What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Resuming topic of mega mega comp probs. [Closed]

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
So my flash is all messed up. As of now it is jumpy and no sound. Any help would be greatly appreciated. I need my computer for work and I'm about to be up poop creek.

Thanks,
Alexander

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:54:09 AM, on 2/7/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\lointusk\My Documents\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&…;ctid=CT3227981
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.313\McAfeeMSS_IE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\lointusk\Application Data\Dropbox\bin\Dropbox.exe
O4 - Global Startup: HiCDEject.lnk = C:\Program Files\HiCDEject\HiCDEject.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.313\SSScheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C2F8020-1F67-43A0-B7E4-678FBBA60FBA}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{58FA7B8E-4E10-4456-906A-8DF7B9D15259}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{595FCF1C-C74B-46AE-B3B1-6CD47E0297D6}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A9C593A-3C2B-4D4A-9DBD-6DB76CA920C6}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DF4D200-5EF5-45C5-B945-C7DFAE8DE4FA}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F9D5D91-3B90-408F-94E8-D822F7C38B25}: NameServer = 192.168.0.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.313\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 5643 bytes
Post #2
Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!
———-
Post #3
[external image: Posted Image] AdwCleaner
  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • You will be prompted to restart your computer. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

[external image: Posted Image] Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-
Post #4
Jeff, thank you for your help!!! Although I cannot find adwcleaner.exe anywhere on my computer to delete it. :pullhair: What should i do next? -Alexander
Post #5
I downloaded the adwcleaner and followed your directions… here is the text from the start up… # AdwCleaner v2.111 - Logfile created 02/08/2013 at 10:39:38 # Updated 05/02/2013 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : lointusk - FROGPUTER # Boot Mode : Normal # Running from : C:\Documents and Settings\lointusk\My Documents\Downloads\AdwCleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** File Deleted : C:\Documents and Settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\searchplugins\Conduit.xml File Deleted : C:\END Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia Folder Deleted : C:\Documents and Settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\Smartbar Folder Deleted : C:\Documents and Settings\lointusk\Application Data\PerformerSoft Folder Deleted : C:\Documents and Settings\lointusk\Local Settings\Application Data\Conduit Folder Deleted : C:\Program Files\Conduit Folder Deleted : C:\Program Files\file scout ***** [Registry] ***** Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ConduitSearchScopes Key Deleted : HKCU\Software\Cr_Installer Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\SmartBar Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3227981 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion [adv_i] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion [adv_i] ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&CUI=UN19366646962045124&ctid=CT3227981 –> hxxp://www.google.com -\\ Mozilla Firefox v18.0.2 (en-US) File : C:\Documents and Settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\prefs.js Deleted : user_pref("CT3227981.1000082.isPlayDisplay", "true"); Deleted : user_pref("CT3227981.1000082.state", "{\"state\":\"stopped\",\"text\":\"1.FM (Cou…\",\"description[…] Deleted : user_pref("CT3227981.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Deleted : user_pref("CT3227981.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[…] Deleted : user_pref("CT3227981.FirstTime", "true"); Deleted : user_pref("CT3227981.FirstTimeFF3", "true"); Deleted : user_pref("CT3227981.LoginRevertSettingsEnabled", true); Deleted : user_pref("CT3227981.PG_ENABLE", "dHJ1ZQ=="); Deleted : user_pref("CT3227981.PG_ENABLE.enc", "dHJ1ZQ=="); Deleted : user_pref("CT3227981.RevertSettingsEnabled", true); Deleted : user_pref("CT3227981.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT322[…] Deleted : user_pref("CT3227981.UserID", "UN18800627841166447"); Deleted : user_pref("CT3227981.addressBarTakeOverEnabledInHidden", "true"); Deleted : user_pref("CT3227981.autoDisableScopes", -1); Deleted : user_pref("CT3227981.bDay_InstallDate.enc", "Ny0x"); Deleted : user_pref("CT3227981.bDay_InstallFromToolbar.enc", "eWVz"); Deleted : user_pref("CT3227981.browser.search.defaultthis.engineName", "true"); Deleted : user_pref("CT3227981.cbfirsttime.enc", "VGh1IEZlYiAwNyAyMDEzIDAwOjI3OjUwIEdNVC0wNzAwIChNb3VudGFpbiBT[…] Deleted : user_pref("CT3227981.defaultSearch", "true"); Deleted : user_pref("CT3227981.embeddedsData", "[{\"appId\":\"129837882913311618\",\"apiPermissions\":{\"cross[…] Deleted : user_pref("CT3227981.enableAlerts", "always"); Deleted : user_pref("CT3227981.enableFix404ByUser", "FALSE"); Deleted : user_pref("CT3227981.enableSearchFromAddressBar", "true"); Deleted : user_pref("CT3227981.firstTimeDialogOpened", "true"); Deleted : user_pref("CT3227981.fixPageNotFoundError", "true"); Deleted : user_pref("CT3227981.fixPageNotFoundErrorByUser", "true"); Deleted : user_pref("CT3227981.fixPageNotFoundErrorInHidden", "true"); Deleted : user_pref("CT3227981.fixUrls", true); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_absolutelyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_azlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_bollywoodlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_cowboylyrics.org.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_darklyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_elyrics.net.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_hindilyrix.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_hitslyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_leoslyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_letssingit.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyred.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricinterpretations.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyrics-p.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsdepot.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsfind.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsfreak.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsmania.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsmode.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsocean.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsondemand.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsoverload.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_lyricsplanet.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_metrolyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_mp3lyrics.org.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_nomorelyrics.net.