) Security Update for Windows Internet Explorer 7 (KB2482017) Security Update for Windows Internet Explorer 7 (KB2497640) Security Update for Windows Internet Explorer 7 (KB2530548) Security Update for Windows Internet Explorer 7 (KB2544521) Security Update for Windows Internet Explorer 7 (KB2586448) Security Update for Windows Internet Explorer 7 (KB2618444) Security Update for Windows Internet Explorer 7 (KB2647516) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Internet Explorer 7 (KB978207) Security Update for Windows Internet Explorer 7 (KB982381) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2647516) Security Update for Windows Internet Explorer 8 (KB2675157) Security Update for Windows Internet Explorer 8 (KB2699988) Security Update for Windows Internet Explorer 8 (KB2722913) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2296199) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2436673) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2621440) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2641653) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2647518) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2655992) Security Update for Windows XP (KB2659262) Security Update for Windows XP (KB2660465) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB2685939) Security Update for Windows XP (KB2686509) Security Update for Windows XP (KB2691442) Security Update for Windows XP (KB2695962) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2705219) Security Update for Windows XP (KB2707511) Security Update for Windows XP (KB2709162) Security Update for Windows XP (KB2712808) Security Update for Windows XP (KB2718523) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2723135) Security Update for Windows XP (KB2731847) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) Skype™ 3.6 Sonic DLA Sonic RecordNow! Sonic Update Manager TurboTax 2009 TurboTax 2009 WinPerFedFormset TurboTax 2009 WinPerReleaseEngine TurboTax 2009 WinPerTaxSupport TurboTax 2009 wrapper TurboTax 2011 TurboTax 2011 wcaiper TurboTax 2011 WinPerFedFormset TurboTax 2011 WinPerReleaseEngine TurboTax 2011 WinPerTaxSupport TurboTax 2011 wrapper Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Update for Windows Internet Explorer 7 (KB976749) Update for Windows Internet Explorer 7 (KB980182) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2541763) Update for Windows XP (KB2641690) Update for Windows XP (KB2718704) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Usnscsvr WD Diagnostics WD FAT32 Formatter WD Firewire HID Driver WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver WinZip WordPerfect Office 12 . ==== Event Viewer Messages From Past Week ======== . 8/19/2012 3:05:29 PM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. . ==== End Of File =========================== aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-19 19:03:00 —————————– 19:03:00.781 OS Version: Windows 5.1.2600 Service Pack 3 19:03:00.781 Number of processors: 2 586 0x304 19:03:01.250 ComputerName: MAIN UserName: 19:03:14.765 Initialize success 19:07:27.718 AVAST engine defs: 12081900 19:08:09.484 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 19:08:09.484 Disk 0 Vendor: WDC_WD800JD-75HKA1 14.03G14 Size: 76293MB BusType: 3 19:08:09.484 Device \Driver\atapi -> DriverStartIo 86a842e2 19:08:09.500 Disk 0 MBR read successfully 19:08:09.500 Disk 0 MBR scan 19:08:10.203 Disk 0 unknown MBR code 19:08:10.203 Disk 0 MBR hidden 19:08:10.265 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 31 MB offset 63 19:08:10.359 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 72669 MB offset 64260 19:08:10.406 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 3584 MB offset 148890420 19:08:10.562 Disk 0 scanning sectors +156232125 19:08:10.890 Disk 0 scanning C:\WINDOWS\system32\drivers 19:10:52.703 Service scanning 19:13:21.234 Modules scanning 19:15:07.187 Disk 0 trace - called modules: 19:15:07.203 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86a844b1]<< 19:15:07.203 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86fd1ab8] 19:15:07.203 3 CLASSPNP.SYS[f774dfd7] -> nt!IofCallDriver -> [0x86b1ff18] 19:15:07.203 \Driver\atapi[0x86aa2ac8] -> IRP_MJ_CREATE -> 0x86a844b1 19:16:10.125 AVAST engine scan C:\WINDOWS 19:22:24.281 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat" 19:22:24.359 The log file has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\aswMBR.txt" MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000003d Kernel Drivers (total 178): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x80700000 \WINDOWS\system32\hal.dll 0x86990000 \WINDOWS\system32\KDCOM.DLL 0xF7AA1000 \WINDOWS\system32\BOOTVID.dll 0xF763E000 ACPI.sys 0xF7B8D000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF762D000 pci.sys 0xF768D000 isapnp.sys 0xF7C55000 pciide.sys 0xF790D000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF7B8F000 aliide.sys 0xF7B91000 cmdide.sys 0xF7B93000 toside.sys 0xF7B95000 viaide.sys 0xF7B97000 intelide.sys 0xF769D000 MountMgr.sys 0xF760E000 ftdisk.sys 0xF7915000 PartMgr.sys 0xF76AD000 VolSnap.sys 0xF7AA5000 cpqarray.sys 0xF75F6000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS 0xF75DE000 atapi.sys 0xF7AA9000 aha154x.sys 0xF791D000 sparrow.sys 0xF7AAD000 symc810.sys 0xF76BD000 aic78xx.sys 0xF7AB1000 dac960nt.sys 0xF76CD000 ql10wnt.sys 0xF7AB5000 amsint.sys 0xF7925000 asc.sys 0xF7AB9000 asc3550.sys 0xF792D000 mraid35x.sys 0xF7935000 i2omp.sys 0xF7ABD000 ini910u.sys 0xF76DD000 ql1240.sys 0xF76ED000 aic78u2.sys 0xF793D000 symc8xx.sys 0xF7945000 sym_hi.sys 0xF794D000 sym_u3.sys 0xF7955000 ABP480N5.SYS 0xF795D000 asc3350p.sys 0xF7B99000 cd20xrnt.sys 0xF76FD000 ultra.sys 0xF75C5000 adpu160m.sys 0xF7965000 dpti2o.sys 0xF770D000 ql1080.sys 0xF771D000 ql1280.sys 0xF772D000 ql12160.sys 0xF796D000 perc2.sys 0xF7B9B000 perc2hib.sys 0xF7975000 hpn.sys 0xF7AC1000 cbidf2k.sys 0xF7599000 dac2w2k.sys 0xF773D000 disk.sys 0xF774D000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF7579000 fltmgr.sys 0xF7564000 drvmcdb.sys 0xF775D000 PxHelp20.sys 0xF754D000 KSecDD.sys 0xF74C0000 Ntfs.sys 0xF7493000 NDIS.sys 0xF776D000 sisagp.sys 0xF777D000 viaagp.sys 0xF7479000 Mup.sys 0xF778D000 avgrkx86.sys 0xF779D000 agp440.sys 0xF77AD000 alim1541.sys 0xF77BD000 amdagp.sys 0xF77CD000 agpCPQ.sys 0xF7429000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xF6CF3000 \SystemRoot\system32\DRIVERS\ialmnt5.sys 0xF6CDF000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF79D5000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF6CBB000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF79DD000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF6C87000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys 0xF6C64000 \SystemRoot\system32\DRIVERS\ks.sys 0xF6B65000 \SystemRoot\system32\DRIVERS\HSF_DP.sys 0xF6ABE000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys 0xF79E5000 \SystemRoot\System32\Drivers\Modem.SYS 0xF6A98000 \SystemRoot\system32\DRIVERS\e100b325.sys 0xF6A02000 \SystemRoot\system32\drivers\smwdm.sys 0xF69DE000 \SystemRoot\system32\drivers\portcls.sys 0xF7409000 \SystemRoot\system32\drivers\drmk.sys 0xF7BC9000 \SystemRoot\system32\drivers\aeaudio.sys 0xF79ED000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF73F9000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF79F5000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF79FD000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF69CA000 \SystemRoot\system32\DRIVERS\parport.sys 0xF73E9000 \SystemRoot\system32\DRIVERS\serial.sys 0xF73B5000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF73B1000 \SystemRoot\system32\drivers\pfc.sys 0xF7BCB000 \SystemRoot\system32\drivers\sscdbhk5.sys 0xF73D9000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF77ED000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF7A05000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys 0xF6EC2000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF7CF1000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF6EB2000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF73A5000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF69B3000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF6EA2000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF6E92000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF7A0D000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF69A2000 \SystemRoot\system32\DRIVERS\psched.sys 0xF6E82000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF7A15000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF7A1D000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF6E72000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF7BCF000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF6944000 \SystemRoot\system32\DRIVERS\update.sys 0xF7399000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF7A25000 \SystemRoot\system32\DRIVERS\omci.sys 0xF6E52000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF6E42000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF7BD1000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF7364000 \SystemRoot\system32\drivers\MODEMCSA.sys 0xF7A3D000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF7B41000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xF7A45000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xF7BD5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7CE8000 \SystemRoot\System32\Drivers\Null.SYS 0xF7BD7000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7A55000 \SystemRoot\system32\drivers\ssrtln.sys 0xF7A5D000 \SystemRoot\System32\drivers\vga.sys 0xF7BD9000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7BDB000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7A65000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7A6D000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7B49000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xAA6ED000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xAA694000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xAA65A000 \SystemRoot\System32\Drivers\avgtdix.sys 0xF780D000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xAA632000 \SystemRoot\system32\DRIVERS\netbt.sys 0xAA610000 \SystemRoot\System32\drivers\afd.sys 0xF781D000 \SystemRoot\system32\DRIVERS\netbios.sys 0xAA545000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xAA4D5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF782D000 \SystemRoot\System32\Drivers\Fips.SYS 0xF7A7D000 \SystemRoot\System32\Drivers\avgmfx86.sys 0xAA4A1000 \SystemRoot\System32\Drivers\avgldx86.sys 0xF784D000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xAA461000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7BDF000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xAA7A8000 \SystemRoot\System32\drivers\Dxapi.sys 0xF7A95000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7CE4000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF020000 \SystemRoot\System32\ialmdnt5.dll 0xBF012000 \SystemRoot\System32\ialmrnt5.dll 0xBF042000 \SystemRoot\System32\ialmdev5.DLL 0xBF077000 \SystemRoot\System32\ialmdd5.DLL 0xBF15A000 \SystemRoot\System32\ATMFD.DLL 0xF7459000 \SystemRoot\system32\drivers\drvnddm.sys 0xF7DA9000 \SystemRoot\system32\dla\tfsndres.sys 0xAA30B000 \SystemRoot\system32\dla\tfsnifs.sys 0xAA395000 \SystemRoot\system32\dla\tfsnopio.sys 0xF7BF1000 \SystemRoot\system32\dla\tfsnpool.sys 0xF799D000 \SystemRoot\system32\dla\tfsnboio.sys 0xF7439000 \SystemRoot\system32\dla\tfsncofs.sys 0xF7DAD000 \SystemRoot\system32\dla\tfsndrct.sys 0xAA2F2000 \SystemRoot\system32\dla\tfsnudf.sys 0xAA2D9000 \SystemRoot\system32\dla\tfsnudfa.sys 0xAA2CD000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xA9F54000 \SystemRoot\system32\drivers\wdmaud.sys 0xAA3A9000 \SystemRoot\system32\drivers\sysaudio.sys 0xA9D19000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xA98E5000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xA95A7000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xA9627000 \SystemRoot\System32\Drivers\mrtRate.SYS 0xA94FB000 \SystemRoot\system32\DRIVERS\srv.sys 0xA9302000 \SystemRoot\System32\Drivers\HTTP.sys 0xA83D2000 \SystemRoot\system32\drivers\kmixer.sys 0xA8616000 \??\C:\DOCUME~1\T5A5E~1.CAR\LOCALS~1\Temp\aswMBR.sys 0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll Processes (total 50): 0 System Idle Process 4 System 572 C:\WINDOWS\SYSTEM32\smss.exe 620 csrss.exe 644 C:\WINDOWS\SYSTEM32\winlogon.exe 692 C:\WINDOWS\SYSTEM32\services.exe 704 C:\WINDOWS\SYSTEM32\lsass.exe 916 C:\WINDOWS\SYSTEM32\svchost.exe 1012 svchost.exe 1124 C:\WINDOWS\SYSTEM32\svchost.exe 1180 C:\Program Files\AVG\AVG9\avgchsvx.exe 1192 C:\Program Files\AVG\AVG9\avgrsx.exe 1280 svchost.exe 1388 svchost.exe 1540 C:\WINDOWS\explorer.exe 1588 C:\Program Files\AVG\AVG9\avgcsrvx.exe 1672 C:\WINDOWS\SYSTEM32\spoolsv.exe 1400 svchost.exe 1596 C:\Program Files\Dell\Media Experience\PCMService.exe 1600 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe 1688 C:\WINDOWS\SYSTEM32\dla\tfswctrl.exe 1744 C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb01.exe 1920 C:\WINDOWS\SYSTEM32\hkcmd.exe 1928 C:\WINDOWS\SYSTEM32\igfxpers.exe 1988 C:\Program Files\iTunes\iTunesHelper.exe 2044 C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe 148 C:\Program Files\AVG Secure Search\vprot.exe 216 C:\Program Files\Microsoft ActiveSync\wcescomm.exe 224 C:\WINDOWS\SYSTEM32\ctfmon.exe 244 C:\Program Files\Digital Line Detect\DLG.exe 288 C:\QUICKENW\QWDLLS.EXE 300 C:\Program Files\AVG\AVG9\avgtray.exe 320 C:\Program Files\Internet Explorer\iexplore.exe 408 C:\Program Files\AVG\AVG9\avgwdsvc.exe 1236 C:\Program Files\OpenOffice.org 3\program\soffice.exe 1736 C:\PROGRA~1\MI3AA1~1\rapimgr.exe 1460 C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe 2124 C:\Program Files\OpenOffice.org 3\program\soffice.bin 2260 C:\Program Files\AVG\AVG9\avgam.exe 2304 C:\Program Files\AVG\AVG9\avgnsx.exe 2884 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe 3064 C:\Program Files\Java\jre6\bin\jqs.exe 3320 C:\WINDOWS\SYSTEM32\svchost.exe 3432 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe 3640 C:\Program Files\iPod\bin\iPodService.exe 376 C:\Program Files\Internet Explorer\iexplore.exe 1252 C:\Program Files\AVG\AVG9\avgcsrvx.exe 3704 C:\Program Files\Internet Explorer\iexplore.exe 3944 C:\I386\SPIDER.EXE 2136 C:\Documents and Settings\T. Carlberg\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS) \\.\F: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD800JD-75HKA1, Rev: 14.03G14 PhysicalDrive1 Model Number: SeagateGoFlex Desk, Rev: 0D19 Size Device Name MBR Status ——————————————– 74 GB \\.\PhysicalDrive0 Dell MBR code detected SHA1: 84B95CE8A54B7C5C3AAF149934FC46FB70FF8365 1863 GB \\.\PhysicalDrive1 RE: Unknown MBR code SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!

