Windows Update, Microsft Security Essentials disabled

After Microsoft Security Essentials was turned off, with no way to turn it back on, I googled the problem and found out there is some kind of malware on the computer that has disabled Windows Update, and along with it, MSE. It doesn't affect the computer much, but I'd like for it to be clean anyway, thanks.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:02:06 AM, on 10/9/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Owner\hunizeakezif.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/dispatcher…d&%language
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=axl&a;…p;cr=1568723304
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~1\Funmoods\1.5.23.22\bh\escort.dll (file missing)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Funmoods Toolbar - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~1\Funmoods\1.5.23.22\escorTlbr.dll (file missing)
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [hunizeakezif] C:\Documents and Settings\Owner\hunizeakezif.exe
O4 - HKCU\..\Run: [LxrAutorun] C:\Documents and Settings\Owner\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.walmartphotocentre.ca/upload/ac…veX_Control.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: intu-tt2010 - {97A0575E-2309-4E75-8509-B1F9390C4DE7} - C:\Program Files\TurboTax 2010\ic2010pp.dll
O18 - Protocol: intu-tt2011 - {B3B5DAD9-E96D-45B4-B636-B6CF2F773DE1} - C:\Program Files\TurboTax 2011\ic2011pp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe

–
End of file - 10844 bytes

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt and Attach.txt in your next reply

08:47:16.0343 2176 TDSS rootkit removing tool [removed] Sep 17 2012 19:23:24
08:47:16.0937 2176 ============================================================
08:47:16.0937 2176 Current date / time: 2012/10/10 08:47:16.0937
08:47:16.0937 2176 SystemInfo:
08:47:16.0937 2176
08:47:16.0937 2176 OS Version: 5.1.2600 ServicePack: 3.0
08:47:16.0937 2176 Product type: Workstation
08:47:16.0937 2176 ComputerName: LAMOUREUX
08:47:16.0937 2176 UserName: Owner
08:47:16.0937 2176 Windows directory: C:\WINDOWS
08:47:16.0937 2176 System windows directory: C:\WINDOWS
08:47:16.0937 2176 Processor architecture: Intel x86
08:47:16.0937 2176 Number of processors: 1
08:47:16.0937 2176 Page size: 0x1000
08:47:16.0937 2176 Boot type: Normal boot
08:47:16.0937 2176 ============================================================
08:47:50.0062 2176 !crdlk
08:47:50.0062 2176 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'A'
08:47:55.0796 2176 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
08:47:55.0812 2176 ============================================================
08:47:55.0812 2176 \Device\Harddisk0\DR0:
08:47:55.0812 2176 MBR partitions:
08:47:55.0812 2176 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A18A82
08:47:55.0812 2176 ============================================================
08:47:55.0875 2176 C: <-> \Device\Harddisk0\DR0\Partition1
08:47:55.0875 2176 ============================================================
08:47:55.0875 2176 Initialize success
08:47:55.0875 2176 ============================================================
08:49:57.0734 2416 ============================================================
08:49:57.0734 2416 Scan started
08:49:57.0734 2416 Mode: Manual;
08:49:57.0734 2416 ============================================================
08:49:58.0421 2416 ================ Scan system memory ========================
08:49:58.0437 2416 System memory - ok
08:49:58.0437 2416 ================ Scan services =============================
08:49:58.0812 2416 Suspicious service (NoAccess): 293d6de7839e4273
08:49:59.0421 2416 [ 8B6A625C8907C5DBFB954FB4BF207E1E ] 293d6de7839e4273 C:\WINDOWS\System32\Drivers\293d6de7839e4273.sys
08:49:59.0421 2416 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\293d6de7839e4273.sys. md5: 8B6A625C8907C5DBFB954FB4BF207E1E
08:50:01.0343 2416 293d6de7839e4273 ( Rootkit.Win32.Necurs.gen ) - infected
08:50:01.0343 2416 293d6de7839e4273 - detected Rootkit.Win32.Necurs.gen (0)
08:50:01.0609 2416 [ C07D5197410AAB28D0D93F943F59656D ] 6to4 C:\WINDOWS\System32\6to4svc.dll
08:50:01.0640 2416 6to4 - ok
08:50:01.0796 2416 Abiosdsk - ok
08:50:01.0953 2416 abp480n5 - ok
08:50:02.0234 2416 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:50:02.0328 2416 ACPI - ok
08:50:02.0515 2416 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
08:50:02.0531 2416 ACPIEC - ok
08:50:02.0859 2416 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
08:50:02.0984 2416 AdobeFlashPlayerUpdateSvc - ok
08:50:03.0156 2416 adpu160m - ok
08:50:03.0375 2416 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
08:50:03.0375 2416 aec - ok
08:50:03.0625 2416 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
08:50:03.0625 2416 AFD - ok
08:50:03.0828 2416 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
08:50:03.0843 2416 agp440 - ok
08:50:04.0000 2416 Aha154x - ok
08:50:04.0140 2416 aic78u2 - ok
08:50:04.0312 2416 aic78xx - ok
08:50:04.0515 2416 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
08:50:04.0531 2416 Alerter - ok
08:50:04.0703 2416 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
08:50:04.0718 2416 ALG - ok
08:50:04.0875 2416 AliIde - ok
08:50:05.0062 2416 [ 8FCE268CDBDD83B23419D1F35F42C7B1 ] AmdK7 C:\WINDOWS\system32\DRIVERS\amdk7.sys
08:50:05.0062 2416 AmdK7 - ok
08:50:05.0218 2416 amsint - ok
08:50:05.0515 2416 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
08:50:05.0546 2416 Apple Mobile Device - ok
08:50:05.0781 2416 AppMgmt - ok
08:50:06.0000 2416 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
08:50:06.0031 2416 Arp1394 - ok
08:50:06.0187 2416 asc - ok
08:50:06.0328 2416 asc3350p - ok
08:50:06.0484 2416 asc3550 - ok
08:50:06.0656 2416 [ D880831279ED91F9A4190A2DB9539EA9 ] ASCTRM C:\WINDOWS\system32\drivers\ASCTRM.sys
08:50:06.0656 2416 ASCTRM - ok
08:50:07.0046 2416 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
08:50:07.0140 2416 aspnet_state - ok
08:50:07.0328 2416 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:50:07.0328 2416 AsyncMac - ok
08:50:07.0562 2416 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
08:50:07.0562 2416 atapi - ok
08:50:07.0718 2416 Atdisk - ok
08:50:07.0921 2416 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:50:07.0953 2416 Atmarpc - ok
08:50:08.0265 2416 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
08:50:08.0296 2416 AudioSrv - ok
08:50:08.0453 2416 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
08:50:08.0453 2416 audstub - ok
08:50:08.0718 2416 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
08:50:08.0734 2416 Beep - ok
08:50:09.0140 2416 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
08:50:09.0328 2416 Bonjour Service - ok
08:50:09.0593 2416 [ A06CE3399D16DB864F55FAEB1F1927A9 ] Browser C:\WINDOWS\System32\browser.dll
08:50:09.0625 2416 Browser - ok
08:50:09.0812 2416 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
08:50:09.0828 2416 cbidf2k - ok
08:50:10.0015 2416 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:50:10.0015 2416 CCDECODE - ok
08:50:10.0171 2416 cd20xrnt - ok
08:50:10.0390 2416 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
08:50:10.0390 2416 Cdaudio - ok
08:50:10.0562 2416 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
08:50:10.0562 2416 Cdfs - ok
08:50:10.0781 2416 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:50:10.0781 2416 Cdrom - ok
08:50:10.0937 2416 Changer - ok
08:50:11.0156 2416 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
08:50:11.0171 2416 CiSvc - ok
08:50:11.0390 2416 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
08:50:11.0421 2416 ClipSrv - ok
08:50:11.0625 2416 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
08:50:11.0890 2416 clr_optimization_v2.0.50727_32 - ok
08:50:12.0062 2416 CmdIde - ok
08:50:12.0187 2416 COMSysApp - ok
08:50:12.0468 2416 Cpqarray - ok
08:50:12.0765 2416 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
08:50:12.0796 2416 CryptSvc - ok