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_oldielyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_onlylyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_plyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_rapgenius.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_songlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_songmeanings.net.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_stlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_sweetslyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_thelyricarchive.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_uplyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_last_targeted_visit_urbanlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_absolutelyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_azlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_bollywoodlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_cowboylyrics.org.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_darklyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_elyrics.net.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_hindilyrix.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_hitslyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_leoslyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_letssingit.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyred.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricinterpretations.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyrics-p.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsdepot.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsfind.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsfreak.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsmania.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsmode.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsocean.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsondemand.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsoverload.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_lyricsplanet.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_metrolyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_mp3lyrics.org.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_nomorelyrics.net.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_oldielyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_onlylyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_plyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_rapgenius.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_songlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_songmeanings.net.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_stlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_sweetslyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_thelyricarchive.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_uplyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_post_urls_urbanlyrics.com.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.harvest_recent.enc", "W1siaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9zZWFyY2g/cT1tcytwYWlud[…] Deleted : user_pref("CT3227981.installDate", "7/2/2013 0:25:35"); Deleted : user_pref("CT3227981.installId", "installbrain"); Deleted : user_pref("CT3227981.installType", "conduitnsisintegration"); Deleted : user_pref("CT3227981.isCheckedStartAsHidden", true); Deleted : user_pref("CT3227981.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Deleted : user_pref("CT3227981.isFirstTimeToolbarLoading", "false"); Deleted : user_pref("CT3227981.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Deleted : user_pref("CT3227981.keyword", "true"); Deleted : user_pref("CT3227981.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[…] Deleted : user_pref("CT3227981.lastVersion", "10.14.42.7"); Deleted : user_pref("CT3227981.mam_gk_AdOptimizer_appState.enc", "b24="); Deleted : user_pref("CT3227981.mam_gk_Coming_Up_Next_appState.enc", "b24="); Deleted : user_pref("CT3227981.mam_gk_CouponBuddy_appState.enc", "b24="); Deleted : user_pref("CT3227981.mam_gk_PriceGong_appState.enc", "b24="); Deleted : user_pref("CT3227981.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9z[…] Deleted : user_pref("CT3227981.mam_gk_appsDefaultEnabled.enc", "bnVsbA=="); Deleted : user_pref("CT3227981.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IlByaWNlR29uZyIsImN[…] Deleted : user_pref("CT3227981.mam_gk_currentVersion.enc", "MS4yLjAuMTI="); Deleted : user_pref("CT3227981.mam_gk_eventsCache.enc", "eyI0YTEyNzU5Ni0wYzc0LTRhYTgtOWZkNS1iNTM2M2JhYjA2MDciO[…] Deleted : user_pref("CT3227981.mam_gk_first_time.enc", "MQ=="); Deleted : user_pref("CT3227981.mam_gk_gadgetOpen.enc", "MQ=="); Deleted : user_pref("CT3227981.mam_gk_installer_preapproved.enc", "ZmFsc2U="); Deleted : user_pref("CT3227981.mam_gk_lastLoginTime.enc", "MTM2MDIyMjA1Njk2OA=="); Deleted : user_pref("CT3227981.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50[…] Deleted : user_pref("CT3227981.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ=="); Deleted : user_pref("CT3227981.mam_gk_settings1.2.0.12.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVy[…] Deleted : user_pref("CT3227981.mam_gk_showCloseButton.enc", "dHJ1ZQ=="); Deleted : user_pref("CT3227981.mam_gk_showWelcomeGadget.enc", "ZmFsc2U="); Deleted : user_pref("CT3227981.mam_gk_userId.enc", "MDAzNGE2OTktYjQ0NC00NzBiLTlhYWYtZjJjMDE2ZDQwNjU5"); Deleted : user_pref("CT3227981.mam_gk_user_apps_selection.enc", ""); Deleted : user_pref("CT3227981.migrateAppsAndComponents", true); Deleted : user_pref("CT3227981.myThings_app_locale.enc", "VVM="); Deleted : user_pref("CT3227981.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about[…] Deleted : user_pref("CT3227981.openThankYouPage", "false"); Deleted : user_pref("CT3227981.openUninstallPage", "true"); Deleted : user_pref("CT3227981.revertSettingsEnabled", "false"); Deleted : user_pref("CT3227981.sac-periodic-reports.enc", "eyJ5dHRfcGluZ18wIjpbMTM2MDIyMjA3MTE1MSw0MzIwMDAwMF1[…] Deleted : user_pref("CT3227981.sac-user-ab-groups.enc", "eyJsZWZ0aGFuZF9kZXNpZ24iOjk4LCJ0cmlnZ2VyIjo5NH0="); Deleted : user_pref("CT3227981.sac-user-id.enc", "ImIwNjhjZWY5LWYxNzctNDk3Yy05ODQ5LWMzMTM5M2M1NmE0MSI="); Deleted : user_pref("CT3227981.sac-yt-first-ping.enc", "MTM2MDIyMjA3MTEzNg=="); Deleted : user_pref("CT3227981.search.searchAppId", "129837882913311618"); Deleted : user_pref("CT3227981.search.searchCount", "0"); Deleted : user_pref("CT3227981.searchInNewTabEnabledByUser", "true"); Deleted : user_pref("CT3227981.searchInNewTabEnabledInHidden", "true"); Deleted : user_pref("CT3227981.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Deleted : user_pref("CT3227981.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[…] Deleted : user_pref("CT3227981.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[…] Deleted : user_pref("CT3227981.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[…] Deleted : user_pref("CT3227981.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[…] Deleted : user_pref("CT3227981.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[…] Deleted : user_pref("CT3227981.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[…] Deleted : user_pref("CT3227981.