[Closed] need help to remove virtumonde (page 2)

jmw3

Post #16January 28, 2009, 9:59 AM UTC

but I am not sure I got rid of the BUM or SHASTA

Have a look in you Add/Remove Programs. Are they still there?

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

File::
c:\windows\Tasks\AdwareAlert Scheduled Scan.job

Folder::
c:\documents and settings\Owner\Application Data\AdwareAlert

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

DDS::
Trusted Zone: turbotax.com

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Run ATF-Cleaner again.

Kaspersky Online Scan
Do an online scan with >Kaspersky Online Scanner<

Read through the requirements and privacy statement and click on Accept button
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run
When the downloads have finished, click on Settings
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan
Once the scan is complete, it will display the results. Click on View Scan Report
You will see a list of infected items there. Click on Save Report As…
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button
Please post this log in your next reply

To post in next reply:
Combofix log
Kaspersky Scan log
New HijackThis log

jhutch34

Post #17January 30, 2009, 2:55 PM UTC

It is taking a very long time to run these scans. ComboFix took about two hours. I started the Kaspersky at 9 last night and by 12 it hadn't finished. I went to bed woke up this morning and nothing? Is there a report stored somewhere? How do I find it? Don't hurry oon the response, I am going out of town for the weekend, leaving now and returning Sunday night. I will continue this process on Monday. Thanks again for all of your help.

jmw3

Post #18January 31, 2009, 4:16 PM UTC

It is taking a very long time to run these scans. ComboFix took about two hours. I started the Kaspersky at 9 last night and by 12 it hadn't finished.

So did Combofix actually finish? if so the log can be found at C:\Combofix.txt. As for the Kaspersky scan, it can take quite a while sometimes. If your having problems with them we'll try this:

OTMoveIt3
Download OTMoveIt3.exe by OldTimer and save it to your desktop.

Double click on OTMoveIt3.exe to run it
Copy & paste the contents of the Code box below into Paste Instructions for Items to be Moved

Note: Do not type it out to minimize the risk of typo error

:Files
c:\windows\Tasks\AdwareAlert Scheduled Scan.job
c:\documents and settings\Owner\Application Data\AdwareAlert

:Reg
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

:Commands
[Purity]
[EmptyTemp]
[Reboot]

Click on MoveIt!
When done, click on Exit

Note: If a file or folder can't be moved immediately, you may be asked to restart your computer. Choose Yes.
A log will be produced at C:\_OTMoveIt\MovedFiles\date_time.log, where date_time are numbers. Post this log in your next reply.

Eset Online Scan
Go to the Eset website to perform an online scan. Please use Internet Explorer as it uses ActiveX.

Check (tick) this box: YES, I accept the Terms of Use
Click on the Start button next to it
When prompted to run ActiveX click Yes
You will be asked to install an ActiveX. Click Install
Once installed, the scanner will be initialized
After the scanner is initialized, click Start
Uncheck (untick) Remove found threats box
Check (tick) Scan unwanted applications
Click on Scan
It will start scanning. The scan may take a while so please be patient
Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt. Post the contents of the log in your next reply

Gmer
Download gmer.zip from Gmer here & save it to your desktop.

Right click on gmer.zip and select Extract All…
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard
Click on the Browse button. Click on Desktop. Then click OK
Click Next. It will start extracting
Once done, check (tick) the Show extracted files box and click Finish
Double click on gmer.exe to run it
Select the Rootkit tab
On the right hand side, check all the items to be scanned, but leave Show All box unchecked
Select all drives that are connected to your system to be scanned
Click on the Scan button
When the scan is finished, click Copy to save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into the text editor
Save the Gmer scan log and post it in your next reply
Close Gmer

Note: Do not run any programs while Gmer is running.

To post in next reply:
OTMoveIt3 log
Eset Online Scan log
New HijackThis log

jhutch34

Post #19February 3, 2009, 12:17 AM UTC

My desktop is completely gone? I have not run any scans or anything since returning home. I was just checking e-mail and facebook and I got all sorts of popups again. My computer froze up, shut off, came back on with no desktop. I can now only access anything with control-alt-delete and new task with the windows task manager.

jmw3

Post #20February 3, 2009, 10:42 AM UTC

Hmmmm…. We were on the home straight. OK, No worries.

Fix Policies
Download FixPolicies.exe from Here & save to your Desktop. This is a self-extracting ZIP archive.

Double-click FixPolicies.exe
Click the Install button on the bottom toolbar of the box that will open
The program will create a new Folder called FixPolicies
Double-click to open the new Folder then double-click on Fix_Policies.cmd
A black box should briefly appear and then close. This will enable your Control Panel & stop the Administrative warnings, at least until the malware infection resets the registry policy keys again. You can run this as many times as you like. A permanent fix requires removing the infection.

Random's System Information Tool (RSIT)

Download Random's System Information Tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run the tool
Click Continue at the disclaimer screen
Once it has finished, two logs will open, log.txt (<info.txt (<
Copy & paste the contents of both logs in your next reply

If info.txt does not minimise to the Task Bar, you will find it in C:\rsit

Gmer
Download gmer.zip from Gmer here & save it to your desktop.

Right click on gmer.zip and select Extract All…
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard
Click on the Browse button. Click on Desktop. Then click OK
Click Next. It will start extracting
Once done, check (tick) the Show extracted files box and click Finish
Disable ALL Anti-virus & Anti-spyware programs prior to running Gmer
Double click on gmer.exe to run it
Select the Rootkit tab
On the right hand side, check all the items to be scanned, but leave Show All box unchecked
Select all drives that are connected to your system to be scanned
Click on the Scan button
When the scan is finished, click Copy to save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into the text editor
Save the Gmer scan log and post it in your next reply
Close Gmer

Note: Do not run any programs while Gmer is running.

To post in next reply:
RSIT logs
Gmer log

jhutch34

Post #21February 3, 2009, 4:38 PM UTC

I can't use Explorer at all. I get a pop up for an anti virus software and scan I can't get rid of. I have switched to Firefox, it doesn't seem to pop up there.

Here are the logs you asked for.

RSIT #1 -

Logfile of random's system information tool 1.05 (written by random/random)
Run by [removed] at 2009-02-03 08:46:58
Microsoft Windows XP Professional Service Pack 3
System drive C: has 176 GB (75%) free of 234 GB
Total RAM: 1012 MB (36% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:47:08 AM, on 2/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://security.microsoft.com/status/?advid=67456
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p;=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 207.182.144.198 security.yahoo.com
O1 - Hosts: 207.182.144.198 security.google.com
O1 - Hosts: 207.182.144.198 advisor.microsoft.com
O1 - Hosts: 207.182.144.198 upgrade.microsoft.com
O1 - Hosts: 207.182.144.198 security.microsoft.com
O1 - Hosts: 207.182.144.198 store.microsoft.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: BinView - {54FBB5AD-5F1A-41BC-B884-7A198AAE6956} - C:\WINDOWS\system32\jumast.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Recguard] "C:\WINDOWS\SMINST\RECGUARD.EXE"
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ezShieldProtector for Px] "C:\WINDOWS\system32\ezSP_Px.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Qhoney] rundll32.exe "C:\WINDOWS\Sfuno.dll",e
O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe
O4 - HKLM\..\Run: [Wbumuyuq] rundll32.exe "C:\WINDOWS\oridanaw.dll",e
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKCU\..\Run: [Installer] "C:\WINDOWS\system32\wpv331232936156.cpx"
O4 - HKUS\S-1-5-18\..\Run: [userinit] C:\WINDOWS\system32\twext.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [userinit] C:\WINDOWS\system32\twext.exe (User 'Default user')
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: MEMonitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo2.walgreens.com/WalgreensActivia.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136668105390
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PowerPanel Personal Edition Service (ppped) - Unknown owner - C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