08:50:12.0968 2416 dac2w2k - ok
08:50:13.0109 2416 dac960nt - ok
08:50:13.0578 2416 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
08:50:13.0828 2416 DcomLaunch - ok
08:50:14.0109 2416 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
08:50:14.0156 2416 Dhcp - ok
08:50:14.0375 2416 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
08:50:14.0406 2416 Disk - ok
08:50:14.0562 2416 dmadmin - ok
08:50:15.0171 2416 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
08:50:15.0562 2416 dmboot - ok
08:50:15.0875 2416 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
08:50:15.0953 2416 dmio - ok
08:50:16.0125 2416 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
08:50:16.0140 2416 dmload - ok
08:50:16.0375 2416 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
08:50:16.0390 2416 dmserver - ok
08:50:16.0625 2416 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
08:50:16.0625 2416 DMusic - ok
08:50:16.0875 2416 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
08:50:16.0906 2416 Dnscache - ok
08:50:17.0296 2416 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
08:50:17.0375 2416 Dot3svc - ok
08:50:17.0515 2416 dpti2o - ok
08:50:17.0671 2416 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
08:50:17.0671 2416 drmkaud - ok
08:50:17.0937 2416 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
08:50:17.0953 2416 EapHost - ok
08:50:18.0328 2416 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
08:50:18.0343 2416 ERSvc - ok
08:50:18.0625 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
08:50:18.0656 2416 Eventlog - ok
08:50:18.0968 2416 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\System32\es.dll
08:50:19.0078 2416 EventSystem - ok
08:50:19.0328 2416 Fabs - ok
08:50:19.0562 2416 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
08:50:19.0625 2416 Fastfat - ok
08:50:19.0890 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
08:50:19.0953 2416 FastUserSwitchingCompatibility - ok
08:50:20.0156 2416 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
08:50:20.0171 2416 Fdc - ok
08:50:20.0343 2416 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
08:50:20.0343 2416 Fips - ok
08:50:22.0156 2416 [ FFF1130F7C9FA01D093A1EDFC5CCE8FC ] FirebirdServerMAGIXInstance C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
08:50:23.0906 2416 FirebirdServerMAGIXInstance - ok
08:50:24.0125 2416 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
08:50:24.0140 2416 Flpydisk - ok
08:50:24.0421 2416 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
08:50:24.0484 2416 FltMgr - ok
08:50:24.0734 2416 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
08:50:24.0765 2416 FontCache3.0.0.0 - ok
08:50:24.0984 2416 [ C6EE3A87FE609D3E1DB9DBD072A248DE ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
08:50:24.0984 2416 fssfltr - ok
08:50:25.0593 2416 [ 206AD9A89BF05DFA1621F1FC7B82592D ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe
08:50:25.0937 2416 fsssvc - ok
08:50:26.0156 2416 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:50:26.0171 2416 Fs_Rec - ok
08:50:26.0421 2416 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:50:26.0484 2416 Ftdisk - ok
08:50:26.0687 2416 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
08:50:26.0703 2416 GEARAspiWDM - ok
08:50:26.0890 2416 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:50:26.0890 2416 Gpc - ok
08:50:27.0078 2416 gusvc - ok
08:50:27.0406 2416 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
08:50:27.0421 2416 helpsvc - ok
08:50:27.0687 2416 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll
08:50:27.0687 2416 HidServ - ok
08:50:27.0906 2416 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:50:27.0906 2416 HidUsb - ok
08:50:28.0250 2416 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
08:50:28.0281 2416 hkmsvc - ok
08:50:28.0484 2416 hpn - ok
08:50:28.0890 2416 [ 5DA42D24712E00728CEA2342A65009B2 ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
08:50:29.0046 2416 hpqcxs08 - ok
08:50:29.0421 2416 [ D86A39BF100069444D026D22D9A6E555 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
08:50:29.0484 2416 hpqddsvc - ok
08:50:29.0718 2416 [ D03D10F7DED688FECF50F8FBF1EA9B8A ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
08:50:29.0734 2416 HPZid412 - ok
08:50:29.0875 2416 [ 89F41658929393487B6B7D13C8528CE3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
08:50:29.0890 2416 HPZipr12 - ok
08:50:30.0062 2416 [ ABCB05CCDBF03000354B9553820E39F8 ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
08:50:30.0078 2416 HPZius12 - ok
08:50:30.0359 2416 [ 128EF741B2293C36810561092B566B1C ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
08:50:30.0437 2416 HSFHWBS2 - ok
08:50:31.0125 2416 [ 9A0D0C461EF2B3D80CB7875B4B995E47 ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
08:50:31.0140 2416 HSF_DP - ok
08:50:31.0515 2416 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
08:50:31.0531 2416 HTTP - ok
08:50:31.0812 2416 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
08:50:31.0812 2416 HTTPFilter - ok
08:50:31.0984 2416 i2omgmt - ok
08:50:32.0140 2416 i2omp - ok
08:50:32.0328 2416 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:50:32.0328 2416 i8042prt - ok
08:50:33.0062 2416 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
08:50:33.0593 2416 idsvc - ok
08:50:34.0109 2416 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
08:50:34.0109 2416 Imapi - ok
08:50:34.0359 2416 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
08:50:34.0406 2416 ImapiService - ok
08:50:34.0640 2416 ini910u - ok
08:50:34.0859 2416 IntelIde - ok
08:50:35.0062 2416 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
08:50:35.0078 2416 intelppm - ok
08:50:35.0343 2416 [ 3BB22519A194418D5FEC05D800A19AD0 ] ip6fw C:\WINDOWS\system32\drivers\ip6fw.sys
08:50:35.0375 2416 ip6fw - ok
08:50:35.0671 2416 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:50:35.0703 2416 IpFilterDriver - ok
08:50:35.0921 2416 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:50:35.0953 2416 IpInIp - ok
08:50:36.0234 2416 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:50:36.0312 2416 IpNat - ok
08:50:36.0937 2416 [ 57EDB35EA2FECA88F8B17C0C095C9A56 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
08:50:37.0343 2416 iPod Service - ok
08:50:37.0546 2416 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:50:37.0546 2416 IPSec - ok
08:50:37.0703 2416 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
08:50:37.0718 2416 IRENUM - ok
08:50:38.0015 2416 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:50:38.0125 2416 isapnp - ok
08:50:38.0500 2416 [ 0E410EDC8D0527801B899CF29E60597C ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
08:50:38.0578 2416 JavaQuickStarterService - ok
08:50:38.0796 2416 [ 03CA5F0EB17C33D79EF90C4CC21E80DB ] JL2005C C:\WINDOWS\system32\Drivers\jl2005c.sys
08:50:38.0843 2416 JL2005C - ok
08:50:39.0031 2416 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:50:39.0031 2416 Kbdclass - ok
08:50:39.0234 2416 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
08:50:39.0234 2416 kbdhid - ok
08:50:39.0531 2416 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
08:50:39.0531 2416 kmixer - ok
08:50:39.0765 2416 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
08:50:39.0812 2416 KSecDD - ok
08:50:40.0093 2416 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
08:50:40.0140 2416 lanmanserver - ok
08:50:40.0500 2416 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
08:50:40.0578 2416 lanmanworkstation - ok
08:50:40.0734 2416 lbrtfdc - ok
08:50:41.0078 2416 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
08:50:41.0078 2416 LmHosts - ok
08:50:41.0656 2416 [ 9EE18A5A45552673A67532EA37370377 ] ltmodem5 C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
08:50:41.0968 2416 ltmodem5 - ok
08:50:42.0187 2416 [ 59045011F52B81CD411419B558DD50FF ] LxrSII1d C:\WINDOWS\System32\Drivers\LxrSII1d.sys
08:50:42.0187 2416 LxrSII1d - ok
08:50:42.0500 2416 [ 59E32E07B7A362532A9C80774BCA8C28 ] m4cxw2k3 C:\WINDOWS\system32\DRIVERS\m4cxw2k3.sys
08:50:42.0578 2416 m4cxw2k3 - ok