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1360222023505"); Deleted : user_pref("CT3227981.serviceLayer_services_appsMetadata_lastUpdate", "1360222023191"); Deleted : user_pref("CT3227981.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1360222022776"); Deleted : user_pref("CT3227981.serviceLayer_services_login_10.14.42.7_lastUpdate", "1360222024239"); Deleted : user_pref("CT3227981.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1360222023000"); Deleted : user_pref("CT3227981.serviceLayer_services_searchAPI_lastUpdate", "1360221971581"); Deleted : user_pref("CT3227981.serviceLayer_services_serviceMap_lastUpdate", "1360221970791"); Deleted : user_pref("CT3227981.serviceLayer_services_toolbarContextMenu_lastUpdate", "1360222022411"); Deleted : user_pref("CT3227981.serviceLayer_services_toolbarSettings_lastUpdate", "1360221971202"); Deleted : user_pref("CT3227981.serviceLayer_services_translation_lastUpdate", "1360222023299"); Deleted : user_pref("CT3227981.settingsINI", true); Deleted : user_pref("CT3227981.shouldFirstTimeDialog", "false"); Deleted : user_pref("CT3227981.smartbar.CTID", "CT3227981"); Deleted : user_pref("CT3227981.smartbar.Uninstall", "0"); Deleted : user_pref("CT3227981.smartbar.homepage", "true"); Deleted : user_pref("CT3227981.smartbar.toolbarName", "appbario7 "); Deleted : user_pref("CT3227981.startPage", "true"); Deleted : user_pref("CT3227981.toolbarBornServerTime", "7-2-2013"); Deleted : user_pref("CT3227981.toolbarCurrentServerTime", "7-2-2013"); Deleted : user_pref("CT3227981.toolbarDisabled", "true"); Deleted : user_pref("CT3227981.url_history0001.enc", "aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo6OmNsaWNraGFuZGxlcjo6OjEz[…] Deleted : user_pref("CT3227981.ytt-mam-test-uid-odc.enc", "NzYwMjdkMzQtNmE0Ny00MmIwLTk2OWItZWVhMThlMTYzY2E0"); Deleted : user_pref("CT3227981.ytt-mam-test-uid-ol.enc", "OWNiMjRlZTctNWNiNi00Y2E2LWEzYmQtNTk2Y2JlNDE5MDlk"); Deleted : user_pref("CT3227981_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[…] Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3227981&SearchSource=1[…] Deleted : user_pref("Smartbar.ConduitSearchEngineList", "appbario7 Customized Web Search"); Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3227981[…] Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", ""); Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3227981"); Deleted : user_pref("browser.search.defaultthis.engineName", "appbario7 Customized Web Search"); Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3227981&Sea[…] Deleted : user_pref("ct3227981.UserID", "UN18800627841166447"); Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3227981&SearchSource=2&CU[…] Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3227981&SearchSource=13[…] Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[…] Deleted : user_pref("smartbar.originalHomepage", "about:home"); Deleted : user_pref("smartbar.originalSearchAddressUrl", ""); Deleted : user_pref("smartbar.originalSearchEngine", "Google"); -\\ Google Chrome v24.0.1312.57 File : C:\Documents and Settings\lointusk\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences Deleted [l.19] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?CUI=UN34305538161159317&ctid=CT[…] Deleted [l.2149] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?CUI=UN34305538161159317&ctid=CT322[…] ************************* AdwCleaner[S1].txt - [19452 octets] - [08/02/2013 10:39:38] ########## EOF - C:\AdwCleaner[S1].txt - [19513 octets] ##########
Post #7
aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2013-02-09 09:46:57 —————————– 09:46:57.875 OS Version: Windows 5.1.2600 Service Pack 3 09:46:57.875 Number of processors: 1 586 0x401 09:46:57.875 ComputerName: FROGPUTER UserName: lointusk 09:46:58.640 Initialize success 09:51:13.093 AVAST engine defs: 13020900 09:53:33.390 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 09:53:33.390 Disk 0 Vendor: Maxtor_6E040L0 NAR61EA0 Size: 39205MB BusType: 3 09:53:33.390 Disk 0 MBR read successfully 09:53:33.390 Disk 0 MBR scan 09:53:33.453 Disk 0 Windows XP default MBR code 09:53:33.484 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 39197 MB offset 63 09:53:33.531 Disk 0 scanning sectors +80276805 09:53:33.625 Disk 0 scanning C:\WINDOWS\system32\drivers 09:54:03.484 Service scanning 09:54:21.953 Service MpKsl55cd5687 c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8E852C26-3404-4721-84C3-D7BFED751401}\MpKsl55cd5687.sys **LOCKED** 32 09:54:37.437 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 09:54:48.390 Modules scanning 09:55:05.421 Disk 0 trace - called modules: 09:55:05.468 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys spoa.sys hal.dll >>UNKNOWN [0x8974b938]<< 09:55:05.796 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89705ab8] 09:55:05.796 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89703d98] 09:55:06.109 AVAST engine scan C:\WINDOWS 09:55:23.781 AVAST engine scan C:\WINDOWS\system32 10:02:31.359 AVAST engine scan C:\WINDOWS\system32\drivers 10:02:56.015 AVAST engine scan C:\Documents and Settings\lointusk 10:08:57.250 File: C:\Documents and Settings\lointusk\Local Settings\Temporary Internet Files\Content.IE5\1Y2WMR2V\Installer[1] **INFECTED** Win32:Dropper-gen [Drp] 10:12:09.453 AVAST engine scan C:\Documents and Settings\All Users 10:12:44.015 Scan finished successfully 10:19:34.031 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\lointusk\Desktop\MBR.dat" 10:19:34.046 The log file has been saved successfully to "C:\Documents and Settings\lointusk\Desktop\aswMBR.txt"
Post #8
Hi,

After seeing the results of the aswMBR log I would like to check another scan…

[external image: Posted Image] Please download TDSSKiller
  • Double click TDSSKiller.exe
  • Press Start Scan
  • If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
  • Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct items.
  • Attach the log in your next reply
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)
———-
Post #9
13:35:48.0062 3916 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 13:35:48.0578 3916 ============================================================ 13:35:48.0578 3916 Current date / time: 2013/02/09 13:35:48.0578 13:35:48.0578 3916 SystemInfo: 13:35:48.0578 3916 13:35:48.0578 3916 OS Version: 5.1.2600 ServicePack: 3.0 13:35:48.0578 3916 Product type: Workstation 13:35:48.0578 3916 ComputerName: FROGPUTER 13:35:48.0578 3916 UserName: lointusk 13:35:48.0578 3916 Windows directory: C:\WINDOWS 13:35:48.0578 3916 System windows directory: C:\WINDOWS 13:35:48.0578 3916 Processor architecture: Intel x86 13:35:48.0578 3916 Number of processors: 1 13:35:48.0578 3916 Page size: 0x1000 13:35:48.0578 3916 Boot type: Normal boot 13:35:48.0578 3916 ============================================================ 13:35:51.0968 3916 Drive \Device\Harddisk0\DR0 - Size: 0x9925B0000 (38.29 Gb), SectorSize: 0x200, Cylinders: 0x1386, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 13:35:51.0984 3916 ============================================================ 13:35:51.0984 3916 \Device\Harddisk0\DR0: 13:35:51.0984 3916 MBR partitions: 13:35:51.0984 3916 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4C8ED06 13:35:51.0984 3916 ============================================================ 13:35:52.0015 3916 C: <-> \Device\Harddisk0\DR0\Partition1 