–
End of file - 10336 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job
C:\WINDOWS\tasks\wrSpySweeperFullSweep.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54FBB5AD-5F1A-41BC-B884-7A198AAE6956}]
BinView - C:\WINDOWS\system32\jumast.dll [2009-02-02 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files\McAfee\VirusScan\scriptsn.dll [2007-11-09 58688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-14 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-13 212992]
"IntelAudioStudio"=C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe [2005-05-10 7086080]
"ezShieldProtector for Px"=C:\WINDOWS\system32\ezSP_Px.exe [2002-08-20 40960]
"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [2007-03-09 63712]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-10-01 111936]
"mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2007-11-01 582992]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-14 136600]
"Qhoney"=C:\WINDOWS\Sfuno.dll [2009-02-02 42496]
"lrijh8s73jhbfgfd"=C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe []
"Wbumuyuq"=C:\WINDOWS\oridanaw.dll [2009-02-02 134656]
"SpySweeper"=C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-08-09 5418864]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE [2004-02-02 401491]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
"Installer"=C:\WINDOWS\system32\wpv331232936156.cpx [2009-02-02 81931]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
C:\WINDOWS\zHotkey.exe [2004-05-17 543232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe [2004-08-10 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio]
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe [2005-05-10 7086080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowWnd]
C:\WINDOWS\ShowWnd.exe [2003-09-19 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
C:\Program Files\Digital Media Reader\shwiconem.exe [2004-11-15 135168]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Documents and Settings\Owner\Start Menu\Programs\Startup
Cyber-shot Viewer Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
MEMonitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WebrootSpySweeperService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE:*:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe"="C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater"
"C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe"="C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe:*:Enabled:EasyShare"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\TurboTax\Premier 2006\32bit\ttax.exe"="C:\Program Files\TurboTax\Premier 2006\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\Program Files\TurboTax\Premier 2006\32bit\updatemgr.exe"="C:\Program Files\TurboTax\Premier 2006\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\McAfee\VirusScan\mcods.exe"="C:\Program Files\McAfee\VirusScan\mcods.exe:*:Enabled:mcods"
"C:\Program Files\McAfee\VirusScan\mcvsmap.exe"="C:\Program Files\McAfee\VirusScan\mcvsmap.exe:*:Enabled:mcvsmap"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-02-03 08:46:58 —-D—- C:\rsit
2009-02-03 08:41:50 —-D—- C:\32788R22FWJFW
2009-02-02 18:58:53 —-SHD—- C:\RECYCLER
2009-02-02 17:43:11 —-A—- C:\WINDOWS\oridanaw.dll
2009-02-02 17:00:19 —-A—- C:\WINDOWS\system32\cmd.execf
2009-02-02 16:58:41 —-D—- C:\ComboFix
2009-02-02 16:58:34 —-A—- C:\WINDOWS\system32\CF15756.exe
2009-02-02 12:34:42 —-A—- C:\WINDOWS\system32\TDSSwokt.dll
2009-02-02 12:34:23 —-A—- C:\WINDOWS\system32\msfokm33fdnd.dll
2009-02-02 12:33:12 —-A—- C:\WINDOWS\sysguard.exe
2009-02-02 12:32:27 —-D—- C:\Documents and Settings\Owner\Application Data\wpv841233285804
2009-02-02 12:31:14 —-D—- C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd
2009-02-02 12:29:33 —-A—- C:\WINDOWS\Sfuno.dll
2009-02-02 12:28:44 —-A—- C:\WINDOWS\system32\jumast.dll
2009-02-02 12:25:29 —-A—- C:\WINDOWS\system32\~.exe
2009-01-28 22:11:27 —-A—- C:\ComboFix.txt
2009-01-28 03:02:54 —-HDC—- C:\WINDOWS\$NtUninstallKB958687$
2009-01-28 03:00:35 —-A—- C:\WINDOWS\system32\MRT.exe
2009-01-26 19:10:45 —-A—- C:\Boot.bak
2009-01-26 19:10:25 —-RASHD—- C:\cmdcons
2009-01-26 19:03:46 —-A—- C:\WINDOWS\zip.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\VFIND.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\SWXCACLS.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\SWSC.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\SWREG.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\sed.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\NIRCMD.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\grep.exe
2009-01-26 19:03:46 —-A—- C:\WINDOWS\fdsv.exe
2009-01-26 19:00:27 —-D—- C:\WINDOWS\ERDNT
2009-01-26 19:00:27 —-D—- C:\Qoobox
2009-01-22 17:01:13 —-D—- C:\Documents and Settings\Owner\Application Data\McAfee
2009-01-21 22:16:03 —-A—- C:\WINDOWS\system32\javaws.exe
2009-01-21 22:16:03 —-A—- C:\WINDOWS\system32\javaw.exe
2009-01-21 22:16:03 —-A—- C:\WINDOWS\system32\java.exe
2009-01-19 20:38:37 —-D—- C:\Program Files\Trend Micro
2009-01-19 17:49:20 —-A—- C:\VundoFix.txt
2009-01-18 12:32:29 —-D—- C:\Documents and Settings\Owner\Application Data\Snapfish
2009-01-13 18:34:13 —-D—- C:\Documents and Settings\Owner\Application Data\Move Networks

======List of files/folders modified in the last 1 months======

2009-02-03 08:47:02 —-D—- C:\WINDOWS\temp
2009-02-03 08:46:45 —-D—- C:\WINDOWS\Prefetch
2009-02-03 08:39:22 —-D—- C:\Program Files\Mozilla Firefox
2009-02-03 00:00:00 —-D—- C:\Program Files\CyberPower PowerPanel Personal Edition
2009-02-02 21:02:06 —-A—- C:\WINDOWS\ModemLog_SoftV92 Data Fax Modem with SmartCP.txt
2009-02-02 19:57:11 —-D—- C:\WINDOWS\Registration
2009-02-02 19:57:08 —-D—- C:\WINDOWS
2009-02-02 19:55:39 —-HD—- C:\Config.Msi
2009-02-02 19:55:38 —-D—- C:\WINDOWS\system32
2009-02-02 19:54:52 —-A—- C:\WINDOWS\SchedLgU.Txt
2009-02-02 19:51:12 —-D—- C:\Program Files
2009-02-02 19:28:44 —-D—- C:\WINDOWS\system32\drivers
2009-02-02 19:05:36 —-D—- C:\Program Files\Yahoo!
2009-02-02 19:04:27 —-HD—- C:\Program Files\InstallShield Installation Information
2009-02-02 19:04:27 —-D—- C:\Program Files\Sony
2009-02-02 19:04:09 —-HD—- C:\WINDOWS\inf
2009-02-02 19:04:08 —-D—- C:\WINDOWS\Help
2009-02-02 19:04:08 —-D—- C:\Program Files\Web Publish
2009-02-02 19:04:04 —-SD—- C:\WINDOWS\Downloaded Program Files
2009-02-02 19:03:50 —-SHD—- C:\WINDOWS\Installer
2009-02-02 19:03:13 —-D—- C:\Program Files\Microsoft Works
2009-01-28 22:01:32 —-D—- C:\WINDOWS\system32\CatRoot2
2009-01-28 21:57:47 —-A—- C:\WINDOWS\system.ini
2009-01-28 21:47:54 —-D—- C:\WINDOWS\AppPatch
2009-01-28 21:47:54 —-D—- C:\Program Files\Common Files
2009-01-28 21:33:40 —-SD—- C:\WINDOWS\Tasks
2009-01-28 03:02:57 —-RSHDC—- C:\WINDOWS\system32\dllcache
2009-01-28 03:02:18 —-HD—- C:\WINDOWS\$hf_mig$
2009-01-27 17:16:46 —-D—- C:\WINDOWS\network diagnostic
2009-01-26 19:45:18 —-D—- C:\WINDOWS\system32\config
2009-01-26 19:10:48 —-RASH—- C:\boot.ini
2009-01-26 11:09:01 —-A—- C:\WINDOWS\NeroDigital.ini
2009-01-22 17:01:40 —-D—- C:\Documents and Settings\All Users\Application Data\McAfee
2009-01-21 22:16:32 —-D—- C:\Program Files\Java
2009-01-19 20:29:20 —-D—- C:\Program Files\Hijackthis