08:50:42.0812 2416 [ C6D085C7045200143528136A43A65FDE ] ManyCam C:\WINDOWS\system32\DRIVERS\ManyCam.sys
08:50:42.0812 2416 ManyCam - ok
08:50:43.0046 2416 [ 5110EDD87E2508F02B922E83A2487DFC ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
08:50:43.0046 2416 mdmxsdk - ok
08:50:43.0312 2416 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
08:50:43.0328 2416 Messenger - ok
08:50:43.0578 2416 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
08:50:43.0578 2416 mnmdd - ok
08:50:43.0796 2416 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\System32\mnmsrvc.exe
08:50:43.0828 2416 mnmsrvc - ok
08:50:44.0078 2416 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
08:50:44.0078 2416 Modem - ok
08:50:44.0281 2416 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:50:44.0296 2416 Mouclass - ok
08:50:45.0218 2416 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:50:45.0218 2416 mouhid - ok
08:50:45.0421 2416 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
08:50:45.0468 2416 MountMgr - ok
08:50:45.0859 2416 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
08:50:45.0921 2416 MozillaMaintenance - ok
08:50:46.0187 2416 [ D993BEA500E7382DC4E760BF4F35EFCB ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys
08:50:46.0281 2416 MpFilter - ok
08:50:46.0437 2416 mraid35x - ok
08:50:46.0750 2416 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:50:46.0765 2416 MRxDAV - ok
08:50:47.0171 2416 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:50:47.0187 2416 MRxSmb - ok
08:50:47.0656 2416 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\System32\msdtc.exe
08:50:47.0671 2416 MSDTC - ok
08:50:47.0937 2416 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
08:50:47.0953 2416 Msfs - ok
08:50:48.0140 2416 MSIServer - ok
08:50:48.0343 2416 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:50:48.0343 2416 MSKSSRV - ok
08:50:48.0562 2416 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:50:48.0562 2416 MSPCLOCK - ok
08:50:48.0718 2416 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
08:50:48.0718 2416 MSPQM - ok
08:50:48.0875 2416 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:50:48.0875 2416 mssmbios - ok
08:50:49.0031 2416 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
08:50:49.0062 2416 MSTEE - ok
08:50:49.0265 2416 [ CA3E22598F411199ADC2DFEE76CD0AE0 ] ms_mpu401 C:\WINDOWS\system32\drivers\msmpu401.sys
08:50:49.0281 2416 ms_mpu401 - ok
08:50:49.0656 2416 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
08:50:49.0718 2416 Mup - ok
08:50:49.0953 2416 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
08:50:50.0000 2416 NABTSFEC - ok
08:50:50.0375 2416 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
08:50:50.0546 2416 napagent - ok
08:50:50.0781 2416 [ E78CE4B8E70CCC1A6E63008C3660867C ] NCHSSVAD C:\WINDOWS\system32\drivers\nchssvad.sys
08:50:50.0796 2416 NCHSSVAD - ok
08:50:51.0062 2416 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
08:50:51.0156 2416 NDIS - ok
08:50:51.0312 2416 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
08:50:51.0312 2416 NdisIP - ok
08:50:51.0500 2416 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:50:51.0500 2416 NdisTapi - ok
08:50:51.0750 2416 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:50:51.0750 2416 Ndisuio - ok
08:50:51.0921 2416 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:50:51.0921 2416 NdisWan - ok
08:50:52.0125 2416 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
08:50:52.0125 2416 NDProxy - ok
08:50:52.0375 2416 [ 69C503C004F49AEE8B8E3067CC047BA7 ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
08:50:52.0421 2416 Net Driver HPZ12 - ok
08:50:52.0921 2416 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
08:50:52.0937 2416 NetBIOS - ok
08:50:53.0187 2416 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
08:50:53.0187 2416 NetBT - ok
08:50:53.0484 2416 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
08:50:53.0546 2416 NetDDE - ok
08:50:53.0781 2416 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
08:50:53.0781 2416 NetDDEdsdm - ok
08:50:53.0937 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
08:50:53.0937 2416 Netlogon - ok
08:50:54.0265 2416 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
08:50:54.0359 2416 Netman - ok
08:50:54.0640 2416 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
08:50:54.0718 2416 NetTcpPortSharing - ok
08:50:54.0906 2416 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
08:50:54.0937 2416 NIC1394 - ok
08:50:55.0265 2416 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
08:50:55.0406 2416 Nla - ok
08:50:55.0625 2416 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
08:50:55.0625 2416 Npfs - ok
08:50:56.0093 2416 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
08:50:56.0375 2416 Ntfs - ok
08:50:56.0578 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\System32\lsass.exe
08:50:56.0578 2416 NtLmSsp - ok
08:50:57.0000 2416 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
08:50:57.0218 2416 NtmsSvc - ok
08:50:57.0421 2416 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
08:50:57.0421 2416 Null - ok
08:50:58.0625 2416 [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:50:58.0656 2416 nv - ok
08:50:58.0843 2416 [ 51635322A7BA00B05977F70B1FFF95BB ] nvax C:\WINDOWS\system32\drivers\nvax.sys
08:50:58.0843 2416 nvax - ok
08:50:59.0062 2416 [ 5155E22DA2F2E1CA4023D00F6EB31B5E ] NVENET C:\WINDOWS\system32\DRIVERS\NVENET.sys
08:50:59.0109 2416 NVENET - ok
08:50:59.0437 2416 [ F9000A5B746CABA368810147CA804E9D ] nvnforce C:\WINDOWS\system32\drivers\nvapu.sys
08:50:59.0437 2416 nvnforce - ok
08:50:59.0656 2416 [ 29291C3A7256337327051CC37E4FC09A ] nv_agp C:\WINDOWS\system32\DRIVERS\nv_agp.sys
08:50:59.0671 2416 nv_agp - ok
08:50:59.0843 2416 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:50:59.0859 2416 NwlnkFlt - ok
08:51:00.0265 2416 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:51:00.0281 2416 NwlnkFwd - ok
08:51:00.0484 2416 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
08:51:00.0515 2416 ohci1394 - ok
08:51:00.0796 2416 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
08:51:00.0796 2416 Parport - ok
08:51:00.0968 2416 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
08:51:00.0984 2416 PartMgr - ok
08:51:01.0187 2416 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
08:51:01.0187 2416 ParVdm - ok
08:51:01.0390 2416 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
08:51:01.0421 2416 PCI - ok
08:51:01.0609 2416 PCIDump - ok
08:51:01.0796 2416 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
08:51:01.0796 2416 PCIIde - ok
08:51:02.0046 2416 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
08:51:02.0109 2416 Pcmcia - ok
08:51:02.0703 2416 [ 984FCAF5834BDEA232822EF5CA20EC4E ] PCToolsSSDMonitorSvc C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
08:51:03.0031 2416 PCToolsSSDMonitorSvc - ok
08:51:03.0250 2416 PDCOMP - ok
08:51:03.0500 2416 PDFRAME - ok
08:51:03.0703 2416 PDRELI - ok
08:51:03.0859 2416 PDRFRAME - ok
08:51:04.0062 2416 perc2 - ok
08:51:04.0218 2416 perc2hib - ok
08:51:04.0781 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
08:51:04.0781 2416 PlugPlay - ok
08:51:05.0218 2416 [ 627FA58ADC043704F9D14CA44340956F ] PMBDeviceInfoProvider C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
08:51:05.0531 2416 PMBDeviceInfoProvider - ok
08:51:05.0875 2416 [ 12B4549D515CB26BB8D375038017CA65 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
08:51:05.0890 2416 Pml Driver HPZ12 - ok
08:51:06.0140 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
08:51:06.0156 2416 PolicyAgent - ok
08:51:06.0406 2416 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:51:06.0406 2416 PptpMiniport - ok
08:51:06.0593 2416 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
08:51:06.0593 2416 Processor - ok
08:51:06.0812 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
08:51:06.0828 2416 ProtectedStorage - ok
08:51:07.0000 2416 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
08:51:07.0000 2416 PSched - ok