13:35:52.0015 3916 ============================================================ 13:35:52.0015 3916 Initialize success 13:35:52.0015 3916 ============================================================ 13:36:05.0781 2596 ============================================================ 13:36:05.0781 2596 Scan started 13:36:05.0781 2596 Mode: Manual; 13:36:05.0781 2596 ============================================================ 13:36:06.0062 2596 ================ Scan system memory ======================== 13:36:06.0062 2596 System memory - ok 13:36:06.0062 2596 ================ Scan services ============================= 13:36:06.0203 2596 Abiosdsk - ok 13:36:06.0218 2596 abp480n5 - ok 13:36:06.0296 2596 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 13:36:06.0296 2596 ACPI - ok 13:36:06.0343 2596 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 13:36:06.0343 2596 ACPIEC - ok 13:36:06.0359 2596 adpu160m - ok 13:36:06.0390 2596 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 13:36:06.0406 2596 aec - ok 13:36:06.0453 2596 [ 023867B6606FBABCDD52E089C4A507DA ] AegisP C:\WINDOWS\system32\DRIVERS\AegisP.sys 13:36:06.0453 2596 AegisP - ok 13:36:06.0500 2596 [ F6B7B1ECD7B41736BDB6FF4B092BCB79 ] AFD C:\WINDOWS\System32\drivers\afd.sys 13:36:06.0500 2596 AFD - ok 13:36:06.0515 2596 Aha154x - ok 13:36:06.0531 2596 aic78u2 - ok 13:36:06.0546 2596 aic78xx - ok 13:36:06.0593 2596 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 13:36:06.0593 2596 Alerter - ok 13:36:06.0625 2596 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 13:36:06.0625 2596 ALG - ok 13:36:06.0640 2596 AliIde - ok 13:36:06.0640 2596 amsint - ok 13:36:06.0687 2596 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 13:36:06.0687 2596 AppMgmt - ok 13:36:06.0703 2596 asc - ok 13:36:06.0718 2596 asc3350p - ok 13:36:06.0734 2596 asc3550 - ok 13:36:06.0828 2596 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 13:36:06.0890 2596 aspnet_state - ok 13:36:06.0937 2596 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 13:36:06.0937 2596 AsyncMac - ok 13:36:07.0000 2596 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 13:36:07.0000 2596 atapi - ok 13:36:07.0015 2596 Atdisk - ok 13:36:07.0046 2596 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 13:36:07.0046 2596 Atmarpc - ok 13:36:07.0093 2596 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 13:36:07.0093 2596 AudioSrv - ok 13:36:07.0140 2596 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 13:36:07.0140 2596 audstub - ok 13:36:07.0218 2596 [ 38CA1443660D0F5F06887C6A2E692AEB ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 13:36:07.0265 2596 BCM43XX - ok 13:36:07.0328 2596 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 13:36:07.0328 2596 Beep - ok 13:36:07.0390 2596 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 13:36:07.0406 2596 BITS - ok 13:36:07.0468 2596 [ FC6D1D80588D371F0321E15A75B2F8F2 ] Browser C:\WINDOWS\System32\browser.dll 13:36:07.0468 2596 Browser - ok 13:36:07.0515 2596 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 13:36:07.0515 2596 cbidf2k - ok 13:36:07.0515 2596 cd20xrnt - ok 13:36:07.0562 2596 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 13:36:07.0562 2596 Cdaudio - ok 13:36:07.0609 2596 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 13:36:07.0609 2596 Cdfs - ok 13:36:07.0640 2596 [ 4B0A100EAF5C49EF3CCA8C641431EACC ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 13:36:07.0640 2596 Cdrom - ok 13:36:07.0656 2596 Changer - ok 13:36:07.0687 2596 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 13:36:07.0687 2596 ClipSrv - ok 13:36:07.0734 2596 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 13:36:07.0828 2596 clr_optimization_v2.0.50727_32 - ok 13:36:07.0843 2596 CmdIde - ok 13:36:07.0859 2596 COMSysApp - ok 13:36:07.0875 2596 Cpqarray - ok 13:36:07.0921 2596 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 13:36:07.0921 2596 CryptSvc - ok 13:36:07.0937 2596 dac2w2k - ok 13:36:07.0953 2596 dac960nt - ok 13:36:08.0015 2596 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 13:36:08.0031 2596 DcomLaunch - ok 13:36:08.0093 2596 [ C51DE19619D50CBD03708647ACA10E70 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 13:36:08.0093 2596 Dhcp - ok 13:36:08.0125 2596 [ 47B6AAEC570F2C11D8BAD80A064D8ED1 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 13:36:08.0125 2596 Disk - ok 13:36:08.0140 2596 dmadmin - ok 13:36:08.0187 2596 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 13:36:08.0343 2596 dmboot - ok 13:36:08.0765 2596 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 13:36:08.0765 2596 dmio - ok 13:36:08.0812 2596 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 13:36:08.0812 2596 dmload - ok 13:36:08.0843 2596 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 13:36:08.0843 2596 dmserver - ok 13:36:08.0890 2596 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 13:36:08.0890 2596 DMusic - ok 13:36:08.0937 2596 [ D977659AE4D8ECE5286D99D1ED34614D ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 13:36:08.0937 2596 Dnscache - ok 13:36:08.0984 2596 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 13:36:08.0984 2596 Dot3svc - ok 13:36:09.0000 2596 dpti2o - ok 13:36:09.0031 2596 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 13:36:09.0046 2596 drmkaud - ok 13:36:09.0093 2596 [ 7D91DC6342248369F94D6EBA0CF42E99 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys 13:36:09.0093 2596 E100B - ok 13:36:09.0140 2596 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 13:36:09.0140 2596 EapHost - ok 13:36:09.0187 2596 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 13:36:09.0187 2596 Eventlog - ok 13:36:09.0250 2596 [ F17F6226BDC0CD5F0BEF0DAF84D29BEC ] EventSystem C:\WINDOWS\system32\es.dll 13:36:09.0250 2596 EventSystem - ok 13:36:09.0296 2596 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 13:36:09.0296 2596 Fastfat - ok 13:36:09.0343 2596 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 13:36:09.0343 2596 FastUserSwitchingCompatibility - ok 13:36:09.0406 2596 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 13:36:09.0406 2596 Fdc - ok 13:36:09.0421 2596 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 13:36:09.0421 2596 Fips - ok 13:36:09.0437 2596 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 13:36:09.0437 2596 Flpydisk - ok 13:36:09.0484 2596 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys 13:36:09.0484 2596 FltMgr - ok 13:36:09.0593 2596 [ 7C2B319EF1F62837AAD0CDD76F0B84C6 ] FolderSize C:\Program Files\FolderSize\FolderSizeSvc.exe 13:36:09.0734 2596 FolderSize - ok 13:36:09.0828 2596 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 13:36:09.0859 2596 FontCache3.0.0.0 - ok 13:36:09.0906 2596 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 13:36:09.0906 2596 Fs_Rec - ok 13:36:09.0921 2596 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 13:36:09.0921 2596 Ftdisk - ok 13:36:09.0984 2596 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 13:36:09.0984 2596 Gpc - ok 13:36:10.0046 2596 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 13:36:10.0062 2596 gupdate - ok 13:36:10.0062 2596 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 13:36:10.0078 2596 gupdatem - ok 13:36:10.0093 2596 HidServ - ok 13:36:10.0140 