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2004-10-07 35840]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2007-11-22 201320]
R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2007-07-13 113952]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-05-22 20747]
R2 ASCTRM;ASCTRM; C:\WINDOWS\system32\drivers\ASCTRM.sys [2005-05-24 8552]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-04-05 132352]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2004-06-17 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2004-06-17 220032]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2007-11-22 79304]
R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2007-11-22 35240]
R3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2007-11-22 33832]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2007-12-02 40488]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 sfng32;Sonic Focus Plugin for Sigmatel HDA; C:\WINDOWS\system32\drivers\sfng32.sys [2005-04-04 35712]
R3 SSKBFD;Webroot Spy Sweeper Keylogger Shield Keyboard Filter; C:\WINDOWS\System32\Drivers\sskbfd.sys [2008-01-04 23920]
R3 STHDA;High Definition Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2005-04-27 300672]
R3 SunkFilt;Alcor Micro Corp Reader; \??\C:\WINDOWS\System32\Drivers\sunkfilt.sys []
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VAD_DEV;Virtual Audio Service; C:\WINDOWS\system32\drivers\vad.sys [2008-09-25 16384]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2004-06-17 685056]
S1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2005-11-03 2432]
S1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2005-11-03 2560]
S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-13 42752]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
S3 HidBatt;HID UPS Battery Driver; C:\WINDOWS\system32\DRIVERS\HidBatt.sys [2008-04-13 20352]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-09-28 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-09-28 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-09-28 21744]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 mr97310c;CIF Dual-Mode Camera; C:\WINDOWS\system32\DRIVERS\mr97310c.sys [2008-08-26 110592]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 mxnic;Macronix MX987xx Family Fast Ethernet NT Driver; C:\WINDOWS\system32\DRIVERS\mxnic.sys [2001-08-17 19968]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 RT61;Linksys Wireless-G PCI Adapter Driver(RT61); C:\WINDOWS\system32\DRIVERS\RT61.sys [2005-10-27 356096]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 SQTECH905C;DB CIF Cam; C:\WINDOWS\System32\Drivers\Capt905c.sys [2006-01-26 34686]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2003-12-21 104064]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2004-09-28 195584]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2004-08-10 102912]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-14 152984]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2008-12-05 206096]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-02 69632]
R2 ppped;PowerPanel Personal Edition Service; C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe [2005-05-06 466944]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2005-05-24 172032]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-08-14 1245064]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine; C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe [2008-08-09 3585384]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-12-05 695624]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-14 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 MSCSPTISRV;MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [2006-04-27 53337]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PACSPTISVR;PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [2006-04-27 49241]
S3 SPTISRV;Sony SPTI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [2006-04-27 69718]
S3 SSScsiSV;SonicStage SCSI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe [2006-05-08 69632]
S4 WMP54Gv4SVC;WMP54Gv4SVC; C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe [2004-02-06 41025]