08:51:07.0171 2416 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:51:07.0171 2416 Ptilink - ok
08:51:07.0328 2416 ql1080 - ok
08:51:08.0015 2416 Ql10wnt - ok
08:51:08.0187 2416 ql12160 - ok
08:51:08.0359 2416 ql1240 - ok
08:51:08.0562 2416 ql1280 - ok
08:51:09.0046 2416 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:51:09.0062 2416 RasAcd - ok
08:51:10.0671 2416 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
08:51:10.0875 2416 RasAuto - ok
08:51:11.0875 2416 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:51:11.0875 2416 Rasl2tp - ok
08:51:14.0078 2416 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
08:51:14.0390 2416 RasMan - ok
08:51:15.0406 2416 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:51:15.0406 2416 RasPppoe - ok
08:51:16.0515 2416 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
08:51:16.0515 2416 Raspti - ok
08:51:17.0906 2416 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:51:17.0921 2416 Rdbss - ok
08:51:19.0578 2416 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:51:19.0578 2416 RDPCDD - ok
08:51:21.0734 2416 [ 6589DB6E5969F8EEE594CF71171C5028 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
08:51:21.0968 2416 RDPWD - ok
08:51:23.0500 2416 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
08:51:23.0828 2416 RDSessMgr - ok
08:51:25.0375 2416 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
08:51:25.0375 2416 redbook - ok
08:51:27.0125 2416 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
08:51:27.0328 2416 RemoteAccess - ok
08:51:28.0265 2416 [ 4F4A4C09CC5BE58A76CAC1C337E004E6 ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys
08:51:28.0296 2416 RimUsb - ok
08:51:39.0703 2416 [ 3A5633AD615E2B15291BD0B1B97CCD8A ] RimVSerPort C:\WINDOWS\system32\DRIVERS\RimSerial.sys
08:51:39.0703 2416 RimVSerPort - ok
08:51:43.0687 2416 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys
08:51:43.0687 2416 ROOTMODEM - ok
08:51:43.0953 2416 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\System32\locator.exe
08:51:44.0015 2416 RpcLocator - ok
08:51:44.0640 2416 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
08:51:44.0640 2416 RpcSs - ok
08:51:45.0593 2416 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\System32\rsvp.exe
08:51:45.0656 2416 RSVP - ok
08:51:46.0093 2416 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
08:51:46.0109 2416 rtl8139 - ok
08:51:46.0562 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
08:51:46.0562 2416 SamSs - ok
08:51:46.0875 2416 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
08:51:46.0921 2416 SCardSvr - ok
08:51:47.0531 2416 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
08:51:47.0625 2416 Schedule - ok
08:51:48.0187 2416 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:51:48.0203 2416 Secdrv - ok
08:51:48.0750 2416 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
08:51:48.0750 2416 seclogon - ok
08:51:49.0546 2416 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
08:51:49.0562 2416 SENS - ok
08:51:49.0875 2416 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
08:51:49.0875 2416 serenum - ok
08:51:50.0343 2416 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
08:51:50.0359 2416 Serial - ok
08:51:51.0187 2416 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
08:51:51.0234 2416 Sfloppy - ok
08:51:51.0781 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
08:51:51.0812 2416 ShellHWDetection - ok
08:51:52.0093 2416 Simbad - ok
08:51:52.0484 2416 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
08:51:52.0500 2416 SLIP - ok
08:51:52.0968 2416 Sparrow - ok
08:51:53.0250 2416 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
08:51:53.0250 2416 splitter - ok
08:51:53.0781 2416 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
08:51:53.0812 2416 Spooler - ok
08:51:54.0265 2416 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\System32\DRIVERS\sr.sys
08:51:54.0296 2416 sr - ok
08:51:54.0875 2416 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
08:51:54.0953 2416 srservice - ok
08:51:55.0484 2416 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
08:51:55.0484 2416 Srv - ok
08:51:56.0031 2416 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
08:51:56.0062 2416 SSDPSRV - ok
08:51:56.0750 2416 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
08:51:56.0890 2416 stisvc - ok
08:51:57.0359 2416 [ 922E268AE143A04BBFE9AA08B13B42FB ] StixKB C:\WINDOWS\system32\Drivers\StixKB.sys
08:51:57.0359 2416 StixKB - ok
08:51:58.0109 2416 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
08:51:58.0203 2416 streamip - ok
08:51:58.0734 2416 [ D8CBD8B4BF4DC9CD64B5CC8E2BEC1B96 ] SunkFilt C:\WINDOWS\System32\Drivers\sunkfilt.sys
08:51:58.0750 2416 SunkFilt - ok
08:51:59.0015 2416 [ FABCC3BEC89A2853958CEFB28943C470 ] SunkFilt39 C:\WINDOWS\System32\Drivers\sunkfilt39.sys
08:51:59.0062 2416 SunkFilt39 - ok
08:51:59.0375 2416 Sunkfiltp - ok
08:51:59.0656 2416 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
08:51:59.0656 2416 swenum - ok
08:52:00.0046 2416 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
08:52:00.0046 2416 swmidi - ok
08:52:00.0296 2416 SwPrv - ok
08:52:00.0859 2416 symc810 - ok
08:52:01.0140 2416 symc8xx - ok
08:52:01.0390 2416 sym_hi - ok
08:52:01.0750 2416 sym_u3 - ok
08:52:02.0062 2416 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
08:52:02.0062 2416 sysaudio - ok
08:52:02.0843 2416 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
08:52:02.0890 2416 SysmonLog - ok
08:52:03.0531 2416 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
08:52:03.0640 2416 TapiSrv - ok
08:52:04.0078 2416 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:52:04.0078 2416 Tcpip - ok
08:52:04.0656 2416 [ 4E53BBCC4BE37D7A4BD6EF1098C89FF7 ] Tcpip6 C:\WINDOWS\system32\DRIVERS\tcpip6.sys
08:52:04.0656 2416 Tcpip6 - ok
08:52:04.0968 2416 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
08:52:04.0984 2416 TDPIPE - ok
08:52:05.0234 2416 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
08:52:05.0281 2416 TDTCP - ok
08:52:05.0531 2416 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
08:52:05.0531 2416 TermDD - ok
08:52:06.0203 2416 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
08:52:06.0328 2416 TermService - ok
08:52:06.0812 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
08:52:06.0812 2416 Themes - ok
08:52:08.0000 2416 TosIde - ok
08:52:08.0578 2416 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
08:52:08.0656 2416 TrkWks - ok
08:52:09.0109 2416 [ 8F861EDA21C05857EB8197300A92501C ] tunmp C:\WINDOWS\system32\DRIVERS\tunmp.sys
08:52:09.0109 2416 tunmp - ok
08:52:09.0578 2416 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
08:52:09.0625 2416 Udfs - ok
08:52:09.0859 2416 ultra - ok
08:52:10.0406 2416 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
08:52:10.0421 2416 Update - ok
08:52:10.0953 2416 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
08:52:11.0062 2416 upnphost - ok
08:52:11.0515 2416 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
08:52:11.0531 2416 UPS - ok
08:52:11.0937 2416 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
08:52:11.0968 2416 USBAAPL - ok
08:52:12.0406 2416 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
08:52:12.0437 2416 usbaudio - ok
08:52:12.0828 2416 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:52:12.0828 2416 usbccgp - ok
08:52:13.0203 2416 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:52:13.0203 2416 usbehci - ok
08:52:13.0656 2416 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:52:13.0656 2416 usbhub - ok
08:52:13.0906 2416 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
08:52:13.0953 2416 usbohci - ok
08:52:14.0390 2416 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
08:52:14.0406 2416 usbprint - ok
08:52:14.0796 2416 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
08:52:14.0796 2416 usbscan - ok
08:52:15.0062 2416 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:52:15.0093 2416 usbstor - ok
08:52:15.0468 2416 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
08:52:15.0484 2416 usbuhci - ok