2596 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 13:36:10.0140 2596 HidUsb - ok 13:36:10.0187 2596 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 13:36:10.0187 2596 hkmsvc - ok 13:36:10.0203 2596 hpn - ok 13:36:10.0250 2596 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 13:36:10.0265 2596 HTTP - ok 13:36:10.0328 2596 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 13:36:10.0328 2596 HTTPFilter - ok 13:36:10.0343 2596 i2omgmt - ok 13:36:10.0359 2596 i2omp - ok 13:36:10.0375 2596 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 13:36:10.0375 2596 i8042prt - ok 13:36:10.0484 2596 [ 9A883C3C4D91292C0D09DE7C728E781C ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 13:36:10.0515 2596 ialm - ok 13:36:10.0593 2596 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 13:36:10.0875 2596 idsvc - ok 13:36:10.0921 2596 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 13:36:10.0921 2596 Imapi - ok 13:36:10.0937 2596 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 13:36:10.0953 2596 ImapiService - ok 13:36:10.0968 2596 ini910u - ok 13:36:11.0031 2596 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 13:36:11.0031 2596 IntelIde - ok 13:36:11.0093 2596 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 13:36:11.0093 2596 intelppm - ok 13:36:11.0125 2596 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 13:36:11.0125 2596 Ip6Fw - ok 13:36:11.0171 2596 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 13:36:11.0171 2596 IpFilterDriver - ok 13:36:11.0218 2596 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 13:36:11.0218 2596 IpInIp - ok 13:36:11.0250 2596 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 13:36:11.0265 2596 IpNat - ok 13:36:11.0281 2596 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 13:36:11.0281 2596 IPSec - ok 13:36:11.0328 2596 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 13:36:11.0328 2596 IRENUM - ok 13:36:11.0375 2596 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 13:36:11.0375 2596 isapnp - ok 13:36:11.0421 2596 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 13:36:11.0421 2596 Kbdclass - ok 13:36:11.0468 2596 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 13:36:11.0468 2596 kbdhid - ok 13:36:11.0500 2596 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 13:36:11.0500 2596 kmixer - ok 13:36:11.0546 2596 [ C6EBF1D6AD71DF30DB49B8D3287E1368 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 13:36:11.0562 2596 KSecDD - ok 13:36:11.0609 2596 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll 13:36:11.0609 2596 LanmanServer - ok 13:36:11.0671 2596 [ 3B9324D60DD321BAB7BF6F77931D3FD1 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 13:36:11.0671 2596 lanmanworkstation - ok 13:36:11.0687 2596 lbrtfdc - ok 13:36:11.0750 2596 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 13:36:11.0750 2596 LmHosts - ok 13:36:11.0796 2596 [ 629CABB0421668C9D3D402A3C3D77E14 ] MBAMProtector C:\WINDOWS\system32\drivers\mbam.sys 13:36:11.0796 2596 MBAMProtector - ok 13:36:11.0890 2596 [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe 13:36:12.0093 2596 MBAMScheduler - ok 13:36:12.0156 2596 [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 13:36:12.0500 2596 MBAMService - ok 13:36:12.0578 2596 [ C58F15CD4EF79210455512CF0C449F39 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.0.313\McCHSvc.exe 13:36:12.0718 2596 McComponentHostService - ok 13:36:12.0765 2596 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 13:36:12.0765 2596 Messenger - ok 13:36:12.0796 2596 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 13:36:12.0812 2596 Modem - ok 13:36:12.0843 2596 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 13:36:12.0843 2596 Mouclass - ok 13:36:12.0890 2596 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 13:36:12.0890 2596 mouhid - ok 13:36:12.0953 2596 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 13:36:12.0953 2596 MountMgr - ok 13:36:13.0062 2596 [ 51A84B690DF519DCF656F780243D953E ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 13:36:13.0171 2596 MozillaMaintenance - ok 13:36:13.0234 2596 [ EE728AF83850DDAD9A3FCAC0AAB3AD97 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys 13:36:13.0234 2596 MpFilter - ok 13:36:13.0390 2596 [ A69630D039C38018689190234F866D77 ] MpKsl55cd5687 c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8E852C26-3404-4721-84C3-D7BFED751401}\MpKsl55cd5687.sys 13:36:13.0390 2596 MpKsl55cd5687 - ok 13:36:13.0390 2596 mraid35x - ok 13:36:13.0437 2596 [ 65E818C473E220B6AB762E1966296FD1 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 13:36:13.0437 2596 MRxDAV - ok 13:36:13.0500 2596 [ FB2FCCC70F7174C7BF64F48E96D3ADF4 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 13:36:13.0515 2596 MRxSmb - ok 13:36:13.0562 2596 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 13:36:13.0562 2596 MSDTC - ok 13:36:13.0625 2596 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 13:36:13.0625 2596 Msfs - ok 13:36:13.0640 2596 MSIServer - ok 13:36:13.0687 2596 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 13:36:13.0687 2596 MSKSSRV - ok 13:36:13.0765 2596 [ E077FCA2A7E79FB9BF67D3E30B5CE593 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe 13:36:13.0812 2596 MsMpSvc - ok 13:36:13.0859 2596 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 13:36:13.0859 2596 MSPCLOCK - ok 13:36:13.0875 2596 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 13:36:13.0875 2596 MSPQM - ok 13:36:13.0921 2596 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 13:36:13.0921 2596 mssmbios - ok 13:36:13.0968 2596 [ F7B1AD991491F02AF6DA70B00B8BF114 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 13:36:13.0968 2596 Mup - ok 13:36:14.0031 2596 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 13:36:14.0031 2596 napagent - ok 13:36:14.0093 2596 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 13:36:14.0093 2596 NDIS - ok 13:36:14.0140 2596 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 13:36:14.0140 2596 NdisTapi - ok 13:36:14.0203 2596 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 13:36:14.0203 2596 Ndisuio - ok 13:36:14.0250 2596 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 13:36:14.0250 2596 NdisWan - ok 13:36:14.0296 2596 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 13:36:14.0296 2596 NDProxy - ok 13:36:14.0359 2596 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 13:36:14.0359 2596 NetBIOS - ok 13:36:14.0390 2596 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 13:36:14.0390 2596 NetBT - ok 13:36:14.0437 2596 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 13:36:14.0437 2596 NetDDE - ok 13:36:14.0453 2596 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 13:36:14.0453 2596 NetDDEdsdm - ok 13:36:14.0500 2596 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 13:36:14.0500 2596 Netlogon - ok 13:36:14.0562 2596 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 13:36:14.0578 2596 Netman - ok 13:36:14.0609 2596 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 13:36:14.0656 2596 NetTcpPortSharing - ok 13:36:14.0718 2596 [ 290C1A30DEFC723BBE10910AC2D6F6D0 ] Nla C:\WINDOWS\System32\mswsock.dll 13:36:14.0718 2596 Nla - ok 13:36:14.0812 2596 [ 7AEA4DF1CA68FD45DD4BBE1F0243CE7F ] NMSAccess C:\Program