—————–EOF—————–

RSIT #2 -

info.txt logfile of random's system information tool 1.05 2009-02-03 08:47:12

======Uninstall list======

–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88E5FCB8-5F25-11D5-B16F-0800460222F0}\setup.exe" -l0x9 UNINSTALL
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D76298C2-E532-4A11-BCFF-76F3F19DA84D}\setup.exe" UNINSTALL
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4E7DC12A-3597-4A94-9429-F6C6987361B1}\setup.exe" -l0x9 -removeonly
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7DADB304-AF20-48C3-A780-4B4133A08817}\setup.exe" -l0x9 -removeonly
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C423CF6-2DAA-4A37-94B8-59D7ECC7DB13}\setup.exe" -l0x9 -removeonly
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FA6CC4B4-7741-4F8D-8E81-15C4BAB9869B}\setup.exe" -l0x9 -removeonly
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 9 ActiveX–>C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.1.0–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A71000000002}
Adobe Shockwave Player–>C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Adobe® Photoshop® Album Starter Edition 3.2–>MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
Apple Mobile Device Support–>MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft PhotoImpression 4–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68D5CEF9-0DA8-47FE-B0EB-4CBFB5AAF662}\setup.exe" -l0x9
ArcSoft PhotoStudio 5.5–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x9
BigFix–>C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\BigFix\Uninst.isu" -c"C:\Program Files\BigFix\Lib\UninstallHelper.dll"
BUM–>MsiExec.exe /I{55937F00-A69B-4049-8D3A-1C7729742B6F}
Canon MP Navigator 2.0–>"C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP170–>"C:\WINDOWS\system32\CanonMP Uninstaller Information\{91175441-4E5D-4e13-B116-828FD352CDB2}\DelDrv.exe" /U:{91175441-4E5D-4e13-B116-828FD352CDB2} /L0x0009
Canon Utilities Easy-PhotoPrint–>C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CardRd81–>MsiExec.exe /I{54C8FE84-89C4-40E8-976C-439EB0729BD6}
CCScore–>MsiExec.exe /I{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}
Compatibility Pack for the 2007 Office system–>MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
CR2–>MsiExec.exe /I{432C3720-37BF-4BD7-8E49-F38E090246D0}
CyberPower PowerPanel Personal Edition–>MsiExec.exe /I{07397346-C8BA-4F57-A625-55AC31108AEC}
DB CIF Cam–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{766E4715-B801-46B3-9D91-12288AB88428}\Setup.exe" -l0x9
DIGITAL BINOCULAR–>MsiExec.exe /I{388887F6-0661-4C80-B272-A6A23EFC7A31}
Digital Media Reader–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}
Disney Pix Micro Downloader–>MsiExec.exe /X{183135A3-2CE8-43B5-BA5A-757EBAECB413}
Documents To Go–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C89C4BEA-3B9A-414A-9392-9CE4EC5C63BF}\Setup.exe" -vzUNINST
Easy-WebPrint–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
ESSBrwr–>MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}
ESSCDBK–>MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
ESScore–>MsiExec.exe /I{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}
ESSgui–>MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}
ESShelp–>MsiExec.exe /I{87843A41-7808-4F2E-B13F-25C1E67CF2FD}
ESSini–>MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}
ESSPCD–>MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
ESSPDock–>MsiExec.exe /I{FCDB1C92-03C6-4C76-8625-371224256091}
ESSSONIC–>MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34}
ESSTOOLS–>MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}
essvatgt–>MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}
essvcpt–>MsiExec.exe /I{D1973749-F5E7-40EB-B528-F2B78685B9FF}
exPressit S.E. 2.1–>"C:\Program Files\exPressit S.E. 2.1\UninstallerData\Uninstall exPressit S.E. 2.1.exe"
Flash Video Exporter 1.2–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8D61229A-9C20-465E-9EEA-76D98FAFE5F6}\Setup.exe" -l0x9 UNINSTALL
Form Viewer–>MsiExec.exe /X{F4536148-B779-4675-98A8-7DD474DDBDA7}
GdiplusUpgrade–>MsiExec.exe /I{5421155F-B033-49DB-9B33-8F80F233D4D5}
Geek Squad 24 Hour Computer Support–>MsiExec.exe /I{356C1B0F-7ABD-4B52-ADD1-52681D27DBF6}
High Definition Audio Driver Package - KB835221–>C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
Hijackthis 1.99.1–>"C:\Program Files\Hijackthis\unins000.exe"
HijackThis 2.0.2–>"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HLPPDOCK–>MsiExec.exe /I{154508C0-07C5-4659-A7A0-E49968750D21}
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
HP Update–>MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
IBM OnDemand AFP Web Viewer–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{13AD0029-FB8E-470E-9EFE-84DA4F5A54AB}\setup.exe" Remove
IKEA HomePlanner Bedroom–>MsiExec.exe /I{66763074-E033-4AB8-9DCD-76AA30CCD543}
Intel Audio Studio–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3D1B20A6-E31D-4BB5-BC5C-DDD3B0D91728}\setup.exe" -l0x9
Intel® Graphics Media Accelerator Driver–>RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV;_2776 PCI\VEN_8086&DEV;_2772
IrfanView (remove only)–>C:\Program Files\IrfanView\iv_uninstall.exe
iTunes–>MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
Java™ 6 Update 11–>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
kgcbase–>MsiExec.exe /I{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}
Kodak EasyShare software–>C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_1e0010_25615\Setup.exe /APR-REMOVE
KSU–>MsiExec.exe /I{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}
Linksys Wireless-G PCI Adapter–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4DDC3BED-CC68-44AA-B435-D727B620CA5B}\setup.exe" -l0x9
LiveUpdate Notice (Symantec Corporation)–>MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
McAfee SecurityCenter–>C:\Program Files\McAfee\MSC\mcuninst.exe
Memorex exPressit Label Design Studio–>C:\WINDOWS\mvuninst\App1\mvuninst.exe "Memorex exPressit Label Design Studio"
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft ActiveSync 3.7–>"C:\WINDOWS\ISUNINST.EXE" -f"C:\Program Files\Microsoft ActiveSync\DeIsL1.isu" -c"C:\Program Files\Microsoft ActiveSync\ceuninst.dll"
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Standard Edition 2003–>MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft Picture It! Premium 10–>"C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=PREM
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.1)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Music Assistant–>rundll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msninst.inf,Uninstall
MSXML 4.0 SP2 (KB925672)–>MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63}
MSXML 4.0 SP2 (KB927978)–>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)–>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Multimedia Keyboard Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6E66ECBD-FCA7-4AE1-A8C5-1CA78BEEB057}\Setup.exe" -l0x9
Music Visualizer Library 1.4.00–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3B24B725-D81F-442D-8CE5-2AF05A4A4CC9}\Setup.exe" -l0x9
NCR Label Formats for MS Word Setup–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\NCR Media Formats\Uninst.isu"
Nero BurnRights–>C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
Nero OEM–>C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
OfotoXMI–>MsiExec.exe /I{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}
OpenMG AAC Add-on Module 1.0.00–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3} UNINSTALL
OpenMG Limited Patch 4.5-06-05-12-01–>C:\Program Files\Common Files\Sony Shared\OpenMG\HotFixes\HotFix4.5-06-05-12-01\HotFixSetup\setup.exe /u
OpenMG Secure Module 4.5.01–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{3633BA28-67CE-4AC8-A677-3406CA84C3D8} UNINSTALL
Opera 9.21–>MsiExec.exe /X{AF599832-2305-4922-9342-6FF48894E384}
OTtBP–>MsiExec.exe /I{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}
OTtBPSDK–>MsiExec.exe /I{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}
Palm-Tech Inspector Version 4.0–>C:\PROGRA~1\PALM-T~1\UNWISE.EXE C:\PROGRA~1\PALM-T~1\PTIINS~1.LOG
Photo Viewer 2.3–>"C:\Program Files\Photo Viewer\uninstall.exe"
Pirates of the Caribbean Screen Saver–>C:\WINDOWS\INDSOFT\SSAVERS\Pirates of the Caribbean\UNINSTAL.EXE
PokerStars–>"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
PowerDVD–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
PowerVideoMaker Professional 3.5.2–>"C:\Program Files\Presentersoft PowerVideoMaker\unins000.exe"
Quicken 2006–>MsiExec.exe /X{2818095F-FB6C-42C8-827E-0A406CC9AFF5}
QuickTime–>MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
RealPlayer Basic–>C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
RegCure 1.5.0.0–>C:\Program Files\RegCure\uninst.exe
SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{E9ED0801-253D-4FE9-AB20-F63DEFE72547}
Scrabble–>C:\WINDOWS\uninst.exe -fc:\Scrabble\DeIsL1.isu -cc:\Scrabble\_ISREG32.DLL
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Windows Internet Explorer 7 (KB928090)–>"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB929969)–>"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB931768)–>"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB933566)–>"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB937143)–>"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)–>"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)–>"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)–>"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)–>"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)–>"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)–>"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)–>"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)–>"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)–>"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)–>"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)–>"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)–>"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)–>"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)–>"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)–>"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)–>"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)–>"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
SFR–>MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}
SFR2–>MsiExec.exe /I{A0AF08BA-3630-4505-BFB2-A41F3837B0D0}
SHASTA–>MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237}
SigmaTel Audio–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly
SKIN0001–>MsiExec.exe /I{FDF9943A-3D5C-46B3-9679-586BD237DDEE}
SKINXSDK–>MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}
SoftV92 Data Fax Modem with SmartCP–>C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV;_2F20&SUBSYS;_200014F1\HXFSETUP.EXE -U -IURSLST5K.inf
Sonic Encoders–>MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
SonicStage 4.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A0EB195B-5876-48E6-879D-33D4B2102610}\setup.exe" -l0x9 UNINSTALL -removeonly
Sony Picture Utility–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5068583-D569-468B-9755-5FBF5848F46F}\setup.exe" -l0x9 /removeonly uninstall -removeonly
Sony USB Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\Setup.exe" UNINSTALL
Spy Sweeper Core–>MsiExec.exe /I{3F5B6210-0903-4DC6-8034-8F488AA3A782}
Spy Sweeper–>"C:\Program Files\Webroot\Spy Sweeper\unins000.exe"
staticcr–>MsiExec.exe /I{8943CE61-53BD-475E-90E1-A580869E98A2}
The Print Shop 20–>MsiExec.exe /I{863DCE5B-D6CA-4DC5-9F95-7DCFED15DE8F}
TurboTax ItsDeductible 2006–>MsiExec.exe /X{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}
TurboTax Premier Investments 2006–>C:\Program Files\TurboTax\Premier 2006\TaxUnst.EXE "C:\Program Files\TurboTax\Premier 2006\Uninstall.log" -NoGui
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)–>"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
V CAST Music Manager –>C:\PROGRA~1\VERIZO~1\VCASTM~3\Setup.exe /remove /q0
V CAST Music–>MsiExec.exe /X{3249FD43-B24B-413F-B786-F8FEA32FA747}
Vegas Movie Studio Platinum 9.0–>MsiExec.exe /X{F14F7FCF-6299-446A-A8F5-C5B791015692}
VPRINTOL–>MsiExec.exe /I{999D43F4-9709-4887-9B1A-83EBB15A8370}
Windows Driver Package - MARS (MR97310_USB_DUAL_CAMERA) Image (12/03/2002 1.2.9.0)–>C:\PROGRA~1\DIFX\7F01D4C0B2897E27\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\mr97310c_52FB7056C8831251CD4DE5CE4CA768F61CDCAD48\mr97310c.inf
Windows Genuine Advantage v1.3.0254.0–>MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Installer Clean Up–>MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52}
Windows Media Format Runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WIRELESS–>MsiExec.exe /I{F9593CFB-D836-49BC-BFF1-0E669A411D9F}
Wondershare PPT2DVD 5.1.0.68–>"C:\Program Files\Wondershare\PPT2DVD\unins000.exe"

======Hosts File======

207.182.144.198 security.yahoo.com
207.182.144.198 security.google.com
[removed] advisor.microsoft.com
[removed] upgrade.microsoft.com
[removed] security.microsoft.com
[removed] store.microsoft.com

======Security center information======

AV: McAfee VirusScan
FW: McAfee Personal Firewall

System event log

Computer Name: YOUR-2540FFFB43
Event Code: 7035
Message: The LiveUpdate service was successfully sent a start control.

Record Number: 287885
Source Name: Service Control Manager
Time Written: 20081226065312.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-2540FFFB43
Event Code: 7036
Message: The LiveUpdate service entered the stopped state.

Record Number: 287884
Source Name: Service Control Manager
Time Written: 20081226054940.000000-420
Event Type: information
User:

Computer Name: YOUR-2540FFFB43
Event Code: 7036
Message: The LiveUpdate service entered the running state.

Record Number: 287883
Source Name: Service Control Manager
Time Written: 20081226054849.000000-420
Event Type: information
User:

Computer Name: YOUR-2540FFFB43
Event Code: 7035
Message: The LiveUpdate service was successfully sent a start control.

Record Number: 287882
Source Name: Service Control Manager
Time Written: 20081226054849.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-2540FFFB43
Event Code: 7036
Message: The LiveUpdate service entered the stopped state.