08:52:15.0750 2416 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
08:52:15.0812 2416 usbvideo - ok
08:52:16.0218 2416 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
08:52:16.0218 2416 usb_rndisx - ok
08:52:16.0671 2416 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
08:52:16.0671 2416 VgaSave - ok
08:52:17.0031 2416 ViaIde - ok
08:52:17.0406 2416 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
08:52:17.0453 2416 VolSnap - ok
08:52:18.0031 2416 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
08:52:18.0187 2416 VSS - ok
08:52:18.0828 2416 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
08:52:18.0906 2416 W32Time - ok
08:52:19.0437 2416 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:52:19.0437 2416 Wanarp - ok
08:52:19.0671 2416 wanatw - ok
08:52:20.0609 2416 [ EE8A9734B448836B0127C76066119E9C ] WCMVCAM C:\WINDOWS\system32\DRIVERS\wcmvcam.sys
08:52:20.0625 2416 WCMVCAM - ok
08:52:21.0296 2416 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys
08:52:21.0546 2416 Wdf01000 - ok
08:52:21.0765 2416 WDICA - ok
08:52:22.0171 2416 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
08:52:22.0171 2416 wdmaud - ok
08:52:22.0656 2416 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
08:52:22.0687 2416 WebClient - ok
08:52:23.0375 2416 [ CE545A84BF3411E7516FA8DA51AD9D93 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
08:52:23.0390 2416 winachsf - ok
08:52:24.0234 2416 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
08:52:24.0296 2416 winmgmt - ok
08:52:25.0312 2416 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
08:52:25.0328 2416 WmdmPmSN - ok
08:52:25.0953 2416 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\System32\wbem\wmiapsrv.exe
08:52:26.0015 2416 WmiApSrv - ok
08:52:26.0359 2416 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
08:52:26.0390 2416 WpdUsb - ok
08:52:26.0828 2416 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
08:52:26.0828 2416 WSTCODEC - ok
08:52:27.0265 2416 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
08:52:27.0343 2416 WudfPf - ok
08:52:27.0703 2416 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
08:52:27.0750 2416 WudfRd - ok
08:52:28.0312 2416 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
08:52:28.0546 2416 WudfSvc - ok
08:52:29.0250 2416 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
08:52:29.0515 2416 WZCSVC - ok
08:52:30.0171 2416 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
08:52:30.0281 2416 xmlprov - ok
08:52:31.0093 2416 ================ Scan global ===============================
08:52:31.0390 2416 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
08:52:31.0625 2416 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
08:52:31.0953 2416 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
08:52:32.0046 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
08:52:32.0046 2416 [Global] - ok
08:52:32.0046 2416 ================ Scan MBR ==================================
08:52:32.0078 2416 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
08:52:33.0953 2416 \Device\Harddisk0\DR0 - ok
08:52:33.0968 2416 ================ Scan VBR ==================================
08:52:33.0984 2416 [ EDB9A725E0E559C0E3A90447D0646861 ] \Device\Harddisk0\DR0\Partition1
08:52:34.0000 2416 \Device\Harddisk0\DR0\Partition1 - ok
08:52:34.0000 2416 ============================================================
08:52:34.0000 2416 Scan finished
08:52:34.0000 2416 ============================================================
08:52:34.0140 2404 Detected object count: 1
08:52:34.0140 2404 Actual detected object count: 1
08:53:25.0671 2404 C:\WINDOWS\System32\Drivers\293d6de7839e4273.sys - copied to quarantine
08:53:26.0140 2404 HKLM\SYSTEM\ControlSet001\services\293d6de7839e4273 - will be deleted on reboot
08:53:27.0187 2404 HKLM\SYSTEM\ControlSet002\services\293d6de7839e4273 - will be deleted on reboot
08:53:31.0640 2404 C:\WINDOWS\System32\Drivers\293d6de7839e4273.sys - will be deleted on reboot
08:53:31.0640 2404 293d6de7839e4273 ( Rootkit.Win32.Necurs.gen ) - User select action: Delete
08:54:04.0156 2168 Deinitialize success

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_35
Run by [removed] at 9:03:22 on 2012-10-10
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1471.1035 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\zHotkey.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Owner\hunizeakezif.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
\\.\globalroot\systemroot\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\U
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
mStart Page = hxxp://start.funmoods.com/?f=1&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Funmoods Helper Object: {75ebb0aa-4214-4cb4-90ec-e3e07ecd04f7} - c:\progra~1\funmoods\1.5.23.22\bh\escort.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Funmoods Toolbar: {a4c272ec-ed9e-4ace-a6f2-9558c7f29ef3} - c:\progra~1\funmoods\1.5.23.22\escorTlbr.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [hunizeakezif] c:\documents and settings\owner\hunizeakezif.exe
uRun: [LxrAutorun] c:\documents and settings\owner\local settings\application data\lexar media\LxrAutorun.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [nForce Tray Options] sstray.exe /r
mRun: [CHotkey] zHotkey.exe
mRun: [ShowWnd] ShowWnd.exe
mRun: [SunKistEM] c:\program files\digital media reader\shwiconem.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [Regedit32] c:\windows\system32\regedit.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://www.walmartphotocentre.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E8675A5B-36B4-40F8-8948-43E5279831FC} : DhcpNameServer = 192.168.1.1
Handler: intu-tt2010 - {97A0575E-2309-4e75-8509-B1F9390C4DE7} - c:\program files\turbotax 2010\ic2010pp.dll
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files\turbotax 2011\ic2011pp.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\u4qtwskk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\owner\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_278.dll
.
—- FIREFOX POLICIES —-
FF - user.js: extensions.funmoods.hmpg - true
FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
FF - user.js: extensions.funmoods.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/?f=3&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304&q=
FF - user.js: extensions.funmoods.id - 0040CA895DA756EF
FF - user.js: extensions.funmoods.instlDay - 15561
FF - user.js: extensions.funmoods.vrsn - 1.5.23.22
FF - user.js: extensions.funmoods.vrsni - 1.5.23.22
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2214:51:50
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - axl
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef - axl
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods.envrmnt - production
FF - user.js: extensions.funmoods.isdcmntcmplt - true
FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0
.
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-3-20 171064]
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\common files\magix services\database\bin\FABS.exe [2009-8-27 1253376]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-7-27 54752]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [2012-9-4 63448]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2010-7-8 632792]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\sony\pmb\PMBDeviceInfoProvider.exe [2009-10-24 360224]
R3 m4cxw2k3;NDIS5.1 Miniport Driver for D-Link PCI Express Ethernet Controller;c:\windows\system32\drivers\m4cxw2k3.sys [2007-2-15 250752]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]
R3 StixKB;Stix Virtual Keybord Driver;c:\windows\system32\drivers\StixKB.sys [2008-6-3 6656]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [2011-6-23 1068216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-5-26 250808]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\common files\magix services\database\bin\fbserver.exe [2008-8-7 3276800]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 114144]
.
=============== Created Last 30 ================
.