Files\CDBurnerXP\NMSAccessU.exe 13:36:14.0906 2596 NMSAccess - ok 13:36:14.0953 2596 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 13:36:14.0953 2596 Npfs - ok 13:36:14.0984 2596 [ 4C51D5275AE8A16999EDFE7E647D00DE ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 13:36:15.0015 2596 Ntfs - ok 13:36:15.0046 2596 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 13:36:15.0046 2596 NtLmSsp - ok 13:36:15.0093 2596 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 13:36:15.0109 2596 NtmsSvc - ok 13:36:15.0171 2596 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 13:36:15.0171 2596 Null - ok 13:36:15.0343 2596 [ E6412CE5A04ED36F77E47244076EFA95 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 13:36:15.0453 2596 nv - ok 13:36:15.0500 2596 [ 7C60A5366FA94C1A68A793C530A7EAF0 ] NVSvc C:\WINDOWS\system32\nvsvc32.exe 13:36:15.0515 2596 NVSvc - ok 13:36:15.0562 2596 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 13:36:15.0562 2596 NwlnkFlt - ok 13:36:15.0578 2596 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 13:36:15.0578 2596 NwlnkFwd - ok 13:36:15.0640 2596 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 13:36:15.0640 2596 Parport - ok 13:36:15.0656 2596 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 13:36:15.0656 2596 PartMgr - ok 13:36:15.0703 2596 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 13:36:15.0703 2596 ParVdm - ok 13:36:15.0734 2596 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 13:36:15.0734 2596 PCI - ok 13:36:15.0750 2596 PCIDump - ok 13:36:15.0765 2596 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 13:36:15.0765 2596 PCIIde - ok 13:36:15.0796 2596 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 13:36:15.0812 2596 Pcmcia - ok 13:36:15.0828 2596 PDCOMP - ok 13:36:15.0828 2596 PDFRAME - ok 13:36:15.0843 2596 PDRELI - ok 13:36:15.0859 2596 PDRFRAME - ok 13:36:15.0875 2596 perc2 - ok 13:36:15.0890 2596 perc2hib - ok 13:36:15.0953 2596 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 13:36:15.0953 2596 PlugPlay - ok 13:36:15.0984 2596 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 13:36:15.0984 2596 PolicyAgent - ok 13:36:16.0046 2596 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 13:36:16.0046 2596 PptpMiniport - ok 13:36:16.0062 2596 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 13:36:16.0062 2596 ProtectedStorage - ok 13:36:16.0078 2596 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 13:36:16.0078 2596 PSched - ok 13:36:16.0125 2596 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 13:36:16.0125 2596 Ptilink - ok 13:36:16.0140 2596 ql1080 - ok 13:36:16.0156 2596 Ql10wnt - ok 13:36:16.0171 2596 ql12160 - ok 13:36:16.0187 2596 ql1240 - ok 13:36:16.0203 2596 ql1280 - ok 13:36:16.0234 2596 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 13:36:16.0234 2596 RasAcd - ok 13:36:16.0296 2596 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 13:36:16.0296 2596 RasAuto - ok 13:36:16.0328 2596 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 13:36:16.0343 2596 Rasl2tp - ok 13:36:16.0359 2596 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 13:36:16.0375 2596 RasMan - ok 13:36:16.0390 2596 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 13:36:16.0390 2596 RasPppoe - ok 13:36:16.0453 2596 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 13:36:16.0453 2596 Raspti - ok 13:36:16.0515 2596 [ 77050C6615F6EB5402F832B27FD695E0 ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 13:36:16.0515 2596 Rdbss - ok 13:36:16.0578 2596 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 13:36:16.0578 2596 RDPCDD - ok 13:36:16.0640 2596 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 13:36:16.0640 2596 rdpdr - ok 13:36:16.0703 2596 [ C7D9BC54354B8C706ABF172D48313F1B ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 13:36:16.0703 2596 RDPWD - ok 13:36:16.0750 2596 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 13:36:16.0765 2596 RDSessMgr - ok 13:36:16.0828 2596 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 13:36:16.0828 2596 redbook - ok 13:36:16.0875 2596 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 13:36:16.0875 2596 RemoteAccess - ok 13:36:16.0906 2596 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 13:36:16.0921 2596 RemoteRegistry - ok 13:36:16.0953 2596 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 13:36:16.0953 2596 RpcLocator - ok 13:36:17.0000 2596 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll 13:36:17.0015 2596 RpcSs - ok 13:36:17.0062 2596 [ 743D7D59767073A617B1DCC6C546F234 ] rspndr C:\WINDOWS\system32\DRIVERS\rspndr.sys 13:36:17.0062 2596 rspndr - ok 13:36:17.0125 2596 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 13:36:17.0125 2596 RSVP - ok 13:36:17.0171 2596 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 13:36:17.0171 2596 SamSs - ok 13:36:17.0218 2596 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 13:36:17.0218 2596 SCardSvr - ok 13:36:17.0281 2596 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 13:36:17.0281 2596 Schedule - ok 13:36:17.0328 2596 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 13:36:17.0328 2596 Secdrv - ok 13:36:17.0375 2596 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 13:36:17.0375 2596 seclogon - ok 13:36:17.0453 2596 [ B9C7617C1E8AB6FDFF75D3C8DAFCB4C8 ] senfilt C:\WINDOWS\system32\drivers\senfilt.sys 13:36:17.0468 2596 senfilt - ok 13:36:17.0531 2596 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 13:36:17.0531 2596 SENS - ok 13:36:17.0546 2596 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 13:36:17.0546 2596 serenum - ok 13:36:17.0578 2596 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 13:36:17.0578 2596 Serial - ok 13:36:17.0640 2596 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 13:36:17.0656 2596 Sfloppy - ok 13:36:17.0718 2596 [ 4F10A2FA76B5BD54CD68AFA94E8ADB39 ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 13:36:17.0718 2596 SharedAccess - ok 13:36:17.0750 2596 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 13:36:17.0750 2596 ShellHWDetection - ok 13:36:17.0765 2596 Simbad - ok 13:36:17.0843 2596 [ C6D9959E493682F872A639B6EC1B4A08 ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys 13:36:17.0843 2596 smwdm - ok 13:36:17.0859 2596 Sparrow - ok 13:36:17.0890 2596 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 13:36:17.0890 2596 splitter - ok 13:36:17.0937 2596 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 13:36:17.0937 2596 Spooler - ok 13:36:18.0015 2596 [ D15DA1BA189770D93EEA2D7E18F95AF9 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys 13:36:18.0015 2596 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: D15DA1BA189770D93EEA2D7E18F95AF9 13:36:18.0015 2596 sptd ( LockedFile.Multi.Generic ) - warning 13:36:18.0015 2596 sptd - detected LockedFile.Multi.Generic (1) 13:36:18.0031 2596 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] Sr C:\WINDOWS\system32\DRIVERS\sr.sys 13:36:18.0046 2596 Sr - ok 13:36:18.0078 2596 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 13:36:18.0078 2596 srservice - ok 13:36:18.0140 2596 [ 9B390283569EA58D43D2586032B892F5 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 13:36:18.0140 2596 Srv - ok 13:36:18.0187 2596 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 