Record Number: 287881
Source Name: Service Control Manager
Time Written: 20081226044305.000000-420
Event Type: information
User:

Application event log

Computer Name: YOUR-2540FFFB43
Event Code: 101
Message:
Record Number: 37228
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081211043927.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-2540FFFB43
Event Code: 101
Message:
Record Number: 37227
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081211043927.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-2540FFFB43
Event Code: 101
Message:
Record Number: 37226
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081211043811.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-2540FFFB43
Event Code: 101
Message:
Record Number: 37225
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081211034111.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-2540FFFB43
Event Code: 101
Message:
Record Number: 37224
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081211034111.000000-420
Event Type: information
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0404
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

—————–EOF—————–

GMER -

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-03 09:33:36
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.14 —-

SSDT 87181A58 ZwAllocateVirtualMemory
SSDT 871C5480 ZwCreateKey
SSDT 8715F148 ZwCreateProcess
SSDT 871541C8 ZwCreateProcessEx
SSDT 87181D28 ZwCreateThread
SSDT 87183150 ZwDeleteKey
SSDT 8715F1C0 ZwDeleteValueKey
SSDT 87181AD0 ZwQueueApcThread
SSDT 87181968 ZwReadVirtualMemory
SSDT 87182148 ZwRenameKey
SSDT 87181BC0 ZwSetContextThread
SSDT 8718B240 ZwSetInformationKey
SSDT 87181E18 ZwSetInformationProcess
SSDT 87181C38 ZwSetInformationThread
SSDT 8718D238 ZwSetValueKey
SSDT 87181DA0 ZwSuspendProcess
SSDT 87181B48 ZwSuspendThread
SSDT 87154150 ZwTerminateProcess
SSDT 87181CB0 ZwTerminateThread
SSDT 871819E0 ZwWriteVirtualMemory

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xAA4DA9A8]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xAA4DAAE5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xAA4DAACF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xAA4DA9E8]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xAA4DAB11]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xAA4DAA2B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xAA4DA930]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xAA4DA944]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xAA4DA9BC]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xAA4DAB4D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xAA4DAAB9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xAA4DAAA3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xAA4DAB39]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xAA4DAB25]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xAA4DAAFB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xAA4DA9FE]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xAA4DA9D2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread

—- Kernel code sections - GMER 1.0.14 —-

.text ntkrnlpa.exe!ZwYieldExecution 80504AE8 7 Bytes JMP AA4DA9D6 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 80579084 5 Bytes JMP AA4DA9AC \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 805B2006 7 Bytes JMP AA4DA9EC \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805B2E14 5 Bytes JMP AA4DAA02 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805B83E6 7 Bytes JMP AA4DA9C0 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenProcess 805CB408 5 Bytes JMP AA4DA934 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenThread 805CB694 5 Bytes JMP AA4DA948 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryValueKey 806219CA 7 Bytes JMP AA4DAAA7 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnloadKey 80622042 7 Bytes JMP AA4DAAFF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryMultipleValueKey 806228E0 7 Bytes JMP AA4DAABD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FD2 7 Bytes JMP AA4DAAE9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateValueKey 8062423C 2 Bytes JMP AA4DAAD3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateValueKey + 3 8062423F 4 Bytes [ EB, 29, 90, 90 ]
PAGE ntkrnlpa.exe!ZwOpenKey 80624B64 5 Bytes JMP AA4DAA2F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryKey 80624E8A 7 Bytes JMP AA4DAB51 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRestoreKey 8062514A 5 Bytes JMP AA4DAB29 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwReplaceKey 8062583E 5 Bytes JMP AA4DAB3D \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwNotifyChangeKey 80625958 5 Bytes JMP AA4DAB15 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- User code sections - GMER 1.0.14 —-

.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A0FEF
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A0F5E
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A0049
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A0F6F
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A0022
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A0011
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A0F1F
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A0F3C
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A00A4
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A0089
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 001A0EF0
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 001A0F80
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 001A0FCA
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 001A0F4D
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 001A0000
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 001A0FAF
.text C:\WINDOWS\System32\svchost.exe[132] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 001A0078
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00290FE5
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00290FA8
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00290036
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00290025
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00290FC3
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 0029000A
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00290FD4
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 49, 88 ]
.text C:\WINDOWS\System32\svchost.exe[132] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 0029005B
.text C:\WINDOWS\System32\svchost.exe[132] WS2_32.dll!socket 71AB4211 5 Bytes JMP 009B0000
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00040FE5
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00040F72
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00040071
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0004004A
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00040F97
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00040025
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 0004009F
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0004008E
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00040F32
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 000400C1
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00040F0D
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00040FA8
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 0004000A
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00040F61
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00040FB9
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00040FD4
.text C:\WINDOWS\system32\services.exe[760] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 000400B0
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00070025
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 0007004A
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00070FD4
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 0007000A
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00070F8D
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00070FEF
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00070F9E
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 27, 88 ]
.text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00070FB9
.text C:\WINDOWS\system32\services.exe[760] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00050000
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00700000
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00700F88
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00700F99
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00700FB4
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0070007D
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00700058
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 007000C6
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 007000B5
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00700103
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 007000F2
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00700114
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00700FDB
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 0070001B
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00700098
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00700047
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 0070002C
.text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 007000E1
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 0073001B
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00730F83
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00730FCA
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00730FE5
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00730F94
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00730000
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 00730036
.text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00730FAF
.text C:\WINDOWS\system32\lsass.exe[772] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00710FEF
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E20FEF
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E20067
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E20056
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E20045
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E2001E
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E20F8D
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E20093
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E20082
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E200AE
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E20F0B
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00E20EFA
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00E20F7C
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00E20FD4
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00E20F57
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00E20F9E
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00E20FB9
.text C:\WINDOWS\system32\svchost.exe[916] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00E20F26
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00E10FB9
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00E1002F
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00E1000A
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00E10FDE
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00E10F72
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00E10FEF
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00E10F8D
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 01, 89 ]
.text C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00E10F9E
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BF0000
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BF0F86
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BF007B
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BF006A
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BF0FA1
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BF0FC3
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BF00BB
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BF00A0
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BF0F3D
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BF0F4E
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00BF00FB
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00BF0FB2
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00BF0FE5
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00BF0F75
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00BF0025
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00BF0FD4
.text C:\WINDOWS\system32\svchost.exe[936] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00BF00CC
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00C2001B
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00C20F79
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00C20FC0
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00C20FE5
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00C20F94
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00C20000
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 00C20036
.text C:\WINDOWS\system32\svchost.exe[936] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00C20FAF
.text C:\WINDOWS\system32\svchost.exe[936] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C00FEF
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C80000
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C80FB2
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C80FC3
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C80091
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C80FD4
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C8005B
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C80F81
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C800D3
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateProcessW 7C802336 1 Byte [ E9 ]
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateProcessW + 2 7C802338 3 Bytes [ EB, 47, 84 ]
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C80F55
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00C800EE
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00C8006C
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00C80025
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00C800C2
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00C8004A
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00C80FEF
.text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00C80F66
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00CB0FB9
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00CB004A
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00CB000A
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00CB0FD4
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00CB0039
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00CB0FE5
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00CB0F97
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ EB, 88 ]
.text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00CB0FA8
.text C:\WINDOWS\system32\svchost.exe[1024] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C90FEF
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02A40000
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02A40F4E
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02A40039
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02A40F6B
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02A40F7C
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02A40FB2
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 02A40082
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02A40071
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02A40F0B
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02A400AE
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 02A40EFA
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 02A40FA1
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 02A40FEF
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 02A40054
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 02A40FCD
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 02A40FDE
.text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 02A40093
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 02A20036
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 02A20F94
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 02A2001B
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 02A20000
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 02A20FAF
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 02A20FE5
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 02A20047
.text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 02A20FCA
.text C:\WINDOWS\System32\svchost.exe[1140] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02960FE5
.text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 02A30000
.text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 02A30025
.text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 02A30FEF
.text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 02A30FDE
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00660FEF
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00660F81
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00660080
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00660065
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00660054
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00660FCD
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006600B8
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0066009B
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00660F30
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00660F4B
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 006600DA
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00660FB2
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00660014
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00660F70
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00660FDE
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00660025
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 006600C9
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00650025
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00650F8D
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00650FD4
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00650FE5
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00650FA8
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00650FB9
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 85, 88 ]
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00650036
.text C:\WINDOWS\system32\svchost.exe[1244] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00630FEF
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C80000
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C8009D
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C80F9E
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C8006C
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C8005B
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C80FB9
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C800CB
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C800BA
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C800F7
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C80F5E
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00C80F43
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00C80040
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00C8001B
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00C80F83
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00C80FCA
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00C80FE5
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00C800DC
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 009F0FD4
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 009F0F72
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 009F002F
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 009F0014
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 009F0F8D
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 009F0FEF
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 009F0F9E
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ BF, 88 ]
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 009F0FB9
.text C:\WINDOWS\system32\svchost.exe[1368] WS2_32.dll!socket 71AB4211 5 Bytes JMP 009D0000
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00A0000A
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00A0001B
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00A00FE5
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00A00036
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2032] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C340 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2032] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 0041C3C0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001B0000
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001B00B3
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001B0FB4
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001B008E
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001B007D
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001B0FE5
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001B00E1
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001B00C4
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001B0F4F
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001B0F74
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!GetProcAddress 7C80AE30 1 Byte [ E9 ]
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!GetProcAddress + 2 7C80AE32 3 Bytes [ 60, 9A, 83 ]
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 001B006C
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 001B001B
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 001B0F99
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 001B0047
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 001B002C
.text C:\Program Files\Messenger\msmsgs.exe[2116] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 001B00F2
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 002B0FC3
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 002B005B
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 002B0014
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 002B0FDE
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 002B004A
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 002B0FEF
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 002B0039
.text C:\Program Files\Messenger\msmsgs.exe[2116] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 002B0FA8
.text C:\Program Files\Messenger\msmsgs.exe[2116] WS2_32.dll!socket 71AB4211 5 Bytes JMP 002C0FE5
.text C:\Program Files\Messenger\msmsgs.exe[2116] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 002D0FEF
.text C:\Program Files\Messenger\msmsgs.exe[2116] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 002D000A
.text C:\Program Files\Messenger\msmsgs.exe[2116] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 002D0FDE
.text C:\Program Files\Messenger\msmsgs.exe[2116] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 002D002F
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E0000A
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E00FAF
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E000A4
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E00093
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E00076
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E00065
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E00F88
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E000D0
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E00F52
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E000EB
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00E000FC
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00E00FD4
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00E00025
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00E000BF
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00E00FEF
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00E00036
.text C:\WINDOWS\Explorer.EXE[2584] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00E00F6D
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00DD0047
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00DD0062
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00DD002C
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00DD0011
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00DD0FA5
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00DD0000
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00DD0FC0
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ FD, 88 ]
.text C:\WINDOWS\Explorer.EXE[2584] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00DD0FDB
.text C:\WINDOWS\Explorer.EXE[2584] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00DE0FE5
.text C:\WINDOWS\Explorer.EXE[2584] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00DE0000
.text C:\WINDOWS\Explorer.EXE[2584] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00DE001B
.text C:\WINDOWS\Explorer.EXE[2584] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00DE0040
.text C:\WINDOWS\Explorer.EXE[2584] WS2_32.dll!socket 71AB4211 5 Bytes JMP 014C0FEF
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B8000A
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B80F54
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B80F6F
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B80047
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B80F8A
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B80FAF
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B80070
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B80F28
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B80EF2
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B80F03
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00B800A6
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00B80036
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00B80FE5
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00B80F39
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00B80FCA
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00B8001B
.text C:\WINDOWS\system32\dllhost.exe[2636] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00B80081
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00B7002F
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00B70FA1
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00B70014
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00B70FDE
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00B7005E
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00B70FEF
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00B70FB2
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ D7, 88 ]
.text C:\WINDOWS\system32\dllhost.exe[2636] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00B70FC3
.text C:\WINDOWS\system32\dllhost.exe[2636] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00B5000A

—- Kernel IAT/EAT - GMER 1.0.14 —-

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 87153FA8
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] 87153FA8
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] 87153FA8
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] 87153FA8
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 87153FA8
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol] 87153FA8
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] 871818F0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] 87153FA8

—- Devices - GMER 1.0.14 —-

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\Ip 86D6A9C8

AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\Tcp 86D6A9C8

AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\Udp 86D6A9C8

AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\RawIp 86D6A9C8

AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\IPMULTICAST 86D6A9C8

AttachedDevice \FileSystem\Fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- Registry - GMER 1.0.14 —-

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs

—- Disk sectors - GMER 1.0.14 —-

Disk \Device\Harddisk0\DR0 sector 60: copy of MBR

—- EOF - GMER 1.0.14 —-

I haven't seen any of the vituemonde but the other stuff actually seems worse now?

jmw3

Post #22February 4, 2009, 1:38 AM UTC

Hi

Fix HiJackThis Entries

Open HiJackThis
Click on Do a system scan only
Place a checkmark next to these lines(if still present):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://security.microsoft.com/status/?advid=67456 <<<—- Fix if you did not set yourself
O1 - Hosts: 207.182.144.198 security.yahoo.com
O1 - Hosts: 207.182.144.198 security.google.com
O1 - Hosts: 207.182.144.198 advisor.microsoft.com
O1 - Hosts: 207.182.144.198 upgrade.microsoft.com
O1 - Hosts: 207.182.144.198 security.microsoft.com
O1 - Hosts: 207.182.144.198 store.microsoft.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: BinView - {54FBB5AD-5F1A-41BC-B884-7A198AAE6956} - C:\WINDOWS\system32\jumast.dll
O4 - HKLM\..\Run: [Qhoney] rundll32.exe "C:\WINDOWS\Sfuno.dll",e
O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe
O4 - HKLM\..\Run: [Wbumuyuq] rundll32.exe "C:\WINDOWS\oridanaw.dll",e
O4 - HKCU\..\Run: [Installer] "C:\WINDOWS\system32\wpv331232936156.cpx"
O4 - HKUS\S-1-5-18\..\Run: [userinit] C:\WINDOWS\system32\twext.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [userinit] C:\WINDOWS\system32\twext.exe (User 'Default user')

Close all windows except Hijackthis and click Fix Checked
Click Yes when prompted
Close HijackThis.

Combofix
Delete the copy of Combofix you have & download it again from one of these locations:
Link 1
Link 2
Link 3

**IMPORTANT !!! Save ComboFix.exe to your Desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply along with a new HijackThis log.

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
Combofix log
New HijackThis log

jhutch34

Post #23February 4, 2009, 4:49 AM UTC

Combofix -

ComboFix 09-02-02.04 - Owner 2009-02-03 20:08:29.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1012.472 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
c:\documents and settings\Owner\Favorites\Cheap Pharmacy Online.url
c:\documents and settings\Owner\Favorites\Search Online.url
c:\documents and settings\Owner\Favorites\SMS TRAP.url
c:\documents and settings\Owner\Favorites\VIP Casino.url
c:\windows\system32\~.exe
c:\windows\system32\c.ico
c:\windows\system32\m.ico
c:\windows\system32\p.ico
c:\windows\system32\s.ico
c:\windows\system32\TDSSbenk.log
c:\windows\system32\TDSSduhl.dat
c:\windows\system32\TDSSwokt.dll
c:\windows\system32\wpv041232715736.cpx
c:\windows\system32\wpv331232936156.cpx
c:\windows\system32\wpv461233630810.cpx
c:\windows\system32\wpv681232591385.cpx
c:\windows\system32\wpv741232935682.cpx
c:\windows\system32\wpv841233285804.cpx
c:\windows\wiaserviv.log

.
((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-02-03 09:01 . 2009-02-03 09:01 250 –a—— c:\windows\gmer.ini
2009-02-03 08:46 . 2009-02-03 08:47 d——– C:\rsit
2009-02-02 17:43 . 2009-02-02 17:43 134,656 –a—— c:\windows\oridanaw.dll
2009-02-02 12:34 . 2009-02-02 12:34 15,000 –a—— c:\windows\system32\msfokm33fdnd.dll
2009-02-02 12:33 . 2009-02-02 12:32 363,016 –a—— c:\windows\sysguard.exe
2009-02-02 12:32 . 2009-02-02 12:32 d——– c:\documents and settings\Owner\Application Data\wpv841233285804
2009-02-02 12:30 . 2009-02-02 12:30 21,446 –a—— c:\windows\system32\sf.ico
2009-02-02 12:30 . 2009-02-02 12:30 13,942 –a—— c:\windows\system32\m3.ico
2009-02-02 12:30 . 2009-02-02 12:30 3,122 –a—— c:\windows\ios.dat
2009-02-02 12:29 . 2009-02-02 12:29 42,496 –a—— c:\windows\Sfuno.dll
2009-01-22 17:01 . 2009-01-22 17:01 d——– c:\documents and settings\Owner\Application Data\McAfee
2009-01-21 22:16 . 2008-12-14 10:21 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-01-19 20:38 . 2009-01-19 20:38 d——– c:\program files\Trend Micro
2009-01-18 12:32 . 2009-01-18 12:32 d——– c:\documents and settings\Owner\Application Data\Snapfish
2009-01-13 18:34 . 2009-01-13 18:34 d——– c:\documents and settings\Owner\Application Data\Move Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-04 03:38 ——— d—–w c:\program files\CyberPower PowerPanel Personal Edition
2009-02-03 02:05 ——— d—–w c:\program files\Yahoo!
2009-02-03 02:04 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-03 02:04 ——— d—–w c:\program files\Web Publish
2009-02-03 02:04 ——— d—–w c:\program files\Sony
2009-02-03 02:03 ——— d—–w c:\program files\Microsoft Works
2009-01-23 00:01 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-01-22 05:16 ——— d—–w c:\program files\Java
2009-01-01 21:50 ——— d—–w c:\program files\iTunes
2009-01-01 21:50 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-01 21:49 ——— d—–w c:\program files\iPod
2009-01-01 21:49 ——— d—–w c:\program files\Common Files\Apple
2009-01-01 21:45 ——— d—–w c:\documents and settings\Owner\Application Data\Yahoo!
2009-01-01 21:44 ——— d—–w c:\documents and settings\LocalService\Application Data\Yahoo!
2009-01-01 21:38 ——— d—–w c:\program files\McAfee
2009-01-01 21:24 ——— d—–w c:\program files\QuickTime
2009-01-01 18:21 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2009-01-01 10:32 ——— d—–w c:\program files\Roguescanfix
2008-12-31 18:19 ——— d—–w c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-12-31 18:15 ——— d—–w c:\program files\McAfee.com
2008-12-31 18:15 ——— d—–w c:\program files\Common Files\McAfee
2008-12-31 17:40 ——— d—–w c:\program files\Hewlett-Packard
2008-12-31 17:35 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-31 17:25 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-31 03:38 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-14 17:21 410,984 —-a-w c:\windows\system32\deploytk.dll
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2005-08-29 01:53 0 -csha-w c:\windows\SMINST\HPCD.sys
2008-08-09 05:19 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080820080809\index.dat
.

((((((((((((((((((((((((((((( snapshot_2009-01-28_22.02.29.85 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-03 16:01:38 884,736 —-a-w c:\windows\gmer.dll
+ 2008-04-18 04:13:02 811,008 —-a-r c:\windows\gmer.exe
- 2009-01-29 02:17:08 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-04 02:42:47 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-29 02:17:08 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-04 02:42:47 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-03 16:01:38 85,969 —-a-w c:\windows\system32\drivers\gmer.sys
- 2009-01-28 10:10:34 16,384 –sha-w c:\windows\temp\Cookies\index.dat
+ 2009-02-04 03:38:02 16,384 –sha-w c:\windows\temp\Cookies\index.dat
- 2009-01-28 10:10:34 16,384 –sha-w c:\windows\temp\History\History.IE5\index.dat
+ 2009-02-04 03:38:02 16,384 –sha-w c:\windows\temp\History\History.IE5\index.dat
+ 2009-02-04 03:38:04 16,384 —-atw c:\windows\temp\Perflib_Perfdata_6a0.dat
- 2009-01-28 10:10:34 32,768 –sha-w c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-04 03:38:02 32,768 –sha-w c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-02 401491]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2005-05-10 7086080]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]
"Wbumuyuq"="c:\windows\oridanaw.dll" [2009-02-02 134656]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-08-09 5418864]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-05-22 155648]
MEMonitor.lnk - c:\program files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe [2007-08-24 947544]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm
"VIDC.LAGS"= lagarith.dll
"VIDC.HFYU"= huffyuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
Trusted 0dab

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
–a—— 2004-08-10 11:04 59392 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio]
–a—— 2005-05-10 16:02 7086080 c:\program files\Intel Audio Studio\IntelAudioStudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2008-04-13 17:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2004-11-02 20:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
–a—— 2004-11-15 15:04 135168 c:\program files\Digital Media Reader\shwiconEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
–a—— 2004-05-17 18:30 543232 c:\windows\zHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowWnd]
–a—— 2003-09-19 09:09 36864 c:\windows\ShowWnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare Software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcods.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcvsmap.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-08-09 29808]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-12-31 206096]
R3 VAD_DEV;Virtual Audio Service;c:\windows\system32\drivers\vad.sys [2008-10-16 16384]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [2008-11-29 110592]
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2009-02-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2009-02-03 c:\windows\Tasks\wrSpySweeperFullSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-08-09 16:04]

2009-02-03 c:\windows\Tasks\wrSpySweeperFullSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-08-09 16:04]

2009-02-03 c:\windows\Tasks\wrSpySweeperFullSweep.job
- C:\ [2009-02-03 20:35]
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.gatewaybiz.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5zps3cec.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-03 21:20:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3264)
c:\program files\McAfee\SiteAdvisor\saHook.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\system32\HPZipm12.exe
c:\program files\CyberPower PowerPanel Personal Edition\ppped.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\dllhost.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-02-03 21:34:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-04 04:33:44
ComboFix2.txt 2009-01-29 05:11:27
ComboFix3.txt 2009-01-28 05:45:31
ComboFix4.txt 2009-01-27 03:04:49

Pre-Run: 184,548,958,208 bytes free
Post-Run: 184,532,447,232 bytes free

251 — E O F — 2009-01-28 10:03:59

HiJackThis -

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:45 PM, on 2/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://security.microsoft.com/status/?advid=67456
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p;=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Recguard] "C:\WINDOWS\SMINST\RECGUARD.EXE"
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ezShieldProtector for Px] "C:\WINDOWS\system32\ezSP_Px.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Wbumuyuq] rundll32.exe "C:\WINDOWS\oridanaw.dll",e
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: MEMonitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo2.walgreens.com/WalgreensActivia.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136668105390
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PowerPanel Personal Edition Service (ppped) - Unknown owner - C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

–
End of file - 9011 bytes

jmw3

Post #24February 4, 2009, 1:27 PM UTC

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

File::
c:\windows\oridanaw.dll
c:\windows\system32\msfokm33fdnd.dll
c:\windows\sysguard.exe
c:\windows\system32\sf.ico
c:\windows\system32\m3.ico
c:\windows\ios.dat
c:\windows\Sfuno.dll

Folder::
c:\documents and settings\Owner\Application Data\wpv841233285804

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wbumuyuq"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
Combofix log
New HiajckThis log
Let me know how the computer is running / problems

jhutch34

Post #25February 5, 2009, 4:01 AM UTC

ComboFix -

ComboFix 09-02-04.01 - Owner 2009-02-04 20:07:17.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1012.426 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *disabled*
* Created a new restore point

FILE ::
c:\windows\ios.dat
c:\windows\oridanaw.dll
c:\windows\Sfuno.dll
c:\windows\sysguard.exe
c:\windows\system32\m3.ico
c:\windows\system32\msfokm33fdnd.dll
c:\windows\system32\sf.ico
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\wpv841233285804
c:\documents and settings\Owner\Application Data\wpv841233285804\spl.ini
c:\windows\ios.dat
c:\windows\oridanaw.dll
c:\windows\Sfuno.dll
c:\windows\sysguard.exe
c:\windows\system32\m3.ico
c:\windows\system32\msfokm33fdnd.dll
c:\windows\system32\sf.ico

.
((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-03 09:01 . 2009-02-03 09:01 250 –a—— c:\windows\gmer.ini
2009-02-03 08:46 . 2009-02-03 08:47 d——– C:\rsit
2009-01-22 17:01 . 2009-01-22 17:01 d——– c:\documents and settings\Owner\Application Data\McAfee
2009-01-21 22:16 . 2008-12-14 10:21 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-01-19 20:38 . 2009-01-19 20:38 d——– c:\program files\Trend Micro
2009-01-18 12:32 . 2009-01-18 12:32 d——– c:\documents and settings\Owner\Application Data\Snapfish
2009-01-13 18:34 . 2009-01-13 18:34 d——– c:\documents and settings\Owner\Application Data\Move Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-04 07:00 ——— d—–w c:\program files\CyberPower PowerPanel Personal Edition
2009-02-03 02:05 ——— d—–w c:\program files\Yahoo!
2009-02-03 02:04 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-03 02:04 ——— d—–w c:\program files\Web Publish
2009-02-03 02:04 ——— d—–w c:\program files\Sony
2009-02-03 02:03 ——— d—–w c:\program files\Microsoft Works
2009-01-23 00:01 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-01-22 05:16 ——— d—–w c:\program files\Java
2009-01-01 21:50 ——— d—–w c:\program files\iTunes
2009-01-01 21:50 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-01 21:49 ——— d—–w c:\program files\iPod
2009-01-01 21:49 ——— d—–w c:\program files\Common Files\Apple
2009-01-01 21:45 ——— d—–w c:\documents and settings\Owner\Application Data\Yahoo!
2009-01-01 21:44 ——— d—–w c:\documents and settings\LocalService\Application Data\Yahoo!
2009-01-01 21:38 ——— d—–w c:\program files\McAfee
2009-01-01 21:24 ——— d—–w c:\program files\QuickTime
2009-01-01 18:21 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2009-01-01 10:32 ——— d—–w c:\program files\Roguescanfix
2008-12-31 18:19 ——— d—–w c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-12-31 18:15 ——— d—–w c:\program files\McAfee.com
2008-12-31 18:15 ——— d—–w c:\program files\Common Files\McAfee
2008-12-31 17:40 ——— d—–w c:\program files\Hewlett-Packard
2008-12-31 17:35 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-31 17:25 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-31 03:38 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-14 17:21 410,984 —-a-w c:\windows\system32\deploytk.dll
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2005-08-29 01:53 0 -csha-w c:\windows\SMINST\HPCD.sys
2008-08-09 05:19 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080820080809\index.dat
.

((((((((((((((((((((((((((((( snapshot_2009-01-28_22.02.29.85 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-03 16:01:38 884,736 —-a-w c:\windows\gmer.dll
+ 2008-04-18 04:13:02 811,008 —-a-r c:\windows\gmer.exe
- 2009-01-29 02:17:08 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-05 02:37:42 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-29 02:17:08 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-05 02:37:42 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-03 16:01:38 85,969 —-a-w c:\windows\system32\drivers\gmer.sys
- 2009-01-28 10:10:34 16,384 –sha-w c:\windows\temp\Cookies\index.dat
+ 2009-02-04 03:38:02 16,384 –sha-w c:\windows\temp\Cookies\index.dat
- 2009-01-28 10:10:34 16,384 –sha-w c:\windows\temp\History\History.IE5\index.dat
+ 2009-02-04 03:38:02 16,384 –sha-w c:\windows\temp\History\History.IE5\index.dat
+ 2009-02-04 03:38:04 16,384 —-atw c:\windows\temp\Perflib_Perfdata_6a0.dat
- 2009-01-28 10:10:34 32,768 –sha-w c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-04 03:38:02 32,768 –sha-w c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-02 401491]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2005-05-10 7086080]
"ezShieldProtector for Px"="c:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-08-09 5418864]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-05-22 155648]
MEMonitor.lnk - c:\program files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe [2007-08-24 947544]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm
"VIDC.LAGS"= lagarith.dll
"VIDC.HFYU"= huffyuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
Trusted 0dab

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
–a—— 2004-08-10 11:04 59392 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio]
–a—— 2005-05-10 16:02 7086080 c:\program files\Intel Audio Studio\IntelAudioStudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2008-04-13 17:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2004-11-02 20:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
–a—— 2004-11-15 15:04 135168 c:\program files\Digital Media Reader\shwiconEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
–a—— 2004-05-17 18:30 543232 c:\windows\zHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowWnd]
–a—— 2003-09-19 09:09 36864 c:\windows\ShowWnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare Software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcods.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcvsmap.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-08-09 29808]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-12-31 206096]
R3 VAD_DEV;Virtual Audio Service;c:\windows\system32\drivers\vad.sys [2008-10-16 16384]
S3 mr97310c;CIF Dual-Mode Camera;c:\windows\system32\drivers\mr97310c.sys [2008-11-29 110592]
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2009-02-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2009-02-04 c:\windows\Tasks\wrSpySweeperFullSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-08-09 16:04]

2009-02-04 c:\windows\Tasks\wrSpySweeperFullSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-08-09 16:04]

2009-02-04 c:\windows\Tasks\wrSpySweeperFullSweep.job
- C:\ [2009-02-04 20:04]
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.gatewaybiz.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5zps3cec.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-04 20:32:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-04 20:45:42
ComboFix-quarantined-files.txt 2009-02-05 03:45:23
ComboFix2.txt 2009-02-04 04:34:30
ComboFix3.txt 2009-01-29 05:11:27
ComboFix4.txt 2009-01-28 05:45:31
ComboFix5.txt 2009-02-05 03:00:45

Pre-Run: 184,519,798,784 bytes free
Post-Run: 184,506,830,848 bytes free

206 — E O F — 2009-01-28 10:03:59

HiJackThis -

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:56:08 PM, on 2/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://security.microsoft.com/status/?advid=67456
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p;=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Recguard] "C:\WINDOWS\SMINST\RECGUARD.EXE"
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ezShieldProtector for Px] "C:\WINDOWS\system32\ezSP_Px.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: MEMonitor.lnk = C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo2.walgreens.com/WalgreensActivia.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136668105390
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PowerPanel Personal Edition Service (ppped) - Unknown owner - C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

–
End of file - 8901 bytes

I have not noticed any problems. It has been less than an hour since these scans but everything seems normal.
Thank you very much you are a life saver.

jmw3

Post #26February 6, 2009, 12:20 PM UTC

Apologies for not getting back to you sooner. Some personal issues I had to sort out.

Good to hear we're back on track. Logs are looking good. Just a couple of things to do. I would like to have a closer look at Registry Key so please do this:

Export A Registry Key
Open Notepad then copy & paste the contents of the Code Box below into it:

regedit.exe /e C:\reglook.txt "HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders"
notepad C:\reglook.txt

Click on File > Save As… & save to your desktop
In the File Name box, copy & paste in reglook.bat
In the Save As Type box, select All Files from the drop-down list
Click Save
Double click on reglook.bat to run it. A Command Prompt will open briefly, followed by Notepad shortly afterwards
Post the contents of this Notepad file in your next reply

Let's try again with the Kaspersky Scan. Follow the instructions previously posted to run the scan. Bare in mind it can take quite some time, so be patient with it. If however you run into problems with it try the Eset Scan, following the instructions previously posted.

To post in next reply:
Contents of the Registry Export
Kaspersky or Eset Scan log

jmw3

Post #27February 11, 2009, 11:07 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

[Closed] need help to remove virtumonde

✨ Ask AI

Ask AI