2012-10-10 12:53:25 ——– d—–w- C:\TDSSKiller_Quarantine
2012-10-09 22:00:11 ——– d—–w- c:\program files\SystemRequirementsLab
2012-10-08 21:09:33 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-08 21:09:33 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-09-15 17:13:29 ——– d—–w- c:\documents and settings\owner\local settings\application data\Research In Motion
2012-09-15 17:13:21 ——– d—–w- c:\documents and settings\owner\application data\Research In Motion
2012-09-15 17:08:15 ——– d—–w- c:\documents and settings\all users\application data\Research In Motion
2012-09-15 17:06:20 ——– d—–w- c:\program files\common files\XCPCSync.OEM
2012-09-15 17:06:20 ——– d—–w- c:\program files\common files\Research In Motion
2012-09-15 17:06:19 ——– d—–w- c:\program files\Research In Motion
2012-09-15 14:53:19 35328 —-a-r- c:\windows\system32\drivers\RimSerial.sys
2012-09-15 14:53:00 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
.
==================== Find3M ====================
.
2012-10-08 21:42:34 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 21:42:33 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 21:08:40 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-10 13:22:12 101312 —-a-w- c:\documents and settings\owner\hunizeakezif.exe
.
============= FINISH: 9:05:34.79 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7/9/2008 4:25:24 AM
System Uptime: 10/10/2012 8:55:08 AM (1 hours ago)
.
Motherboard: First International Computer, Inc. | | AU31
Processor: AMD Athlon™ | Socket A | 1102/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 100.735 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: NVIDIA nForce MCP Networking Controller
Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_904D1509&REV_A1\3&13C0B0C5&0&20
Manufacturer: Nvidia
Name: NVIDIA nForce MCP Networking Controller
PNP Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_904D1509&REV_A1\3&13C0B0C5&0&20
Service: NVENET
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
µTorrent
32 Bit HP CIO Components Installer
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4)
Adobe Shockwave Player 11.6
AIO_Scan
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ASIO4ALL
Auslogics Disk Defrag
BlackBerry Desktop Software 7.1
Bonjour
BufferChm
CCleaner
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
D-Link DGE-530T
D1600
DeviceDiscovery
Digital Media Reader
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
DJ_SF_06_D1600_SW_Min
ESET Online Scanner v3
Express Burn
Express Rip
F4100
F4100_doccd
F4100_Help
Firebird SQL Server - MAGIX Edition
FL Studio 10
FrostWire 4.21.5
Golive2 Sphere 1.0.6
Google Chrome
Google Toolbar for Internet Explorer
GPBaseService2
Highlight Viewer (Windows Live Toolbar)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 14.0
HP Deskjet All-In-One Software 9.0
HP Deskjet D1600 Printer Driver Software 14.0 Rel. 6
HP Imaging Device Functions 14.0
HP Photo Creations
HP Photosmart and Deskjet 7.0 Software
HP Photosmart Essential
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
hph_readme
hph_software
hph_software_req
HPPhotoSmartExpress
HPProductAssistant
HPSSupply
iTunes
Java Auto Updater
Java™ 6 Update 35
Junk Mail filter update
LiveUpdate 1.90 (Symantec Corporation)
Malwarebytes Anti-Malware version 1.60.0.1800
ManyCam 2.6.60 (remove only)
Map Button (Windows Live Toolbar)
MarketResearch
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft Picture It! Photo Premium 9
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Mozilla Firefox 15.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML4SP2
Multimedia Keyboard Driver
Nero BurnRights
NVIDIA Display Driver
NVIDIA Ethernet Driver
NVIDIA nForce Drivers
PeaZip 4.7.1
PMB
PSSWCORE
QuickTime
RealPlayer Basic
Scan
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
Shop for HP Supplies
Smart Menus (Windows Live Toolbar)
SmartWebPrinting
Soap 3.0 Toolkit
SoftV92 Data Fax Modem with SmartCP
SolutionCenter
Star Wars Image Master
Status
swMSM
System Requirements Lab CYRI
Text-To-Speech-Runtime
Toolbox
TrayApp
TurboTax 2010
TurboTax 2011
UCreate Games and Artimation
UFile 2006
UFile 2007
UFile 2008
UFile 2009
UFile Updater 2006
UFile Updater 2007
UFile Updater 2008
UFile Updater 2009
Uninstall Dual Mode Camera
Unity Web Player
Unload
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB953356)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VideoToolkit01
VLC media player 2.0.0
VVVVVV version 2.0
WebEx Support Manager for Internet Explorer
WebFldrs XP
WebReg
Windows Backup Utility
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Favorites for Windows Live Toolbar
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 11
Windows Movie Maker 2.0
Windows XP Service Pack 3
Wizard101
Yahoo! Detect
Zac Browser English
.
==== Event Viewer Messages From Past Week ========
.
10/8/2012 9:03:17 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Startup and Shutdown Monitor service service to connect.
10/5/2012 3:54:37 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/5/2012 3:45:30 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Java Quick Starter service to connect.
10/5/2012 3:45:30 PM, error: Service Control Manager [7000] - The Java Quick Starter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/4/2012 9:19:28 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter
10/4/2012 9:19:24 AM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
10/4/2012 9:19:24 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HP CUE DeviceDiscovery Service service to connect.
10/4/2012 9:19:24 AM, error: Service Control Manager [7000] - The WebcamMax, WDM Video Capture service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
10/4/2012 9:19:24 AM, error: Service Control Manager [7000] - The Secure II Driver service failed to start due to the following error: A device attached to the system is not functioning.
10/4/2012 9:19:24 AM, error: Service Control Manager [7000] - The HP CUE DeviceDiscovery Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/3/2012 5:44:42 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
10/3/2012 5:44:42 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/3/2012 5:44:41 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
10/10/2012 9:00:54 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: agp440
.
==== End Of File ===========================

ComboFix 12-10-10.02 - Owner 10/10/2012 10:47:32.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1471.1049 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Owner\Application Data\.#
c:\documents and settings\Owner\Application Data\.#\MBX@370@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@370@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@370@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@4E0@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@4E0@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@4E0@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@850@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@850@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@850@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@9E0@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@9E0@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@9E0@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@B24@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@B24@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@B24@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@BD0@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@BD0@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@BD0@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@BE0@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@BE0@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@BE0@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@BE8@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@BE8@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@BE8@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@C0C@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@C0C@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@C0C@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@C28@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@C28@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@C28@384248.###
c:\documents and settings\Owner\Application Data\.#\MBX@C68@3841E8.###
c:\documents and settings\Owner\Application Data\.#\MBX@C68@384218.###
c:\documents and settings\Owner\Application Data\.#\MBX@C68@384248.###
c:\documents and settings\Owner\hunizeakezif.exe
c:\documents and settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}
c:\documents and settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\@
c:\documents and settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\n
c:\documents and settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\00000001.@
c:\documents and settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\80000000.@
c:\documents and settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\800000cb.@
c:\documents and settings\Owner\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
c:\program files\Mozilla Firefox\components\AskHPRFF.js
c:\windows\help\wmplayer.bak
c:\windows\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}
c:\windows\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\@
c:\windows\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\n
c:\windows\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\00000001.@
c:\windows\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\80000000.@
c:\windows\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\800000cb.@
c:\windows\system32\AutoRun.inf
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\sstray.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-09-10 to 2012-10-10 )))))))))))))))))))))))))))))))
.
.
2012-10-10 12:53 . 2012-10-10 12:53 ——– d—–w- C:\TDSSKiller_Quarantine
2012-10-09 22:00 . 2012-10-09 22:00 ——– d—–w- c:\program files\SystemRequirementsLab
2012-10-09 22:00 . 2012-10-09 22:00 ——– d—–w- c:\documents and settings\Owner\Application Data\SystemRequirementsLab
2012-10-08 21:10 . 2012-10-08 21:10 ——– d—–w- c:\program files\Common Files\Java
2012-10-08 21:09 . 2012-10-08 21:08 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-08 21:09 . 2012-10-08 21:08 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-09-15 17:13 . 2012-09-15 17:13 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Research In Motion
2012-09-15 17:13 . 2012-09-15 17:16 ——– d—–w- c:\documents and settings\Owner\Application Data\Research In Motion
2012-09-15 17:08 . 2012-09-15 17:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2012-09-15 17:06 . 2012-09-15 17:08 ——– d—–w- c:\program files\Common Files\Research In Motion
2012-09-15 17:06 . 2012-09-15 17:08 ——– d—–w- c:\program files\Common Files\XCPCSync.OEM
2012-09-15 17:06 . 2012-09-15 17:06 ——– d—–w- c:\program files\Research In Motion
2012-09-15 14:53 . 2011-07-20 18:13 35328 —-a-r- c:\windows\system32\drivers\RimSerial.sys
2012-09-15 14:53 . 2008-03-21 17:57 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 21:42 . 2012-05-26 14:01 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 21:42 . 2011-07-04 16:00 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 21:08 . 2010-06-23 00:34 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-09-14 04:31 . 2012-09-14 04:31 266720 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-03-03 46080]
"CHotkey"="zHotkey.exe" [2004-05-18 543232]
"ShowWnd"="ShowWnd.exe" [2003-09-19 36864]
"SunKistEM"="c:\program files\Digital Media Reader\shwiconem.exe" [2004-03-11 135168]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-03-27 09:09 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 21:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMBVolumeWatcher]
2010-03-24 19:42 599328 —-a-w- c:\program files\Sony\PMB\PMBVolumeWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-11-02 06:00 90448 —-a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [8/27/2009 6:09 PM 1253376]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [9/4/2012 9:45 AM 63448]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [7/8/2010 7:39 PM 632792]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [10/24/2009 3:18 AM 360224]
R3 m4cxw2k3;NDIS5.1 Miniport Driver for D-Link PCI Express Ethernet Controller;c:\windows\system32\drivers\m4cxw2k3.sys [2/15/2007 8:04 AM 250752]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 6:06 AM 21632]
R3 StixKB;Stix Virtual Keybord Driver;c:\windows\system32\drivers\StixKB.sys [6/3/2008 12:00 PM 6656]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [6/23/2011 2:43 AM 1068216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [5/26/2012 10:01 AM 250808]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [8/7/2008 12:10 PM 3276800]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/25/2012 2:01 PM 114144]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - BITS
*NewlyCreated* - WS2IFSL
*NewlyCreated* - WUAUSERV
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-26 21:42]
.
2012-10-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1290437929-3326408694-2755336205-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-19 01:21]
.
2012-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1290437929-3326408694-2755336205-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-19 01:21]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2012-08-12 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 21:03]
.
2008-07-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-01-03 01:17]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://start.funmoods.com/?f=1&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
TCP: DhcpNameServer = 192.168.1.1
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files\TurboTax 2011\ic2011pp.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\u4qtwskk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.funmoods.hmpg - true
FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
FF - user.js: extensions.funmoods.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/?f=3&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304&q=
FF - user.js: extensions.funmoods.id - 0040CA895DA756EF
FF - user.js: extensions.funmoods.instlDay - 15561
FF - user.js: extensions.funmoods.vrsn - 1.5.23.22
FF - user.js: extensions.funmoods.vrsni - 1.5.23.22
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2214:51
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - axl
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef - axl
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods.envrmnt - production
FF - user.js: extensions.funmoods.isdcmntcmplt - true
FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-hunizeakezif - c:\documents and settings\Owner\hunizeakezif.exe
HKCU-Run-LxrAutorun - c:\documents and settings\Owner\Local Settings\Application Data\Lexar Media\LxrAutorun.exe
HKLM-Run-nForce Tray Options - sstray.exe
SafeBoot-05713673.sys
SafeBoot-MsMpSvc
MSConfigStartUp-CTFMON - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-10 11:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1212)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\zHotkey.exe
.
**************************************************************************
.
Completion time: 2012-10-10 11:32:41 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-10 15:32
.
Pre-Run: 108,082,900,992 bytes free
Post-Run: 110,176,329,728 bytes free
.
- - End Of File - - 805A4895151270A8347833916BE65516

The computer is running fine, Windows Update and Microsoft Security Essentials are back to running normally too.

ComboFix 12-10-11.03 - Owner 10/11/2012 9:04.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1471.982 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((( Files Created from 2012-09-11 to 2012-10-11 )))))))))))))))))))))))))))))))
.
.
2012-10-10 12:53 . 2012-10-10 12:53 ——– d—–w- C:\TDSSKiller_Quarantine
2012-10-09 22:00 . 2012-10-09 22:00 ——– d—–w- c:\program files\SystemRequirementsLab
2012-10-09 22:00 . 2012-10-09 22:00 ——– d—–w- c:\documents and settings\Owner\Application Data\SystemRequirementsLab
2012-10-08 21:10 . 2012-10-08 21:10 ——– d—–w- c:\program files\Common Files\Java
2012-10-08 21:09 . 2012-10-08 21:08 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-08 21:09 . 2012-10-08 21:08 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-09-15 17:13 . 2012-09-15 17:13 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Research In Motion
2012-09-15 17:13 . 2012-09-15 17:16 ——– d—–w- c:\documents and settings\Owner\Application Data\Research In Motion
2012-09-15 17:08 . 2012-09-15 17:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2012-09-15 17:06 . 2012-09-15 17:08 ——– d—–w- c:\program files\Common Files\Research In Motion
2012-09-15 17:06 . 2012-09-15 17:08 ——– d—–w- c:\program files\Common Files\XCPCSync.OEM
2012-09-15 17:06 . 2012-09-15 17:06 ——– d—–w- c:\program files\Research In Motion
2012-09-15 14:53 . 2011-07-20 18:13 35328 —-a-r- c:\windows\system32\drivers\RimSerial.sys
2012-09-15 14:53 . 2008-03-21 17:57 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 21:42 . 2012-05-26 14:01 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 21:42 . 2011-07-04 16:00 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 21:08 . 2010-06-23 00:34 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-31 02:03 . 2012-03-21 00:44 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14 . 2006-06-23 15:33 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2003-01-03 11:41 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2003-01-03 11:41 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2003-01-03 11:42 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2003-01-03 11:41 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2002-08-29 01:04 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-09-14 04:31 . 2012-09-14 04:31 266720 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-03-03 46080]
"CHotkey"="zHotkey.exe" [2004-05-18 543232]
"ShowWnd"="ShowWnd.exe" [2003-09-19 36864]
"SunKistEM"="c:\program files\Digital Media Reader\shwiconem.exe" [2004-03-11 135168]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-03-27 09:09 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 21:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMBVolumeWatcher]
2010-03-24 19:42 599328 —-a-w- c:\program files\Sony\PMB\PMBVolumeWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-11-02 06:00 90448 —-a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [8/27/2009 6:09 PM 1253376]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [9/4/2012 9:45 AM 63448]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [7/8/2010 7:39 PM 632792]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [10/24/2009 3:18 AM 360224]
R3 m4cxw2k3;NDIS5.1 Miniport Driver for D-Link PCI Express Ethernet Controller;c:\windows\system32\drivers\m4cxw2k3.sys [2/15/2007 8:04 AM 250752]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 6:06 AM 21632]
R3 StixKB;Stix Virtual Keybord Driver;c:\windows\system32\drivers\StixKB.sys [6/3/2008 12:00 PM 6656]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [6/23/2011 2:43 AM 1068216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [5/26/2012 10:01 AM 250808]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [8/7/2008 12:10 PM 3276800]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/25/2012 2:01 PM 114144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-26 21:42]
.
2012-10-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1290437929-3326408694-2755336205-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-19 01:21]
.
2012-10-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1290437929-3326408694-2755336205-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-19 01:21]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2012-10-11 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 21:25]
.