13:36:18.0187 2596 SSDPSRV - ok 13:36:18.0234 2596 [ F92254B0BCFCD10CAAC7BCCC7CB7F467 ] StarOpen C:\WINDOWS\system32\drivers\StarOpen.sys 13:36:18.0234 2596 StarOpen - ok 13:36:18.0296 2596 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 13:36:18.0312 2596 stisvc - ok 13:36:18.0375 2596 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 13:36:18.0375 2596 swenum - ok 13:36:18.0390 2596 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 13:36:18.0390 2596 swmidi - ok 13:36:18.0406 2596 SwPrv - ok 13:36:18.0421 2596 symc810 - ok 13:36:18.0437 2596 symc8xx - ok 13:36:18.0453 2596 sym_hi - ok 13:36:18.0468 2596 sym_u3 - ok 13:36:18.0515 2596 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 13:36:18.0515 2596 sysaudio - ok 13:36:18.0562 2596 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 13:36:18.0578 2596 SysmonLog - ok 13:36:18.0640 2596 [ E2B32B10ACC5D97623275AAFB67E5F03 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 13:36:18.0640 2596 TapiSrv - ok 13:36:18.0671 2596 [ 25A740D70E8007814A48D3FA1B34FA34 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 13:36:18.0687 2596 Tcpip - ok 13:36:18.0734 2596 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 13:36:18.0750 2596 TDPIPE - ok 13:36:18.0765 2596 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 13:36:18.0765 2596 TDTCP - ok 13:36:18.0812 2596 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 13:36:18.0812 2596 TermDD - ok 13:36:18.0859 2596 [ 37981A741AD7B04258E87129FFE79AB9 ] TermService C:\WINDOWS\System32\termsrv.dll 13:36:18.0875 2596 TermService - ok 13:36:18.0890 2596 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 13:36:18.0890 2596 Themes - ok 13:36:18.0953 2596 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 13:36:18.0953 2596 TlntSvr - ok 13:36:18.0968 2596 TosIde - ok 13:36:19.0015 2596 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 13:36:19.0015 2596 Udfs - ok 13:36:19.0031 2596 ultra - ok 13:36:19.0093 2596 [ 4847639D852763EE39415C929470F672 ] UnlockerDriver5 C:\Program Files\Unlocker\UnlockerDriver5.sys 13:36:19.0093 2596 UnlockerDriver5 - ok 13:36:19.0156 2596 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 13:36:19.0203 2596 Update - ok 13:36:19.0265 2596 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 13:36:19.0265 2596 upnphost - ok 13:36:19.0296 2596 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 13:36:19.0312 2596 UPS - ok 13:36:19.0359 2596 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 13:36:19.0359 2596 usbccgp - ok 13:36:19.0406 2596 [ 152EE0BAA614388273A0B9AE9C9FD5A0 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 13:36:19.0406 2596 usbehci - ok 13:36:19.0453 2596 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 13:36:19.0453 2596 usbhub - ok 13:36:19.0515 2596 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 13:36:19.0515 2596 usbscan - ok 13:36:19.0562 2596 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 13:36:19.0562 2596 USBSTOR - ok 13:36:19.0609 2596 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 13:36:19.0609 2596 usbuhci - ok 13:36:19.0671 2596 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 13:36:19.0671 2596 VgaSave - ok 13:36:19.0687 2596 ViaIde - ok 13:36:19.0703 2596 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 13:36:19.0703 2596 VolSnap - ok 13:36:19.0750 2596 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 13:36:19.0750 2596 VSS - ok 13:36:19.0812 2596 [ 9F8A0D0CBB2FA265A754516128C00E22 ] W32Time C:\WINDOWS\system32\w32time.dll 13:36:19.0812 2596 W32Time - ok 13:36:19.0843 2596 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 13:36:19.0859 2596 Wanarp - ok 13:36:19.0875 2596 WDICA - ok 13:36:19.0890 2596 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 13:36:19.0906 2596 wdmaud - ok 13:36:19.0937 2596 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 13:36:19.0937 2596 WebClient - ok 13:36:20.0046 2596 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 13:36:20.0140 2596 winmgmt - ok 13:36:20.0218 2596 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 13:36:20.0218 2596 WmdmPmSN - ok 13:36:20.0281 2596 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 13:36:20.0296 2596 Wmi - ok 13:36:20.0359 2596 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 13:36:20.0453 2596 WmiApSrv - ok 13:36:20.0562 2596 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 13:36:21.0140 2596 WMPNetworkSvc - ok 13:36:21.0187 2596 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 13:36:21.0187 2596 wscsvc - ok 13:36:21.0250 2596 [ AAE1A6FFBA2B0436E91795120F48C461 ] wuauserv C:\WINDOWS\system32\wuauserv.dll 13:36:21.0250 2596 wuauserv - ok 13:36:21.0312 2596 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 13:36:21.0312 2596 WudfPf - ok 13:36:21.0328 2596 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 13:36:21.0343 2596 WudfRd - ok 13:36:21.0359 2596 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 13:36:21.0375 2596 WudfSvc - ok 13:36:21.0421 2596 [ 70AEEC67E87A2002E6B2CC353D56E222 ] WUSB54GPV4SRV C:\WINDOWS\system32\DRIVERS\rt2500usb.sys 13:36:21.0421 2596 WUSB54GPV4SRV - ok 13:36:21.0484 2596 [ 349B8D2BB755E8C3B0E3E82A87663E55 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 13:36:21.0515 2596 WZCSVC - ok 13:36:21.0546 2596 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 13:36:21.0546 2596 xmlprov - ok 13:36:21.0609 2596 ================ Scan global =============================== 13:36:21.0656 2596 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 13:36:21.0718 2596 [ B23423313519C522E0E73BA170D3CE71 ] C:\WINDOWS\system32\winsrv.dll 13:36:21.0734 2596 [ B23423313519C522E0E73BA170D3CE71 ] C:\WINDOWS\system32\winsrv.dll 13:36:21.0750 2596 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 13:36:21.0765 2596 [Global] - ok 13:36:21.0765 2596 ================ Scan MBR ================================== 13:36:21.0796 2596 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0 13:36:21.0968 2596 \Device\Harddisk0\DR0 - ok 13:36:21.0968 2596 ================ Scan VBR ================================== 13:36:21.0984 2596 [ FBF5E674CEA06C7FF5D41085E6FFC239 ] \Device\Harddisk0\DR0\Partition1 13:36:21.0984 2596 \Device\Harddisk0\DR0\Partition1 - ok 13:36:21.0984 2596 ============================================================ 13:36:21.0984 2596 Scan finished 13:36:21.0984 2596 ============================================================ 13:36:22.0015 2296 Detected object count: 1 13:36:22.0015 2296 Actual detected object count: 1 13:36:50.0937 2296 sptd ( LockedFile.Multi.Generic ) - skipped by user 13:36:50.0937 2296 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
Post #10
ComboFix

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
4. If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.
———-
Post #13
I apologize for the delay Jeffce, i was moving inbetween homes…

Combofix log here…

ComboFix 13-02-07.02 - lointusk 02/14/2013 18:21:46.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1278.892 [GMT -7:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
- REDUCED FUNCTIONALITY MODE -
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\lointusk\WINDOWS
.
.
((((((((((((((((((((((((( Files Created from 2013-01-15 to 2013-02-15 )))))))))))))))))))))))))))))))
.
.