JonTom

Post #4August 20, 2012, 7:19 AM UTC

Hello symbiosis7

Thank you for the logs.

the backup is in progress to an external drive - do i need to worry about backing up the infection, too?

We can't rule it out 100%, but better to have the backups than nothing at all at this point.

Lets proceed as follows:

Combofix
Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Should there be issues with internet afterward:

In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.

symbiosis7

Post #5August 21, 2012, 4:09 AM UTC

hi jontom - a couple variations from your instructions…

1. avg 9.0 resident sheld disabled, but combofix still saw it as active (avg website does not provide info for any further disabling).
2. combofix could not download files for microsoft console ("download failed"). combofix still offered to scan computer, so i said "OK". log follows.

ComboFix 12-08-20.02 - T. Carlberg 08/20/2012 20:31:39.7.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.549 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\T. Carlberg\g2mdlhlpx.exe
c:\documents and settings\T. Carlberg\WINDOWS
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\@
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L\00000004.@
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L\201d3dde
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\00000004.@
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\00000008.@
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\000000cb.@
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000000.@
c:\windows\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\52a8b6ee7c453e29.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\84719704d11b39d0.fb
c:\windows\system32\Cache\8da560b8b1e03737.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d4a870cf66b25df4.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\FUSION.DLL
c:\windows\system32\URTTemp\MSCOREE.DLL
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\MSCORSN.DLL
c:\windows\system32\URTTemp\MSCORWKS.DLL
c:\windows\system32\URTTemp\MSVCR71.DLL
c:\windows\system32\URTTemp\REGTLIB.EXE
F:\Autorun.inf
F:\Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-07-21 to 2012-08-21 )))))))))))))))))))))))))))))))
.
.
2012-08-20 01:46 . 2012-08-20 01:46 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-08-07 16:09 . 2012-06-02 22:18 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09 . 2012-06-02 22:18 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 06:07 . 2012-08-07 06:07 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft Sync Framework
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\documents and settings\All Users\Microsoft
2012-08-07 06:03 . 2012-08-07 06:03 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01 . 2012-08-07 06:01 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00 . 2012-08-07 06:00 ——– d—–w- c:\documents and settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
2012-08-07 06:00 . 2012-08-16 06:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2012-08-07 05:59 . 2012-08-07 05:59 ——– d—–r- C:\MSOCache
2012-07-22 22:14 . 2012-08-01 01:20 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-22 22:14 . 2012-08-01 01:20 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-06 13:58 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 11:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2004-08-04 11:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 11:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 11:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49 . 2012-06-06 15:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50 . 2008-10-19 04:34 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 11:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 11:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 22:19 . 2007-06-08 01:05 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19 . 2004-08-04 11:00 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 22:19 . 2004-08-04 11:00 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19 . 2004-08-04 11:00 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19 . 2005-05-26 11:16 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2004-11-30 05:43 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2004-08-04 11:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 22:19 . 2004-08-04 11:00 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2007-06-08 01:05 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 22:19 . 2004-08-04 11:00 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2004-08-04 11:00 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2004-08-04 11:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2006-10-10 21:09 . 2006-10-10 21:09 1053198 —-a-w- c:\program files\freemahjongg.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 02:44 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-07 192512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-04-13 933]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
c:\documents and settings\T. Carlberg\Start Menu\Programs\Startup\
AVG Tray Icon.lnk - c:\program files\AVG\AVG9\avgtray.exe [2010-6-24 2077536]
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2004-11-29 36864]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-18 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2004-11-29 36864]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-24 23:12 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Themes"=2 (0x2)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"helpsvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [4/20/2008 4:20 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [4/20/2008 4:20 PM 216400]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [4/20/2008 4:20 PM 243152]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/24/2010 4:12 PM 308136]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [11/29/2004 6:18 PM 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [7/9/2012 7:44 PM 935008]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 11:22 AM 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
*NewlyCreated* - WUAUSERV
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10m_ActiveX.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-20 20:54
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800JD-75HKA1 rev.14.03G14 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
.
device: opened successfully
user: MBR read successfully
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x86BC42E2
user & kernel MBR OK
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'lsass.exe'(704)
c:\windows\system32\WININET.dll
.
Completion time: 2012-08-20 21:00:50
ComboFix-quarantined-files.txt 2012-08-21 04:00
.
Pre-Run: 10,106,302,464 bytes free
Post-Run: 11,296,346,112 bytes free
.
- - End Of File - - BF0B5DD972B293BDBDAD24946FFF1CCD

JonTom

Post #6August 21, 2012, 10:44 AM UTC

Hello symbiosis7

Thank you for the log and extra information. If AVG gives you any problems it may have to be temporarily uninstalled.

The following tool may present you with the option to fix what has been detected.

At this time please do not have it fix anything. Once I have reviewed the log produced we will decide on a course of action.

TDSS Killer
Please read carefully and follow these steps.
Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and Right click on TDSSKiller.exe and select "Run as Administrator" to run the application.
When the window opens, click on Change Parameters.
Under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”.
Click on Start Scan.
If an infected file is detected, the default action will be Cure, click on SKIP.
If a suspicious file is detected, the default action will be SKIP, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt".
Please copy and paste the contents of that file here.

symbiosis7

Post #7August 22, 2012, 2:44 AM UTC

thanks for the current series of steps, however there were several problems, and TDSSkiller has not run properly: 1. i don't have an option to run as administrator - no user profile exists with that name 2. running it as "current user" resulted in a. "warning - can't initialize log" and b. "error - can't load driver" during the load process 3. the program loaded. i changed the parameters according to instructions, then clicked "scan". the program ran for about 1/10 second and reported no problems. no log was created.

JonTom

Post #8August 22, 2012, 10:44 AM UTC

Hello symbiosis7

Sorry to hear you are having problems with TDSSKiller. This is most likely occuring due to malware interference.

Lets see if we can get TDSSKiller to run from Safe Mode:

Reboot Your System in Safe Mode
- Restart your computer.
- As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
- Use the arrow keys to select the Safe mode menu item.
- Press Enter.
Once in safe Mode run TDSSKiller as described (just double click on the icon, no need to run as administrator).

If the scan is able to complete this time, save the log then boot back into normal mode and post it here for me to review.

If the scan does not complete (or if it runs very quickly again and reports nothing found without producing a log) boot back into normal mode and continue with the following scans:
Please scan your system with GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
- Extract the contents of the zipped file to desktop.
- Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
- If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
- In the right panel, you will see several boxes that have been checked. Uncheck the following …
  - IAT/EAT
  - Drives/Partition other than Systemdrive (typically C:\)
  - Show All (don't miss this one)
- Then click the Scan button & wait for it to finish.
- Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
- Save it where you can easily find it, such as your desktop, and post it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOTKIT" entries

Please post the GMER log in your next reply. If you encounter any problems with the scan come back and let me know.
DDS
- Please re-scan with DDS and post the dds.txt log in your next reply (there is no need to post the attach.txt log this time).

symbiosis7

Post #9August 23, 2012, 4:29 AM UTC

hi jontom - TDSS never did work right. in safe mode this morning it hung my computer after reporting (onscreen, not in a log) "rootkit.bcot.pihar.c" and reporting itself. i had to do a hard reboot. safe mode would not work after that, nor would booting normally. then i had to go to work. when i got back it was still hung up.

i tried a hard reboot again, and things booted ~normally . i ran GMER according to your instructions (IAT/EAT and show all unchecked, scan only C:) and DDS without incident.

currently i am not picking up oprah/E! anymore, and spontaneous browser windows are not opening, however, still getting security alerts (avg is still turned off but not uninstalled), and all things run slowly. actually, launching programs and switching windows is slow; as far as i can tell, the diagnostics you have me use are running at normal speed.

that's all for tonight.
tom

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-08-22 20:14:39
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort1 WDC_WD800JD-75HKA1 rev.14.03G14
Running: gmer.exe; Driver: C:\DOCUME~1\T5A5E~1.CAR\LOCALS~1\Temp\pxtdypog.sys

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E7217 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7149 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E701A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E707C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E727A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[328] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E70DE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AB5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E7217 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7149 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E701A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E707C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E727A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E70DE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[400] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E757F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\system32\svchost.exe[1128] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 001A3E39
.text C:\WINDOWS\system32\svchost.exe[1128] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 001A47A7
.text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 001A47F6
.text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 001A4856
.text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!IsWindowVisible 7E429E3D 5 Bytes JMP 001A487D
.text C:\WINDOWS\system32\svchost.exe[1128] USER32.dll!MessageBoxIndirectW 7E4664D5 6 Bytes [33, C0, 40, C2, 04, 00] {XOR EAX, EAX; INC EAX; RET 0x4}
.text C:\WINDOWS\system32\svchost.exe[1128] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 001A4974
.text C:\WINDOWS\system32\svchost.exe[1128] ole32.dll!CoGetClassObject 77515205 5 Bytes JMP 001A494A
.text C:\WINDOWS\system32\svchost.exe[1128] WS2_32.dll!GetAddrInfoW 71AB2899 5 Bytes JMP 001A4743
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AB5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E7217 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7149 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E701A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E707C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E727A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E70DE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3232] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E757F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 86A852E2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 86A852E2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-4 86A852E2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T1L0-c 86A852E2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-17 86A852E2

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ACDMII3A\fastbutton[1].txt 11411 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\DV390G7Z\26425_t_c_t_c_clickpayz_com[1].htm 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\DV390G7Z\gossipcenter[1].txt 2249 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GG085WKH\detect[1].js 267 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GG085WKH\imp[1].js 2877 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GG085WKH\StayYou300x250[1].swf 39269 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GG085WKH\1[1].xml 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\LQ81HO3Y\salma-hayek-081612-%20(8)[1].jpg 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\call_gp_avazu[1].js 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\if[3].txt 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\jsadimpCA0I99JI.gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\jsadimpCAA71VZG.gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\jsadimpCAH3Y65I.gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\jsadimpCAPAJ0X0.gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\jsadimpCAZHKKJB.gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\checkOAuth[1].esi 22 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\christian-bale-011411-4[1].jpg 5299 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PNN941B1\JS[1].htm 942 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QC1B0TEX\tr-clk[1].js 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QC1B0TEX\transparent[1].gif 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QC1B0TEX\afr[1].htm 4 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QC1B0TEX\afe2_specificclick_net[1].txt 2 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\SN1VE264\81ffc999-0691-4ea1-b778-eefc82726655[1].txt 2383 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\SN1VE264\pc[1] 43 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\SN1VE264\syncuppixels[1].html 16067 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ZRGS2P3T\pd[1].htm 4 bytes

—- EOF - GMER 1.0.15 —-

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 20:15:07 on 2012-08-22
.
============== Running Processes ===============
.
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\T. Carlberg\Desktop\dds.scr
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.12\AVG Secure Search_toolbar.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.12\AVG Secure Search_toolbar.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Intel AppUp(SM) center] "c:\program files\intel\intelappstore\bin\serviceManager.lnk"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
Trusted Zone: intuit.com\ttlc
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{124E9C0C-7263-4DDD-A928-3A79B1179208} : DhcpNameServer = [removed] [removed]
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\11.2.0\ViProtocol.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R? AVG Security Toolbar Service;AVG Security Toolbar Service
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? gupdate;Google Update Service (gupdate)
R? gupdatem;Google Update Service (gupdatem)
R? Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service
R? osppsvc;Office Software Protection Platform
R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
S? avg9wd;AVG WatchDog
S? AvgLdx86;AVG AVI Loader Driver x86
S? AvgMfx86;AVG On-access Scanner Minifilter Driver x86
S? AvgRkx86;avgrkx86.sys
S? AvgTdiX;AVG8 Network Redirector
S? IntuitUpdateServiceV4;Intuit Update Service v4
S? mrtRate;mrtRate
S? vToolbarUpdater11.2.0;vToolbarUpdater11.2.0
.
=============== Created Last 30 ================
.
2012-08-21 03:25:18 98816 —-a-w- c:\windows\sed.exe
2012-08-21 03:25:18 518144 —-a-w- c:\windows\SWREG.exe
2012-08-21 03:25:18 256000 —-a-w- c:\windows\PEV.exe
2012-08-21 03:25:18 208896 —-a-w- c:\windows\MBR.exe
2012-08-07 16:09:02 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09:02 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 16:09:02 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-08-07 06:07:17 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05:27 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05:27 ——– d—–w- c:\program files\common files\ODBC
2012-08-07 06:05:27 ——– d—–w- c:\documents and settings\all users\Microsoft
2012-08-07 06:03:13 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01:34 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00:41 ——– d—–w- c:\documents and settings\t. carlberg\local settings\application data\Microsoft Help
.
==================== Find3M ====================
.
2012-08-01 01:20:19 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20:19 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58:51 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40:15 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49:33 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49:52 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50:25 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50:25 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32:08 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 22:19:44 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19:38 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19:38 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19:34 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19:30 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 13:22:09 599040 —-a-w- c:\windows\system32\crypt32.dll
2006-10-10 21:09:36 1053198 —-a-w- c:\program files\freemahjongg.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800JD-75HKA1 rev.14.03G14 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86A854B1]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x86a8c93c]; MOV EAX, [0x86a8cab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x86F49AB8]
3 CLASSPNP[0xF774DFD7] -> nt!IofCallDriver[0x804E13B9] -> [0x86AD4030]
\Driver\atapi[0x86E96A20] -> IRP_MJ_CREATE -> 0x86A854B1
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { CLI ; MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; STI ; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62f; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x86A852E2
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 20:17:34.85 ===============

JonTom

Post #10August 23, 2012, 10:59 AM UTC

Hello symbiosis7

after reporting (onscreen, not in a log) "rootkit.bcot.pihar.c" and reporting itself

Thank you for posting this information (very helpful).

Lets try renaming TDSSKiller before we try anything else:

Please make sure file extensions are Visible:
- Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
- Uncheck the "Hide extensions for known file types" box.
- Close the window with "OK".
Once you have done that, Right click on the TDSSKiller icon and select Rename. Rename the file to jontom.com

Try the renamed TDSSKiller again. If a log is created, stop here and post the log in your next reply.

===

If TDSSKiller still gives you problems please do the following:

When you ran aswMBR, a file called MBR.dat was placed on your desktop (full path to file is C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat).

Right click on the file (MBR.dat) and select Send to > Compressed (zipped folder). The file will be placed in a zipped folder on your desktop.

Please attach the zipped file and post it in your next reply.

Once attached and posted, please work your way through the steps below:
ListParts
- Download ListParts by clicking here and save it to your desktop.
- Double click the ListParts icon to open, click on "Scan" and post the log (Result.txt) created.
  [external image: Posted Image]
xPUD

We will need a USB stick and access to an uninfected machine.

We need to prepare the USB stick. It is not absolutely essential that it is formatted, but it may help if it is:
- Insert your USB drive ino the uninfected machine.
- Click on Start > My Computer > right click your USB drive > choose Format > Quick format.
Next
- Please use Firefox to download each required tool (Internet Explorer can sometimes encounter problems).
- Download both http://sourceforge.net/projects/unetbootin…87.exe/download and http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of the uninfected machine.
- Make sure you have the formatted USB stick in the uninfected system.
- Double click on the unetbootin-xpud-windows-387.exe that you just downloaded.
- Press Run and then OK.
- Select the DiskImage option then click the browse button located on the right side of the textbox field.
- Browse to and select the xpud-0.9.2.iso file you downloaded.
- Verify the correct drive letter is selected for your USB device then click OK.
- It will install a little bootable OS on your USB device
- After it has completed do not choose to reboot the clean computer, simply close the installer.
Next
- Use the clean computer to download dumpit from the following link: http://noahdfear.net/downloads/dumpit
- Once dumpit is downloaded save it to the USB stick.
Next
- Take the USB to the infected computer and boot with it.
- The computer must be set to boot from the USB (as soon as BIOS is loaded tap F12 and choose to boot from the USB drive).
- A Welcome to xPUD screen will appear.
- Press File.
- Expand mnt.
- sda1,2…usually corresponds to your HDD.
- sdb1 is likely your USB drive.
- Click on the folder that represents your USB drive (sdb1 ?).
- Confirm that you see dumpit that you downloaded there.
- Double click on dumpit.
- Once completed, a file called mbr.zip will be saved to the USB drive.
- Take the USB drive back to the uninfected system and attach the mbr.zip in your next reply.
Please post the TDSSKiller log (if the tool is able to run), or the additional files and logs requested in your next reply.

symbiosis7

Post #11August 24, 2012, 1:26 AM UTC

hi jontom - TDSSK worked this time - no failures while loading. i'm glad - your subsequent instructions were extensive. here's the log: 18:19:12.0484 4012 TDSS rootkit removing tool [removed] Aug 20 2012 17:30:03 18:19:13.0000 4012 ============================================================ 18:19:13.0000 4012 Current date / time: 2012/08/23 18:19:13.0000 18:19:13.0000 4012 SystemInfo: 18:19:13.0000 4012 18:19:13.0000 4012 OS Version: 5.1.2600 ServicePack: 3.0 18:19:13.0000 4012 Product type: Workstation 18:19:13.0000 4012 ComputerName: MAIN 18:19:13.0000 4012 UserName: T. Carlberg 18:19:13.0000 4012 Windows directory: C:\WINDOWS 18:19:13.0000 4012 System windows directory: C:\WINDOWS 18:19:13.0000 4012 Processor architecture: Intel x86 18:19:13.0000 4012 Number of processors: 2 18:19:13.0000 4012 Page size: 0x1000 18:19:13.0000 4012 Boot type: Normal boot 18:19:13.0000 4012 ============================================================ 18:19:15.0781 4012 Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 18:19:15.0828 4012 Drive \Device\Harddisk1\DR4 - Size: 0x1D1C1115E00 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 18:19:16.0109 4012 ============================================================ 18:19:16.0109 4012 \Device\Harddisk0\DR0: 18:19:16.0109 4012 MBR partitions: 18:19:16.0109 4012 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xFB04, BlocksNum 0x8DEE830 18:19:16.0109 4012 \Device\Harddisk1\DR4: 18:19:16.0109 4012 MBR partitions: 18:19:16.0109 4012 \Device\Harddisk1\DR4\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE8E074C1 18:19:16.0109 4012 ============================================================ 18:19:16.0140 4012 C: <-> \Device\Harddisk0\DR0\Partition1 18:19:16.0156 4012 F: <-> \Device\Harddisk1\DR4\Partition1 18:19:16.0156 4012 ============================================================ 18:19:16.0156 4012 Initialize success 18:19:16.0156 4012 ============================================================ 18:20:36.0656 3284 ============================================================ 18:20:36.0656 3284 Scan started 18:20:36.0656 3284 Mode: Manual; TDLFS; 18:20:36.0656 3284 ============================================================ 18:20:41.0468 3284 ================ Scan system memory ======================== 18:20:41.0484 3284 System memory - ok 18:20:41.0484 3284 ================ Scan services ============================= 18:20:41.0609 3284 Abiosdsk - ok 18:20:41.0656 3284 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS 18:20:41.0656 3284 abp480n5 - ok 18:20:41.0703 3284 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 18:20:41.0703 3284 ACPI - ok 18:20:41.0734 3284 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 18:20:41.0734 3284 ACPIEC - ok 18:20:41.0796 3284 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys 18:20:41.0796 3284 adpu160m - ok 18:20:41.0843 3284 [ 11C04B17ED2ABBB4833694BCD644AC90 ] aeaudio C:\WINDOWS\system32\drivers\aeaudio.sys 18:20:41.0843 3284 aeaudio - ok 18:20:41.0890 3284 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 18:20:41.0890 3284 aec - ok 18:20:41.0953 3284 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 18:20:41.0953 3284 AFD - ok 18:20:41.0984 3284 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys 18:20:41.0984 3284 agp440 - ok 18:20:42.0031 3284 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys 18:20:42.0031 3284 agpCPQ - ok 18:20:42.0062 3284 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys 18:20:42.0062 3284 Aha154x - ok 18:20:42.0078 3284 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys 18:20:42.0078 3284 aic78u2 - ok 18:20:42.0093 3284 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys 18:20:42.0093 3284 aic78xx - ok 18:20:42.0187 3284 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 18:20:42.0187 3284 Alerter - ok 18:20:42.0203 3284 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 18:20:42.0203 3284 ALG - ok 18:20:42.0203 3284 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys 18:20:42.0203 3284 AliIde - ok 18:20:42.0218 3284 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys 18:20:42.0218 3284 alim1541 - ok 18:20:42.0250 3284 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys 18:20:42.0250 3284 amdagp - ok 18:20:42.0265 3284 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys 18:20:42.0265 3284 amsint - ok 18:20:42.0265 3284 AppMgmt - ok 18:20:42.0281 3284 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys 18:20:42.0281 3284 asc - ok 18:20:42.0296 3284 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys 18:20:42.0296 3284 asc3350p - ok 18:20:42.0296 3284 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys 18:20:42.0296 3284 asc3550 - ok 18:20:42.0453 3284 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 18:20:42.0484 3284 aspnet_state - ok 18:20:42.0515 3284 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 18:20:42.0546 3284 AsyncMac - ok 18:20:42.0546 3284 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 18:20:42.0546 3284 atapi - ok 18:20:42.0578 3284 Atdisk - ok 18:20:42.0625 3284 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 18:20:42.0625 3284 Atmarpc - ok 18:20:42.0671 3284 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 18:20:42.0671 3284 AudioSrv - ok 18:20:42.0687 3284 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 18:20:42.0687 3284 audstub - ok 18:20:42.0906 3284 [ D45B7995761253A92AB071D576114F28 ] AVG Security Toolbar Service C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe 18:20:42.0906 3284 AVG Security Toolbar Service - ok 18:20:42.0968 3284 [ C4D15594DB5BE042D3346EA58DF87D89 ] avg9wd C:\Program Files\AVG\AVG9\avgwdsvc.exe 18:20:43.0000 3284 avg9wd - ok 18:20:43.0062 3284 [ B8C187439D27ABA430DD69FDCF1FA657 ] AvgLdx86 C:\WINDOWS\System32\Drivers\avgldx86.sys 18:20:43.0062 3284 AvgLdx86 - ok 18:20:43.0125 3284 [ 80FF2B1B7EEDA966394F0BAA895BBF4B ] AvgMfx86 C:\WINDOWS\System32\Drivers\avgmfx86.sys 18:20:43.0125 3284 AvgMfx86 - ok 18:20:43.0171 3284 [ 5BBCD8646074A3AF4EE9B321D12C2B64 ] AvgRkx86 C:\WINDOWS\system32\Drivers\avgrkx86.sys 18:20:43.0171 3284 AvgRkx86 - ok 18:20:43.0265 3284 [ 9A7A93388F503A34E7339AE7F9997449 ] AvgTdiX C:\WINDOWS\System32\Drivers\avgtdix.sys 18:20:43.0265 3284 AvgTdiX - ok 18:20:43.0312 3284 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 18:20:43.0312 3284 Beep - ok 18:20:43.0406 3284 [ 673CF4F6BB1FBE09331B526802FBB892 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 18:20:43.0421 3284 Bonjour Service - ok 18:20:43.0468 3284 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 18:20:43.0468 3284 Browser - ok 18:20:43.0500 3284 [ C945DC4EEE3F624DFD07788EA7F0DB0A ] bvrp_pci C:\WINDOWS\system32\drivers\bvrp_pci.sys 18:20:43.0500 3284 bvrp_pci - ok 18:20:43.0750 3284 catchme - ok 18:20:43.0765 3284 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys 18:20:43.0765 3284 cbidf - ok 18:20:43.0781 3284 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 18:20:43.0781 3284 cbidf2k - ok 18:20:43.0859 3284 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys 18:20:43.0859 3284 cd20xrnt - ok 18:20:43.0906 3284 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 18:20:43.0906 3284 Cdaudio - ok 18:20:43.0937 3284 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 18:20:43.0953 3284 Cdfs - ok 18:20:43.0984 3284 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 18:20:44.0000 3284 Cdrom - ok 18:20:44.0000 3284 Changer - ok 18:20:44.0062 3284 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 18:20:44.0062 3284 CiSvc - ok 18:20:44.0125 3284 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 18:20:44.0125 3284 ClipSrv - ok 18:20:44.0171 3284 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 18:20:44.0250 3284 clr_optimization_v2.0.50727_32 - ok 18:20:44.0625 3284 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 18:20:44.0625 3284 clr_optimization_v4.0.30319_32 - ok 18:20:44.0640 3284 [ E5DCB56C533014ECBC556A8357C929D5 ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys 18:20:44.0640 3284 CmdIde - ok 18:20:44.0656 3284 COMSysApp - ok 18:20:44.0671 3284 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys 18:20:44.0671 3284 Cpqarray - ok 18:20:44.0765 3284 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 18:20:44.0765 3284 CryptSvc - ok 18:20:44.0781 3284 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys 18:20:44.0781 3284 dac2w2k - ok 18:20:44.0796 3284 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys 18:20:44.0796 3284 dac960nt - ok 18:20:44.0859 3284 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 18:20:44.0906 3284 DcomLaunch - ok 18:20:44.0968 3284 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 18:20:44.0984 3284 Dhcp - ok 18:20:45.0015 3284 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 18:20:45.0015 3284 Disk - ok 18:20:45.0015 3284 dmadmin - ok 18:20:45.0125 3284 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 18:20:45.0156 3284 dmboot - ok 18:20:45.0218 3284 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 18:20:45.0218 3284 dmio - ok 18:20:45.0281 3284 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 18:20:45.0312 3284 dmload - ok 18:20:45.0343 3284 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 18:20:45.0359 3284 dmserver - ok 18:20:45.0390 3284 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 18:20:45.0406 3284 DMusic - ok 18:20:45.0453 3284 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 18:20:45.0453 3284 Dnscache - ok 18:20:45.0500 3284 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 18:20:45.0500 3284 Dot3svc - ok 18:20:45.0500 3284 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys 18:20:45.0500 3284 dpti2o - ok 18:20:45.0578 3284 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 18:20:45.0578 3284 drmkaud - ok 18:20:45.0593 3284 [ B15F9E526BA511A48B1B1B8537815740 ] drvmcdb C:\WINDOWS\system32\drivers\drvmcdb.sys 18:20:45.0609 3284 drvmcdb - ok 18:20:45.0609 3284 [ FA4670CAE95AE2BB857C68E535661145 ] drvnddm C:\WINDOWS\system32\drivers\drvnddm.sys 18:20:45.0609 3284 drvnddm - ok 18:20:45.0687 3284 [ 7D91DC6342248369F94D6EBA0CF42E99 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys 18:20:45.0687 3284 E100B - ok 18:20:45.0703 3284 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 18:20:45.0703 3284 EapHost - ok 18:20:45.0765 3284 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 18:20:45.0765 3284 ERSvc - ok 18:20:45.0812 3284 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 18:20:45.0812 3284 Eventlog - ok 18:20:45.0875 3284 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 18:20:45.0890 3284 EventSystem - ok 18:20:45.0937 3284 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 18:20:45.0937 3284 Fastfat - ok 18:20:45.0984 3284 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 18:20:45.0984 3284 FastUserSwitchingCompatibility - ok 18:20:45.0984 3284 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 18:20:45.0984 3284 Fdc - ok 18:20:46.0000 3284 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 18:20:46.0015 3284 Fips - ok 18:20:46.0046 3284 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 18:20:46.0046 3284 Flpydisk - ok 18:20:46.0093 3284 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 18:20:46.0109 3284 FltMgr - ok 18:20:46.0187 3284 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 18:20:46.0187 3284 FontCache3.0.0.0 - ok 18:20:46.0203 3284 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 18:20:46.0203 3284 Fs_Rec - ok 18:20:46.0218 3284 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 18:20:46.0218 3284 Ftdisk - ok 18:20:46.0265 3284 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 18:20:46.0265 3284 GEARAspiWDM - ok 18:20:46.0359 3284 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 18:20:46.0421 3284 Gpc - ok 18:20:46.0484 3284 gupdate - ok 18:20:46.0500 3284 gupdatem - ok 18:20:46.0578 3284 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 18:20:46.0578 3284 helpsvc - ok 18:20:46.0593 3284 HidServ - ok 18:20:46.0609 3284 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 18:20:46.0640 3284 HidUsb - ok 18:20:46.0750 3284 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 18:20:46.0750 3284 hkmsvc - ok 18:20:46.0781 3284 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys 18:20:46.0781 3284 hpn - ok 18:20:46.0875 3284 [ 77E4FF0B73BC0AEAAF39BF0C8104231F ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 18:20:46.0875 3284 HSFHWBS2 - ok 18:20:46.0937 3284 [ 60E1604729A15EF4A3B05F298427B3B1 ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 18:20:46.0968 3284 HSF_DP - ok 18:20:47.0031 3284 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 18:20:47.0046 3284 HTTP - ok 18:20:47.0046 3284 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 18:20:47.0062 3284 HTTPFilter - ok 18:20:47.0062 3284 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys 18:20:47.0062 3284 i2omgmt - ok 18:20:47.0093 3284 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys 18:20:47.0093 3284 i2omp - ok 18:20:47.0125 3284 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 18:20:47.0125 3284 i8042prt - ok 18:20:47.0281 3284 [ 5A8E05F1D5C36ABD58CFFA111EB325EA ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 18:20:47.0328 3284 ialm - ok 18:20:47.0453 3284 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 18:20:47.0546 3284 idsvc - ok 18:20:47.0609 3284 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 18:20:47.0609 3284 Imapi - ok 18:20:47.0656 3284 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 18:20:47.0656 3284 ImapiService - ok 18:20:47.0671 3284 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys 18:20:47.0671 3284 ini910u - ok 18:20:47.0687 3284 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 18:20:47.0687 3284 IntelIde - ok 18:20:47.0750 3284 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 18:20:47.0750 3284 intelppm - ok 18:20:48.0031 3284 [ 7BDB4E00E1CB174B56E5B2C31DDE68A7 ] IntuitUpdateService C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe 18:20:48.0046 3284 IntuitUpdateService - ok 18:20:48.0171 3284 [ 1663A135865F0BA6E853353E98E67F2A ] IntuitUpdateServiceV4 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe 18:20:48.0203 3284 IntuitUpdateServiceV4 - ok 18:20:48.0265 3284 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 18:20:48.0296 3284 Ip6Fw - ok 18:20:48.0359 3284 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 18:20:48.0390 3284 IpFilterDriver - ok 18:20:48.0437 3284 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 18:20:48.0453 3284 IpInIp - ok 18:20:48.0531 3284 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 18:20:48.0546 3284 IpNat - ok 18:20:48.0609 3284 [ 32CDEDD15E2D1A557CD54552AE78FF86 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 18:20:48.0640 3284 iPod Service - ok 18:20:48.0687 3284 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 18:20:48.0687 3284 IPSec - ok 18:20:48.0796 3284 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 18:20:48.0796 3284 IRENUM - ok 18:20:48.0875 3284 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 18:20:48.0875 3284 isapnp - ok 18:20:49.0000 3284 [ 381B25DC8E958D905B33130D500BBF29 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe 18:20:49.0000 3284 JavaQuickStarterService - ok 18:20:49.0015 3284 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 18:20:49.0015 3284 Kbdclass - ok 18:20:49.0031 3284 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 18:20:49.0031 3284 kmixer - ok 18:20:49.0093 3284 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 18:20:49.0093 3284 KSecDD - ok 18:20:49.0140 3284 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 18:20:49.0156 3284 lanmanserver - ok 18:20:49.0203 3284 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 18:20:49.0203 3284 lanmanworkstation - ok 18:20:49.0250 3284 lbrtfdc - ok 18:20:49.0312 3284 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 18:20:49.0312 3284 LmHosts - ok 18:20:49.0328 3284 [ EEAEA6514BA7C9D273B5E87C4E1AAB30 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 18:20:49.0328 3284 mdmxsdk - ok 18:20:49.0375 3284 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 18:20:49.0390 3284 Messenger - ok 18:20:49.0718 3284 Microsoft SharePoint Workspace Audit Service - ok 18:20:49.0765 3284 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 18:20:49.0765 3284 mnmdd - ok 18:20:49.0812 3284 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 18:20:49.0843 3284 mnmsrvc - ok 18:20:49.0890 3284 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 18:20:49.0890 3284 Modem - ok 18:20:49.0937 3284 [ 1992E0D143B09653AB0F9C5E04B0FD65 ] MODEMCSA C:\WINDOWS\system32\drivers\MODEMCSA.sys 18:20:49.0937 3284 MODEMCSA - ok 18:20:49.0953 3284 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 18:20:49.0953 3284 Mouclass - ok 18:20:49.0984 3284 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 18:20:49.0984 3284 MountMgr - ok 18:20:50.0031 3284 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys 18:20:50.0031 3284 mraid35x - ok 18:20:50.0078 3284 [ 6075DE2AD531F6E30C9995DFDA22001F ] mrtRate C:\WINDOWS\system32\drivers\mrtRate.sys 18:20:50.0078 3284 mrtRate - ok 18:20:50.0093 3284 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 18:20:50.0093 3284 MRxDAV - ok 18:20:50.0156 3284 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 18:20:50.0171 3284 MRxSmb - ok 18:20:50.0234 3284 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 18:20:50.0234 3284 MSDTC - ok 18:20:50.0281 3284 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 18:20:50.0281 3284 Msfs - ok 18:20:50.0296 3284 MSIServer - ok 18:20:50.0312 3284 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 18:20:50.0312 3284 MSKSSRV - ok 18:20:50.0343 3284 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 18:20:50.0343 3284 MSPCLOCK - ok 18:20:50.0406 3284 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 18:20:50.0406 3284 MSPQM - ok 18:20:50.0406 3284 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 18:20:50.0406 3284 mssmbios - ok 18:20:50.0468 3284 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 18:20:50.0484 3284 Mup - ok 18:20:50.0531 3284 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 18:20:50.0546 3284 napagent - ok 18:20:50.0578 3284 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 18:20:50.0593 3284 NDIS - ok 18:20:50.0765 3284 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 18:20:50.0781 3284 NdisTapi - ok 18:20:50.0875 3284 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 18:20:50.0890 3284 Ndisuio - ok 18:20:50.0937 3284 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 18:20:50.0937 3284 NdisWan - ok 18:20:50.0984 3284 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 18:20:50.0984 3284 NDProxy - ok 18:20:51.0031 3284 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 18:20:51.0031 3284 NetBIOS - ok 18:20:51.0078 3284 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 18:20:51.0093 3284 NetBT - ok 18:20:51.0140 3284 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 18:20:51.0140 3284 NetDDE - ok 18:20:51.0140 3284 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 18:20:51.0156 3284 NetDDEdsdm - ok 18:20:51.0203 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 18:20:51.0203 3284 Netlogon - ok 18:20:51.0250 3284 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 18:20:51.0265 3284 Netman - ok 18:20:51.0390 3284 [ 02D0798F376FCBD0210EDA58476D0B1B ] NetSvc C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe 18:20:51.0406 3284 NetSvc - ok 18:20:51.0484 3284 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 18:20:51.0484 3284 NetTcpPortSharing - ok 18:20:51.0546 3284 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 18:20:51.0562 3284 Nla - ok 18:20:51.0593 3284 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 18:20:51.0593 3284 Npfs - ok 18:20:51.0640 3284 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 18:20:51.0671 3284 Ntfs - ok 18:20:51.0687 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 18:20:51.0687 3284 NtLmSsp - ok 18:20:51.0734 3284 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 18:20:51.0750 3284 NtmsSvc - ok 18:20:51.0781 3284 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 18:20:51.0781 3284 Null - ok 18:20:51.0906 3284 [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 18:20:52.0046 3284 nv - ok 18:20:52.0078 3284 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 18:20:52.0093 3284 NwlnkFlt - ok 18:20:52.0093 3284 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 18:20:52.0093 3284 NwlnkFwd - ok 18:20:52.0140 3284 [ 53D5F1278D9EDB21689BBBCECC09108D ] omci C:\WINDOWS\system32\DRIVERS\omci.sys 18:20:52.0140 3284 omci - ok 18:20:52.0250 3284 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 18:20:52.0250 3284 ose - ok 18:20:53.0109 3284 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 18:20:54.0843 3284 osppsvc - ok 18:20:54.0953 3284 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 18:20:55.0031 3284 Parport - ok 18:20:55.0078 3284 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 18:20:55.0078 3284 PartMgr - ok 18:20:55.0109 3284 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 18:20:55.0109 3284 ParVdm - ok 18:20:55.0125 3284 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 18:20:55.0125 3284 PCI - ok 18:20:55.0140 3284 PCIDump - ok 18:20:55.0140 3284 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 18:20:55.0140 3284 PCIIde - ok 18:20:55.0171 3284 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 18:20:55.0203 3284 Pcmcia - ok 18:20:55.0203 3284 PDCOMP - ok 18:20:55.0218 3284 PDFRAME - ok 18:20:55.0218 3284 PDRELI - ok 18:20:55.0234 3284 PDRFRAME - ok 18:20:55.0234 3284 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys 18:20:55.0234 3284 perc2 - ok 18:20:55.0265 3284 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys 18:20:55.0265 3284 perc2hib - ok 18:20:55.0328 3284 [ 444F122E68DB44C0589227781F3C8B3F ] pfc C:\WINDOWS\system32\drivers\pfc.sys 18:20:55.0328 3284 pfc - ok 18:20:55.0343 3284 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 18:20:55.0359 3284 PlugPlay - ok 18:20:55.0359 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 18:20:55.0375 3284 PolicyAgent - ok 18:20:55.0421 3284 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 18:20:55.0453 3284 PptpMiniport - ok 18:20:55.0453 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 18:20:55.0453 3284 ProtectedStorage - ok 18:20:55.0500 3284 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 18:20:55.0515 3284 PSched - ok 18:20:55.0578 3284 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 18:20:55.0578 3284 Ptilink - ok 18:20:55.0625 3284 [ 1962166E0CEB740704F30FA55AD3D509 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 18:20:55.0625 3284 PxHelp20 - ok 18:20:55.0671 3284 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys 18:20:55.0671 3284 ql1080 - ok 18:20:55.0687 3284 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys 18:20:55.0687 3284 Ql10wnt - ok 18:20:55.0687 3284 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys 18:20:55.0687 3284 ql12160 - ok 18:20:55.0703 3284 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys 18:20:55.0703 3284 ql1240 - ok 18:20:55.0718 3284 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys 18:20:55.0718 3284 ql1280 - ok 18:20:55.0734 3284 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 18:20:55.0734 3284 RasAcd - ok 18:20:55.0781 3284 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 18:20:55.0812 3284 RasAuto - ok 18:20:55.0843 3284 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 18:20:55.0859 3284 Rasl2tp - ok 18:20:55.0890 3284 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 18:20:55.0906 3284 RasMan - ok 18:20:55.0921 3284 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 18:20:55.0921 3284 RasPppoe - ok 18:20:55.0921 3284 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 18:20:55.0921 3284 Raspti - ok 18:20:56.0031 3284 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 18:20:56.0156 3284 Rdbss - ok 18:20:56.0203 3284 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 18:20:56.0218 3284 RDPCDD - ok 18:20:56.0312 3284 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 18:20:56.0468 3284 rdpdr - ok 18:20:56.0578 3284 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 18:20:56.0625 3284 RDPWD - ok 18:20:56.0671 3284 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 18:20:56.0671 3284 RDSessMgr - ok 18:20:56.0750 3284 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 18:20:56.0750 3284 redbook - ok 18:20:56.0828 3284 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 18:20:56.0859 3284 RemoteAccess - ok 18:20:56.0890 3284 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 18:20:56.0906 3284 RpcLocator - ok 18:20:56.0921 3284 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 18:20:56.0937 3284 RpcSs - ok 18:20:57.0015 3284 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 18:20:57.0046 3284 RSVP - ok 18:20:57.0078 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 18:20:57.0078 3284 SamSs - ok 18:20:57.0125 3284 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 18:20:57.0156 3284 SCardSvr - ok 18:20:57.0218 3284 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 18:20:57.0218 3284 Schedule - ok 18:20:57.0281 3284 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 18:20:57.0281 3284 Secdrv - ok 18:20:57.0328 3284 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 18:20:57.0328 3284 seclogon - ok 18:20:57.0375 3284 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 18:20:57.0390 3284 SENS - ok 18:20:57.0421 3284 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 18:20:57.0437 3284 serenum - ok 18:20:57.0437 3284 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 18:20:57.0437 3284 Serial - ok 18:20:57.0468 3284 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 18:20:57.0468 3284 Sfloppy - ok 18:20:57.0531 3284 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 18:20:57.0546 3284 SharedAccess - ok 18:20:57.0562 3284 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 18:20:57.0562 3284 ShellHWDetection - ok 18:20:57.0562 3284 Simbad - ok 18:20:57.0625 3284 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys 18:20:57.0625 3284 sisagp - ok 18:20:57.0671 3284 [ 4AA922332433CDEB8B82C072C212E32E ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys 18:20:57.0687 3284 smwdm - ok 18:20:57.0718 3284 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys 18:20:57.0718 3284 Sparrow - ok 18:20:57.0750 3284 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 18:20:57.0750 3284 splitter - ok 18:20:57.0796 3284 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 18:20:57.0796 3284 Spooler - ok 18:20:57.0906 3284 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 18:20:57.0906 3284 sr - ok 18:20:57.0968 3284 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 18:20:57.0984 3284 srservice - ok 18:20:58.0031 3284 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 18:20:58.0093 3284 Srv - ok 18:20:58.0140 3284 [ D7968049BE0ADBB6A57CEE3960320911 ] sscdbhk5 C:\WINDOWS\system32\drivers\sscdbhk5.sys 18:20:58.0140 3284 sscdbhk5 - ok 18:20:58.0187 3284 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 18:20:58.0203 3284 SSDPSRV - ok 18:20:58.0203 3284 [ C3FFD65ABFB6441E7606CF74F1155273 ] ssrtln C:\WINDOWS\system32\drivers\ssrtln.sys 18:20:58.0203 3284 ssrtln - ok 18:20:58.0265 3284 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 18:20:58.0281 3284 stisvc - ok 18:20:58.0328 3284 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 18:20:58.0328 3284 swenum - ok 18:20:58.0375 3284 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 18:20:58.0375 3284 swmidi - ok 18:20:58.0390 3284 SwPrv - ok 18:20:58.0406 3284 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys 18:20:58.0406 3284 symc810 - ok 18:20:58.0421 3284 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys 18:20:58.0421 3284 symc8xx - ok 18:20:58.0437 3284 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys 18:20:58.0453 3284 sym_hi - ok 18:20:58.0468 3284 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys 18:20:58.0468 3284 sym_u3 - ok 18:20:58.0500 3284 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 18:20:58.0500 3284 sysaudio - ok 18:20:58.0562 3284 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 18:20:58.0562 3284 SysmonLog - ok 18:20:58.0609 3284 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 18:20:58.0625 3284 TapiSrv - ok 18:20:58.0687 3284 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 18:20:58.0703 3284 Tcpip - ok 18:20:58.0781 3284 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 18:20:58.0781 3284 TDPIPE - ok 18:20:58.0828 3284 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 18:20:58.0843 3284 TDTCP - ok 18:20:58.0890 3284 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 18:20:58.0890 3284 TermDD - ok 18:20:58.0937 3284 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 18:20:58.0953 3284 TermService - ok 18:20:59.0046 3284 [ 1D265CD2FB1673A0873BF8CEC19DDC7F ] tfsnboio C:\WINDOWS\system32\dla\tfsnboio.sys 18:20:59.0046 3284 tfsnboio - ok 18:20:59.0062 3284 [ 62E4901295E0467CAC78E5B4B131AE5C ] tfsncofs C:\WINDOWS\system32\dla\tfsncofs.sys 18:20:59.0062 3284 tfsncofs - ok 18:20:59.0078 3284 [ A2F380F9252AB3464C859ADF91EEAD9C ] tfsndrct C:\WINDOWS\system32\dla\tfsndrct.sys 18:20:59.0078 3284 tfsndrct - ok 18:20:59.0093 3284 [ EEE79BBEFE9C6A2A3CE6C8753CFEA950 ] tfsndres C:\WINDOWS\system32\dla\tfsndres.sys 18:20:59.0093 3284 tfsndres - ok 18:20:59.0109 3284 [ 9D644EB11FEC9487450C4CFCD63A5DF4 ] tfsnifs C:\WINDOWS\system32\dla\tfsnifs.sys 18:20:59.0109 3284 tfsnifs - ok 18:20:59.0125 3284 [ E656AF05C67EDB7C0E9230A5DF71ED1B ] tfsnopio C:\WINDOWS\system32\dla\tfsnopio.sys 18:20:59.0125 3284 tfsnopio - ok 18:20:59.0125 3284 [ 64FCCB9CCE703CA507DFFC3CEBF6B2CB ] tfsnpool C:\WINDOWS\system32\dla\tfsnpool.sys 18:20:59.0125 3284 tfsnpool - ok 18:20:59.0140 3284 [ 48BC9D8AB4E4B9BFF70FB18E55CEC3D6 ] tfsnudf C:\WINDOWS\system32\dla\tfsnudf.sys 18:20:59.0140 3284 tfsnudf - ok 18:20:59.0156 3284 [ 79F60822224256B49BFC855DA8D651D5 ] tfsnudfa C:\WINDOWS\system32\dla\tfsnudfa.sys 18:20:59.0156 3284 tfsnudfa - ok 18:20:59.0171 3284 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 18:20:59.0171 3284 Themes - ok 18:20:59.0187 3284 [ F2790F6AF01321B172AA62F8E1E187D9 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys 18:20:59.0187 3284 TosIde - ok 18:20:59.0250 3284 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 18:20:59.0250 3284 TrkWks - ok 18:20:59.0312 3284 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 18:20:59.0312 3284 Udfs - ok 18:20:59.0328 3284 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys 18:20:59.0328 3284 ultra - ok 18:20:59.0375 3284 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 18:20:59.0390 3284 Update - ok 18:20:59.0453 3284 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 18:20:59.0468 3284 upnphost - ok 18:20:59.0500 3284 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 18:20:59.0515 3284 UPS - ok 18:20:59.0562 3284 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 18:20:59.0562 3284 usbccgp - ok 18:20:59.0578 3284 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 18:20:59.0578 3284 usbehci - ok 18:20:59.0625 3284 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 18:20:59.0625 3284 usbhub - ok 18:20:59.0671 3284 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 18:20:59.0687 3284 usbscan - ok 18:20:59.0718 3284 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 18:20:59.0718 3284 USBSTOR - ok 18:20:59.0781 3284 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 18:20:59.0843 3284 usbuhci - ok 18:20:59.0906 3284 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys 18:20:59.0906 3284 usb_rndisx - ok 18:20:59.0953 3284 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 18:20:59.0953 3284 VgaSave - ok 18:20:59.0984 3284 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys 18:20:59.0984 3284 viaagp - ok 18:21:00.0000 3284 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 18:21:00.0000 3284 ViaIde - ok 18:21:00.0015 3284 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 18:21:00.0015 3284 VolSnap - ok 18:21:00.0062 3284 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 18:21:00.0078 3284 VSS - ok 18:21:00.0234 3284 [ 8ED347BAD8D1FB7C40B593BFB01786D2 ] vToolbarUpdater11.2.0 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe 18:21:00.0281 3284 vToolbarUpdater11.2.0 - ok 18:21:00.0296 3284 [ 54AF4B1D5459500EF0937F6D33B1914F ] w32time C:\WINDOWS\system32\w32time.dll 18:21:00.0312 3284 w32time - ok 18:21:00.0328 3284 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 18:21:00.0328 3284 Wanarp - ok 18:21:00.0328 3284 wanatw - ok 18:21:00.0343 3284 WDICA - ok 18:21:00.0390 3284 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 18:21:00.0390 3284 wdmaud - ok 18:21:00.0406 3284 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 18:21:00.0406 3284 WebClient - ok 18:21:00.0484 3284 [ F59ED5A43B988A18EF582BB07B2327A7 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 18:21:00.0515 3284 winachsf - ok 18:21:00.0656 3284 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 18:21:00.0656 3284 winmgmt - ok 18:21:00.0765 3284 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 18:21:00.0781 3284 WmdmPmSN - ok 18:21:00.0828 3284 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 18:21:00.0828 3284 WmiApSrv - ok 18:21:01.0000 3284 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 18:21:01.0046 3284 WMPNetworkSvc - ok 18:21:01.0359 3284 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 18:21:01.0375 3284 WPFFontCache_v0400 - ok 18:21:01.0421 3284 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 18:21:01.0421 3284 WS2IFSL - ok 18:21:01.0468 3284 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 18:21:01.0500 3284 wscsvc - ok 18:21:01.0546 3284 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 18:21:01.0546 3284 wuauserv - ok 18:21:01.0593 3284 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 18:21:01.0593 3284 WudfPf - ok 18:21:01.0609 3284 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 18:21:01.0625 3284 WudfRd - ok 18:21:01.0671 3284 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 18:21:01.0671 3284 WudfSvc - ok 18:21:01.0734 3284 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 18:21:01.0750 3284 WZCSVC - ok 18:21:01.0796 3284 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 18:21:01.0796 3284 xmlprov - ok 18:21:01.0859 3284 ================ Scan global =============================== 18:21:01.0921 3284 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 18:21:02.0093 3284 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 18:21:02.0187 3284 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 18:21:02.0218 3284 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 18:21:02.0218 3284 [Global] - ok 18:21:02.0218 3284 ================ Scan MBR ================================== 18:21:02.0250 3284 [ B16A2359F4962B0C622D81A1C1F4B703 ] \Device\Harddisk0\DR0 18:21:02.0250 3284 Suspicious mbr (Forged): \Device\Harddisk0\DR0 18:21:02.0281 3284 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected 18:21:02.0281 3284 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0) 18:21:04.0625 3284 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 18:21:04.0625 3284 \Device\Harddisk0\DR0 - detected TDSS File System (1) 18:21:04.0625 3284 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR4 18:21:04.0812 3284 \Device\Harddisk1\DR4 - ok 18:21:04.0812 3284 ================ Scan VBR ================================== 18:21:04.0843 3284 [ 6755AC694578A40EB27944F7DDA2B76B ] \Device\Harddisk0\DR0\Partition1 18:21:04.0859 3284 \Device\Harddisk0\DR0\Partition1 - ok 18:21:04.0859 3284 [ EF5F60B8846206442E7EC7340E1D509D ] \Device\Harddisk1\DR4\Partition1 18:21:04.0859 3284 \Device\Harddisk1\DR4\Partition1 - ok 18:21:04.0859 3284 ============================================================ 18:21:04.0859 3284 Scan finished 18:21:04.0859 3284 ============================================================ 18:21:04.0875 3256 Detected object count: 2 18:21:04.0875 3256 Actual detected object count: 2 18:22:50.0781 3256 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - skipped by user 18:22:50.0781 3256 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Skip 18:22:50.0796 3256 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 18:22:50.0796 3256 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

JonTom

Post #12August 24, 2012, 10:43 AM UTC

Hello symbiosis7

I'm glad TDSSKiller worked this time

Please run TDSSKiller as you did before but this time allow it to cure anything malicious that is detected.

Save the log created and then follow with another run of Combofix. If Combofix informs you that an update is available, please allow it to be installed.

Post the TDSSKiller log and the Combofix log in your next reply.

symbiosis7

Post #13August 24, 2012, 5:57 PM UTC

hi jontom - i ran TDSS as jontom.com, an update was available, i downloded it, changed the parameter you requested, ran TDSS. seemed to run normally, found "rootkit.boot.pihar.c". i cured it and TDSS requested a reboot, which i did.

ran combofix, which also had an update. i did it and launched combofix, which could not load console. scanned anyway, which seemd to take a lot longer, but probably not abnormally long…?

2 logs follow:

10:00:35.0062 0204 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
10:00:37.0093 0204 ============================================================
10:00:37.0093 0204 Current date / time: 2012/08/24 10:00:37.0093
10:00:37.0093 0204 SystemInfo:
10:00:37.0093 0204
10:00:37.0093 0204 OS Version: 5.1.2600 ServicePack: 3.0
10:00:37.0093 0204 Product type: Workstation
10:00:37.0234 0204 ComputerName: MAIN
10:00:37.0234 0204 UserName: T. Carlberg
10:00:37.0250 0204 Windows directory: C:\WINDOWS
10:00:37.0250 0204 System windows directory: C:\WINDOWS
10:00:37.0250 0204 Processor architecture: Intel x86
10:00:37.0250 0204 Number of processors: 2
10:00:37.0250 0204 Page size: 0x1000
10:00:37.0250 0204 Boot type: Normal boot
10:00:37.0250 0204 ============================================================
10:00:40.0046 0204 BG loaded
10:00:54.0203 0204 Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
10:00:54.0609 0204 Drive \Device\Harddisk1\DR4 - Size: 0x1D1C1115E00 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
10:00:54.0609 0204 ============================================================
10:00:54.0609 0204 \Device\Harddisk0\DR0:
10:00:55.0156 0204 MBR partitions:
10:00:55.0156 0204 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xFB04, BlocksNum 0x8DEE830
10:00:55.0156 0204 \Device\Harddisk1\DR4:
10:00:55.0156 0204 MBR partitions:
10:00:55.0156 0204 \Device\Harddisk1\DR4\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE8E074C1
10:00:55.0156 0204 ============================================================
10:01:43.0843 0204 C: <-> \Device\Harddisk0\DR0\Partition1
10:01:43.0875 0204 F: <-> \Device\Harddisk1\DR4\Partition1
10:01:43.0875 0204 ============================================================
10:01:43.0875 0204 Initialize success
10:01:43.0875 0204 ============================================================
10:07:02.0250 1224 Deinitialize success

ComboFix 12-08-24.01 - T. Carlberg 08/24/2012 10:14:57.8.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.452 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2012-07-24 to 2012-08-24 )))))))))))))))))))))))))))))))
.
.
2012-08-24 16:52 . 2012-08-24 16:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-22 15:04 . 2012-08-22 15:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-08-22 04:50 . 2012-08-22 04:50 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-20 01:46 . 2012-08-20 01:46 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-08-07 16:09 . 2012-06-02 22:18 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09 . 2012-06-02 22:18 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 06:07 . 2012-08-07 06:07 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft Sync Framework
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\documents and settings\All Users\Microsoft
2012-08-07 06:03 . 2012-08-07 06:03 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01 . 2012-08-07 06:01 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00 . 2012-08-07 06:00 ——– d—–w- c:\documents and settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
2012-08-07 06:00 . 2012-08-16 06:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2012-08-07 05:59 . 2012-08-07 05:59 ——– d—–r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-01 01:20 . 2012-07-22 22:14 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20 . 2012-07-22 22:14 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 11:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2004-08-04 11:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 11:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 11:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49 . 2012-06-06 15:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50 . 2008-10-19 04:34 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 11:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 11:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 22:19 . 2007-06-08 01:05 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19 . 2004-08-04 11:00 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 22:19 . 2004-08-04 11:00 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19 . 2004-08-04 11:00 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19 . 2005-05-26 11:16 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2004-11-30 05:43 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2004-08-04 11:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 22:19 . 2004-08-04 11:00 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2007-06-08 01:05 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 22:19 . 2004-08-04 11:00 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2004-08-04 11:00 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2004-08-04 11:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2006-10-10 21:09 . 2006-10-10 21:09 1053198 —-a-w- c:\program files\freemahjongg.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-21_03.55.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-24 17:01 . 2012-08-24 17:01 16384 c:\windows\temp\Perflib_Perfdata_a58.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 02:44 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-07 192512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-04-13 933]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
c:\documents and settings\T. Carlberg\Start Menu\Programs\Startup\
AVG Tray Icon.lnk - c:\program files\AVG\AVG9\avgtray.exe [2010-6-24 2077536]
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2004-11-29 36864]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-18 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2004-11-29 36864]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-24 23:12 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Themes"=2 (0x2)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"helpsvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [4/20/2008 4:20 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [4/20/2008 4:20 PM 216400]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [4/20/2008 4:20 PM 243152]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/24/2010 4:12 PM 308136]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [11/29/2004 6:18 PM 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [7/9/2012 7:44 PM 935008]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 11:22 AM 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 50875031
*NewlyCreated* - 92396827
*Deregistered* - 50875031
*Deregistered* - 92396827
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-92396827.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-24 10:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3388)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-08-24 10:45:06
ComboFix-quarantined-files.txt 2012-08-24 17:45
ComboFix2.txt 2012-08-21 04:00
.
Pre-Run: 10,543,882,240 bytes free
Post-Run: 11,193,188,352 bytes free
.
- - End Of File - - 6EB7BB910B1F68278F6910A9705B96DF

JonTom

Post #14August 24, 2012, 7:30 PM UTC

Hello symbiosis7

Thank you for the logs.

Please run aswMBR again and post the log created.

Once you have done that please proceed as follows:

MalwareBytes AntiMalware:
I can see that you have MBAM installed.
Double click on your MalwareBytes AntiMalware icon to launch the program.
Click on the "Update" tab and then on "Check for Updates".
The program will now install the latest Malware definition files.
Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
Once the program has scanned your computer, a log file will be created in Notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.

If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
Come back here to this thread and Paste the log in your next reply.

Please post the aswMBR log and the MBAM log in your next reply and let me know how the machine is running now.

JonTom

Post #15August 28, 2012, 11:27 AM UTC

Are you still with me?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

spontaneous odd behaviours: voices, web pages... [Solved]

✨ Ask AI

Ask AI