2008-07-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-01-03 01:17]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
TCP: DhcpNameServer = 192.168.1.1
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files\TurboTax 2011\ic2011pp.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\u4qtwskk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.funmoods.hmpg - true
FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
FF - user.js: extensions.funmoods.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304
FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/?f=3&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDyEtD0C0AzzzyyD0D0AyByDyC0E0FtN0D0Tzu0CtBtBtBtN1L2Xzut
BtFtCtFtCtFtAtCtB&cr=1568723304&q=
FF - user.js: extensions.funmoods.id - 0040CA895DA756EF
FF - user.js: extensions.funmoods.instlDay - 15561
FF - user.js: extensions.funmoods.vrsn - 1.5.23.22
FF - user.js: extensions.funmoods.vrsni - 1.5.23.22
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2214:51
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - axl
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef - axl
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods.envrmnt - production
FF - user.js: extensions.funmoods.isdcmntcmplt - true
FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-11 09:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3444)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-10-11 09:25:40
ComboFix-quarantined-files.txt 2012-10-11 13:25
ComboFix2.txt 2012-10-10 15:32
.
Pre-Run: 110,041,702,400 bytes free
Post-Run: 110,057,762,816 bytes free
.
- - End Of File - - 38D23943F6116C609B85D85A88D3B84E

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Database version: v2012.10.11.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Owner :: LAMOUREUX [administrator]

10/11/2012 9:41:55 AM
mbam-log-2012-10-11 (09-41-55).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 198753
Time elapsed: 11 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 13
HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\escort.escortIEPane (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\f (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCU\Software\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Documents and Settings\Owner\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.

(end)

C:\Documents and Settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\17\1ed1eb51-5d3c6984 a variant of Java/Exploit.Agent.AN trojan
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\7\233f6ec7-14047019 Java/Exploit.CVE-2012-1723.AP trojan
C:\Documents and Settings\Owner\Desktop\iLividSetupV1.exe Win32/Toolbar.SearchSuite application
C:\Qoobox\Quarantine\C\Documents and Settings\Owner\hunizeakezif.exe.vir a variant of Win32/Kryptik.AJTM trojan
C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\n.vir Win32/Sirefef.EV trojan
C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\80000000.@.vir Win32/Sirefef.FA trojan
C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Local Settings\Application Data\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\800000cb.@.vir probably a variant of Win32/Agent.TEO trojan
C:\Qoobox\Quarantine\C\WINDOWS\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\n.vir Win32/Sirefef.EV trojan
C:\Qoobox\Quarantine\C\WINDOWS\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\80000000.@.vir Win32/Sirefef.FA trojan
C:\Qoobox\Quarantine\C\WINDOWS\Installer\{cccce82c-25bf-9857-47be-efdf57ce772f}\U\800000cb.@.vir probably a variant of Win32/Agent.TEO trojan
C:\TDSSKiller_Quarantine\10.10.2012_08.47.16\necurs0000\svc0000\tsk0000.dta a variant of Win32/Rootkit.Kryptik.NO trojan

ComboFix 12-10-11.03 - Owner 10/11/2012 20:50:30.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1471.926 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll"
"c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\17\1ed1eb51-5d3c6984"
"c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\7\233f6ec7-14047019"
"c:\documents and settings\Owner\Desktop\iLividSetupV1.exe"
.
.
((((((((((((((((((((((((( Files Created from 2012-09-12 to 2012-10-12 )))))))))))))))))))))))))))))))
.
.
2012-10-11 20:49 . 2012-08-30 05:17 6980552 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{40D98C7A-74FD-4A90-BBB5-EDDA9C53F8E2}\mpengine.dll
2012-10-11 20:28 . 2012-06-29 08:44 6891424 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-10 12:53 . 2012-10-10 12:53 ——– d—–w- C:\TDSSKiller_Quarantine
2012-10-09 22:00 . 2012-10-09 22:00 ——– d—–w- c:\program files\SystemRequirementsLab
2012-10-09 22:00 . 2012-10-09 22:00 ——– d—–w- c:\documents and settings\Owner\Application Data\SystemRequirementsLab
2012-10-08 21:10 . 2012-10-08 21:10 ——– d—–w- c:\program files\Common Files\Java
2012-10-08 21:09 . 2012-10-08 21:08 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-08 21:09 . 2012-10-08 21:08 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-09-15 17:13 . 2012-09-15 17:13 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Research In Motion
2012-09-15 17:13 . 2012-09-15 17:16 ——– d—–w- c:\documents and settings\Owner\Application Data\Research In Motion
2012-09-15 17:08 . 2012-09-15 17:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Research In Motion
2012-09-15 17:06 . 2012-09-15 17:08 ——– d—–w- c:\program files\Common Files\Research In Motion
2012-09-15 17:06 . 2012-09-15 17:08 ——– d—–w- c:\program files\Common Files\XCPCSync.OEM
2012-09-15 17:06 . 2012-09-15 17:06 ——– d—–w- c:\program files\Research In Motion
2012-09-15 14:53 . 2011-07-20 18:13 35328 —-a-r- c:\windows\system32\drivers\RimSerial.sys
2012-09-15 14:53 . 2008-03-21 17:57 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 21:42 . 2012-05-26 14:01 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 21:42 . 2011-07-04 16:00 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 21:08 . 2010-06-23 00:34 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-09-07 21:04 . 2010-08-16 17:53 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 02:03 . 2012-03-21 00:44 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14 . 2006-06-23 15:33 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2003-01-03 11:41 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2003-01-03 11:41 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2003-01-03 11:42 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2003-01-03 11:41 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2002-08-29 01:04 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-09-14 04:31 . 2012-09-14 04:31 266720 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-03-03 46080]
"CHotkey"="zHotkey.exe" [2004-05-18 543232]
"ShowWnd"="ShowWnd.exe" [2003-09-19 36864]
"SunKistEM"="c:\program files\Digital Media Reader\shwiconem.exe" [2004-03-11 135168]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-03-27 09:09 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 21:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMBVolumeWatcher]
2010-03-24 19:42 599328 —-a-w- c:\program files\Sony\PMB\PMBVolumeWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-11-02 06:00 90448 —-a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
.
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [8/27/2009 6:09 PM 1253376]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [9/4/2012 9:45 AM 63448]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [7/8/2010 7:39 PM 632792]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [10/24/2009 3:18 AM 360224]
R3 m4cxw2k3;NDIS5.1 Miniport Driver for D-Link PCI Express Ethernet Controller;c:\windows\system32\drivers\m4cxw2k3.sys [2/15/2007 8:04 AM 250752]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 6:06 AM 21632]
R3 StixKB;Stix Virtual Keybord Driver;c:\windows\system32\drivers\StixKB.sys [6/3/2008 12:00 PM 6656]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [6/23/2011 2:43 AM 1068216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [5/26/2012 10:01 AM 250808]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [8/7/2008 12:10 PM 3276800]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/25/2012 2:01 PM 114144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-26 21:42]
.
2012-10-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1290437929-3326408694-2755336205-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-19 01:21]
.
2012-10-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1290437929-3326408694-2755336205-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-19 01:21]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2008-07-09 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-01-03 00:12]
.
2012-10-11 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 21:25]
.
2008-07-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-01-03 01:17]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
TCP: DhcpNameServer = 192.168.1.1
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files\TurboTax 2011\ic2011pp.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\u4qtwskk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-11 21:07
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2940)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-10-11 21:11:36
ComboFix-quarantined-files.txt 2012-10-12 01:11
ComboFix2.txt 2012-10-11 13:25
ComboFix3.txt 2012-10-10 15:32
.
Pre-Run: 108,147,859,456 bytes free
Post-Run: 108,144,349,184 bytes free
.
- - End Of File - - D925D4A1024A63E6D17BF3587A615376