2013-02-15 01:09 . 2013-02-15 01:09 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C4A319E-8B2C-48A6-B6A3-414CD0C104AF}\MpKsl266b8764.sys
2013-02-11 10:49 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C4A319E-8B2C-48A6-B6A3-414CD0C104AF}\mpengine.dll
2013-02-10 12:27 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-07 15:47 . 2013-02-07 15:48 ——– d—–w- c:\program files\Dropbox
2013-02-07 15:43 . 2013-02-15 00:55 ——– d—–w- c:\documents and settings\lointusk\Application Data\Dropbox
2013-02-07 07:29 . 2012-12-19 22:53 18096 —-a-w- c:\windows\system32\roboot.exe
2013-02-07 07:26 . 2013-02-07 07:26 ——– d—–w- c:\documents and settings\lointusk\Local Settings\Application Data\CRE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-30 10:53 . 2012-11-29 16:55 232336 ——w- c:\windows\system32\MpSigStub.exe
2012-12-16 12:23 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 23:49 . 2012-11-29 17:34 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-12-04 20:09 . 2012-12-04 20:09 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-04 20:09 . 2012-12-04 20:09 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-06 01:32 . 2013-02-06 01:30 262552 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-08-05 . 25A740D70E8007814A48D3FA1B34FA34 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-19 7634944]
"nwiz"="nwiz.exe" [2007-03-19 1622016]
"NvMediaCenter"="NvMCTray.dll" [2007-03-19 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-08-05 128512]
.
c:\documents and settings\lointusk\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\lointusk\Application Data\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HiCDEject.lnk - c:\program files\HiCDEject\HiCDEject.exe [2001-2-13 9248]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"AdVantage"=c:\documents and settings\lointusk\Application Data\advantage\AdVantage.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Documents and Settings\\lointusk\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/10/2009 10:34 AM 721904]
R1 MpKsl266b8764;MpKsl266b8764;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C4A319E-8B2C-48A6-B6A3-414CD0C104AF}\MpKsl266b8764.sys [2/14/2013 6:09 PM 29904]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [11/29/2012 10:34 AM 398184]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/29/2012 10:34 AM 682344]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/29/2012 10:34 AM 21104]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.313\McCHSvc.exe [10/26/2012 11:15 AM 234776]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL266B8764
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001Core.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001UA.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-15 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 22:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1 [removed]
TCP: Interfaces\{3C2F8020-1F67-43A0-B7E4-678FBBA60FBA}: NameServer = 192.168.0.1
TCP: Interfaces\{58FA7B8E-4E10-4456-906A-8DF7B9D15259}: NameServer = 192.168.0.1
TCP: Interfaces\{595FCF1C-C74B-46AE-B3B1-6CD47E0297D6}: NameServer = 192.168.0.1
TCP: Interfaces\{6A9C593A-3C2B-4D4A-9DBD-6DB76CA920C6}: NameServer = 192.168.0.1
TCP: Interfaces\{8DF4D200-5EF5-45C5-B945-C7DFAE8DE4FA}: NameServer = 192.168.0.1
TCP: Interfaces\{9F9D5D91-3B90-408F-94E8-D822F7C38B25}: NameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/firefox/?fr=sfp-yff17
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Final Fantasy VII - c:\program files\Final Fantasy VII\Uninst.isu
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-14 18:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2132)
c:\windows\system32\WININET.dll
c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-02-14 18:25:00
ComboFix-quarantined-files.txt 2013-02-15 01:24
.
Pre-Run: 9,701,060,608 bytes free
Post-Run: 10,032,287,744 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 89B523BFFC0EE516463189604C3A76CB
Post #14
Hi,

I merged the old topic with this one…

Please delete the current version of Combofix.exe from your desktop and download a new version from here to your desktop.

Disable your AntiVirus and AntiSpyware applications.

Right-click and Run as Administrator on the Combofix.exe and follow the prombts on your display. When finish, it will create a C:\Combofix.txt. Please post this log for further review.
———
Post #15
ComboFix 13-02-13.02 - lointusk 02/15/2013 1:15.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1278.814 [GMT -7:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\msconfig.exe
c:\windows\system32\roboot.exe
c:\windows\system32\SET95D.tmp
.
.
((((((((((((((((((((((((( Files Created from 2013-01-15 to 2013-02-15 )))))))))))))))))))))))))))))))
.
.
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\wbem\snmp
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\srchasst
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\xircom
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\program files\microsoft frontpage
2013-02-15 01:09 . 2013-02-15 01:09 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C4A319E-8B2C-48A6-B6A3-414CD0C104AF}\MpKsl266b8764.sys
2013-02-11 10:49 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C4A319E-8B2C-48A6-B6A3-414CD0C104AF}\mpengine.dll
2013-02-10 12:27 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-07 15:47 . 2013-02-07 15:48 ——– d—–w- c:\program files\Dropbox
2013-02-07 15:43 . 2013-02-15 08:10 ——– d—–w- c:\documents and settings\lointusk\Application Data\Dropbox
2013-02-07 07:26 . 2013-02-07 07:26 ——– d—–w- c:\documents and settings\lointusk\Local Settings\Application Data\CRE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-15 08:07 . 2009-10-10 12:45 98304 —-a-w- c:\windows\DUMP50cf.tmp
2013-01-30 10:53 . 2012-11-29 16:55 232336 ——w- c:\windows\system32\MpSigStub.exe
2012-12-16 12:23 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 23:49 . 2012-11-29 17:34 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-12-04 20:09 . 2012-12-04 20:09 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-04 20:09 . 2012-12-04 20:09 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-06 01:32 . 2013-02-06 01:30 262552 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-08-05 . 25A740D70E8007814A48D3FA1B34FA34 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-19 7634944]
"nwiz"="nwiz.exe" [2007-03-19 1622016]
"NvMediaCenter"="NvMCTray.dll" [2007-03-19 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-08-05 128512]
.
c:\documents and settings\lointusk\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\lointusk\Application Data\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HiCDEject.lnk - c:\program files\HiCDEject\HiCDEject.exe [2001-2-13 9248]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"AdVantage"=c:\documents and settings\lointusk\Application Data\advantage\AdVantage.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Documents and Settings\\lointusk\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/10/2009 10:34 AM 721904]
R1 MpKsl266b8764;MpKsl266b8764;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C4A319E-8B2C-48A6-B6A3-414CD0C104AF}\MpKsl266b8764.sys [2/14/2013 6:09 PM 29904]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [11/29/2012 10:34 AM 398184]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/29/2012 10:34 AM 682344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/29/2012 10:34 AM 21104]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.313\McCHSvc.exe [10/26/2012 11:15 AM 234776]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - HELPSVC
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001Core.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001UA.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-15 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 22:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1 [removed]
TCP: Interfaces\{3C2F8020-1F67-43A0-B7E4-678FBBA60FBA}: NameServer = 192.168.0.1
TCP: Interfaces\{58FA7B8E-4E10-4456-906A-8DF7B9D15259}: NameServer = 192.168.0.1
TCP: Interfaces\{595FCF1C-C74B-46AE-B3B1-6CD47E0297D6}: NameServer = 192.168.0.1
TCP: Interfaces\{6A9C593A-3C2B-4D4A-9DBD-6DB76CA920C6}: NameServer = 192.168.0.1
TCP: Interfaces\{8DF4D200-5EF5-45C5-B945-C7DFAE8DE4FA}: NameServer = 192.168.0.1
TCP: Interfaces\{9F9D5D91-3B90-408F-94E8-D822F7C38B25}: NameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/firefox/?fr=sfp-yff17
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-15 01:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-02-15 01:23:44
ComboFix-quarantined-files.txt 2013-02-15 08:23
ComboFix2.txt 2013-02-15 01:25
.
Pre-Run: 9,996,812,288 bytes free
Post-Run: 9,989,238,784 bytes free
.
- - End Of File - - A6E1DBF146D8CDAE33873B459DD1849E

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI