Deep rooted fake anti-virus software (I think)

[kelane317]

Several months ago I had trouble with one of the fake anti-virus softwares that are really a virus and I don't feel like I have ever gotten completely rid of it. I have downloaded and used a couple of different anti-virus softwares and it will for a time seem like it is working, but then I start having problems again. Including my computer freezing up, lots of crashing, etc. I tend to go back and forth between Internet Explorer and Mozilla becomes sometimes when one is freezing up the other works better.

Two days ago I purchased the Webroot Internet Security Complete package and i did a scan and clean up and it quarantined a bunch of stuff. But then I was having problems staying logged in on Webroot for the live protection. As soon as I sign in it disconnects me and says that it can't connect to the internet or my session has expired. One of the things that has come up in a couple of different places is something around the file names --
O4 - HKUS\S-1-5-18\..\Run: and O4 - HKUS\.DEFAULT -- I copy & pasted this out of my HJT log, but i have seen it on previous logs.

I also dowloaded and ran the SuperAntiSpyware you talk about in your instructions and I have used the MalwareBytes Anti-Malware in the past to clean things out, but it seems like there is still something in there. I followed all of your instructions so my recent MalwareBytes and SuperAntiSpyware logs both came up clean, I will still post those with my HJT log. (**I was playing spider solitaire in the backround when these were running, I think that is what the spider.exe file is... hopefully that doesn't cause a problem)

I appreciate any help or suggestions.

Super Antispyware Log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/18/2010 at 12:50 PM

Application Version : 4.47.1000

Core Rules Database Version : 6031
Trace Rules Database Version: 3843

Scan type       : Complete Scan
Total Scan Time : 01:04:38

Memory items scanned      : 479
Memory threats detected   : 0
Registry items scanned    : 5655
Registry threats detected : 0
File items scanned        : 41174
File threats detected     : 0

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5350

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/18/2010 1:08:10 PM
mbam-log-2010-12-18 (13-08-10).txt

Scan type: Quick scan
Objects scanned: 131960
Time elapsed: 7 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





Hijackthis Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:53:58 PM, on 12/18/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\PersistenceThread.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe
C:\Program Files\Webroot\Security\current\plugins\sync\WRSyncManager.exe
C:\WINDOWS\system32\spider.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\sniper.exe\sniper.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Webroot Browser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\Program Files\Webroot\Security\current\products\WISC\toolbar\LPBar.dll
O2 - BHO: WRCommonBHO - {D93EC24D-8741-4D41-B83D-A5793B998416} - C:\Program Files\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\Program Files\Webroot\Security\current\products\WISC\toolbar\LPBar.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\system32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\system32\hkcmd.exe"
O4 - HKLM\..\Run: [PersistenceThread] "C:\WINDOWS\system32\PersistenceThread.exe"
O4 - HKLM\..\Run: [RTHDCPL] "RTHDCPL.EXE"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [SynAsusAcpi] "C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe"
O4 - HKLM\..\Run: [LiveUpdate] "C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe" auto
O4 - HKLM\..\Run: [EasyMode] "%ProgramFiles%\\ASUS\\Easy Mode\\Easy Mode.exe" --limitedUserImportRegister
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [AsusACPIServer] "C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe"
O4 - HKLM\..\Run: [AsusEPCMonitor] "C:\Program Files\EeePC\ACPI\AsEPCMon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WebrootTrayApp] "C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup:  SuperHybridEngine.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: taskqueue.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc.  - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe

--
End of file - 8253 bytes

[kelane317]

I thought I was really careful reading all of the instructions and I am sorry if i was supposed to post my logs as separate reply posts... if you would like me to separate them out I can do that. Thanks!

[harry 48]

not to worry , what you have done is as it should be

[Dr Jay]

Hello kelane317.

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3[/list]

• Double-click on MBRCheck.exe to run it.
  
• It will open a black window...please do not fix anything (if it gives you an option).
  
• When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
  
• A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
• Please copy and paste the contents of that log in your next reply.

~DMJ

[kelane317]

Here you go... Thanks! - Kelly

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:         
Windows Version:      Windows XP Home Edition
Windows Information:      Service Pack 3 (build 2600)
Logical Drives Mask:      0x00000004

Kernel Drivers (total 117):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806E4000 \WINDOWS\system32\hal.dll
  0xF7AF0000 \WINDOWS\system32\KDCOM.DLL
  0xF7A00000 \WINDOWS\system32\BOOTVID.dll
  0xF74C1000 ACPI.sys
  0xF7AF2000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xF74B0000 pci.sys
  0xF75F0000 isapnp.sys
  0xF7600000 sshrmd.sys
  0xF747F000 ssidrv.sys
  0xF7452000 \WINDOWS\system32\DRIVERS\NDIS.SYS
  0xF7870000 \WINDOWS\system32\DRIVERS\TDI.SYS
  0xF7A04000 compbatt.sys
  0xF7A08000 \WINDOWS\system32\DRIVERS\BATTC.SYS
  0xF7BB8000 pciide.sys
  0xF7878000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF7610000 MountMgr.sys
  0xF7433000 ftdisk.sys
  0xF7A0C000 ACPIEC.sys
  0xF7BB9000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
  0xF7880000 PartMgr.sys
  0xF7620000 VolSnap.sys
  0xF741B000 ATAPI.SYS
  0xF7630000 disk.sys
  0xF7640000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF73FB000 fltMgr.sys
  0xF73E9000 sr.sys
  0xF73D2000 KSecDD.sys
  0xF7345000 Ntfs.sys
  0xF732B000 Mup.sys
  0xF7770000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xF6670000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
  0xF665C000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF6634000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xF7780000 \SystemRoot\system32\DRIVERS\l1c51x86.sys
  0xF64BE000 \SystemRoot\system32\DRIVERS\athw.sys
  0xF7940000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0xF649A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF7948000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF7790000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF7958000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF6468000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0xF7B1A000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF77A0000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
  0xF63EC000 \SystemRoot\System32\Drivers\wdf01000.sys
  0xF7960000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF7AD8000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0xF7ADC000 \SystemRoot\system32\DRIVERS\ASUSACPI.sys
  0xF7AE4000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0xF7C95000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xF77B0000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xF7AEC000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xF63D5000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xF77C0000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xF77D0000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xF63C4000 \SystemRoot\system32\DRIVERS\psched.sys
  0xF7800000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF7980000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF7990000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xF7810000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xF7B2C000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xF63A1000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF6343000 \SystemRoot\system32\DRIVERS\update.sys
  0xF72F7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xF7820000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF5D57000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xF5D33000 \SystemRoot\system32\drivers\portcls.sys
  0xF7830000 \SystemRoot\system32\drivers\drmk.sys
  0xF7850000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF7B46000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xF7D00000 \SystemRoot\System32\Drivers\Null.SYS
  0xF7B4A000 \SystemRoot\System32\Drivers\Beep.SYS
  0xF79E0000 \SystemRoot\System32\drivers\vga.sys
  0xF7B4E000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF7B52000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xF79F0000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xF7890000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF7303000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xF5BF8000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xF5B9F000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xF5B4B000 \SystemRoot\system32\drivers\pwipf6.sys
  0xF5B25000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xF5AFD000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xF5ADB000 \SystemRoot\System32\drivers\afd.sys
  0xF7680000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xF5AB9000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
  0xF78B8000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
  0xF5A8E000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xF59F6000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xF76B0000 \SystemRoot\System32\Drivers\Fips.SYS
  0xF7B58000 \SystemRoot\system32\drivers\AsUpIO.sys
  0xF76D0000 \SystemRoot\system32\DRIVERS\uvclf.sys
  0xF59D8000 \SystemRoot\System32\Drivers\usbvideo.sys
  0xF5D17000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xF76E0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xF78D8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xF5D0F000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xF59C0000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xF7B6A000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xF7AC8000 \SystemRoot\System32\drivers\Dxapi.sys
  0xF78F0000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xF7C2F000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF01E000 \SystemRoot\System32\igxpdd32.dll
  0xBF012000 \SystemRoot\System32\igxprd32.dll
  0xF7740000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xF76A0000 \SystemRoot\system32\DRIVERS\ssfmonm.sys
  0xEC393000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xEC032000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xEBF2D000 \SystemRoot\system32\drivers\wdmaud.sys
  0xEC177000 \SystemRoot\system32\drivers\sysaudio.sys
  0xEBD97000 \SystemRoot\system32\DRIVERS\srv.sys
  0xEB494000 \SystemRoot\System32\Drivers\HTTP.sys
  0xBA207000 \SystemRoot\system32\drivers\kmixer.sys
  0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 43):
       0 System Idle Process
       4 System
     416 C:\WINDOWS\system32\smss.exe
     476 csrss.exe
     712 C:\WINDOWS\system32\winlogon.exe
     756 C:\WINDOWS\system32\services.exe
     768 C:\WINDOWS\system32\lsass.exe
     932 C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
     952 C:\WINDOWS\system32\svchost.exe
    1040 svchost.exe
    1096 C:\WINDOWS\system32\svchost.exe
    1160 svchost.exe
    1252 svchost.exe
    1572 C:\WINDOWS\explorer.exe
    1632 C:\WINDOWS\system32\spoolsv.exe
    1856 svchost.exe
    1972 C:\Program Files\Java\jre6\bin\jqs.exe
     152 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
     364 C:\WINDOWS\system32\svchost.exe
    1156 C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe
    1456 C:\WINDOWS\system32\igfxtray.exe
    1468 C:\WINDOWS\system32\hkcmd.exe
    1756 C:\WINDOWS\system32\PersistenceThread.exe
     180 C:\WINDOWS\RTHDCPL.EXE
     232 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
     228 C:\WINDOWS\system32\igfxsrvc.exe
     320 C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
     660 C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
     816 C:\Program Files\EeePC\ACPI\AsEPCMon.exe
    1264 C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe
    1292 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1344 C:\WINDOWS\system32\ctfmon.exe
    1372 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    1308 C:\WINDOWS\system32\igfxext.exe
    1280 C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
    1716 C:\Program Files\OpenOffice.org 3\program\soffice.exe
    2052 C:\Program Files\OpenOffice.org 3\program\soffice.bin
    2856 C:\Program Files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe
    2888 alg.exe
    3188 WRCleanupEngine.exe
    3360 SSU.exe
    2084 C:\Program Files\Webroot\Security\Current\plugins\sync\WRSyncManager.exe
    3660 C:\Documents and Settings\Kelly\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

PhysicalDrive0 Model Number: ST9160301AS, Rev: 0001SDM2

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0   Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644 A


Done!

[Dr Jay]

None of your logs reveal infection. The next step is a bit complicated, unfortunately...

Please download 7-Zip and install it. If you already have it, no need to reinstall.

Then, download RootkitUnhooker and save the setup to your Desktop.

• Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
  
• Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
• Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
• It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
• Once inside the interface, do not fix anything. Click on the Report tab.
  
• Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
  
• It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
• When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.

[kelane317]

Okay here you go:

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>SSDT State
==============================================
ntkrnlpa.exe-->NtAdjustPrivilegesToken, Type: Address change 0x805EBB16-->F5B5A0C0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtAllocateVirtualMemory, Type: Address change 0x805A8A80-->865C6BC0 [Unknown module filename]
ntkrnlpa.exe-->NtConnectPort, Type: Address change 0x805A4596-->F5B5B970 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtCreateFile, Type: Address change 0x80579084-->F5B5AF40 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtCreateKey, Type: Address change 0x806237C8-->F5B59D60 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtCreatePort, Type: Address change 0x805A50B2-->F5B5BC90 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtCreateProcess, Type: Address change 0x805D11EA-->865DD248 [Unknown module filename]
ntkrnlpa.exe-->NtCreateProcessEx, Type: Address change 0x805D1134-->F5B5C780 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtCreateSection, Type: Address change 0x805AB38E-->F5B5BEF0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtCreateThread, Type: Address change 0x805D0FD2-->F5B5C370 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtDebugActiveProcess, Type: Address change 0x8064320E-->F5B59820 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtDeleteKey, Type: Address change 0x80623C64-->F5B5A980 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtDeleteValueKey, Type: Address change 0x80623E34-->F5B5AAF0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtDuplicateObject, Type: Address change 0x805BDFB4-->F5B59930 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtOpenFile, Type: Address change 0x8057A182-->F5B5B1B0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtOpenKey, Type: Address change 0x80624BA6-->865E22D8 [Unknown module filename]
ntkrnlpa.exe-->NtOpenProcess, Type: Address change 0x805CB3FA-->F5B5ACC0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtOpenSection, Type: Address change 0x805AA3B2-->F5B593A0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtOpenThread, Type: Address change 0x805CB686-->F5B59F70 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtQueueApcThread, Type: Address change 0x805D1230-->865C6C38 [Unknown module filename]
ntkrnlpa.exe-->NtReadVirtualMemory, Type: Address change 0x805B426E-->865C6AD0 [Unknown module filename]
ntkrnlpa.exe-->NtRenameKey, Type: Address change 0x806231EA-->865A64D8 [Unknown module filename]
ntkrnlpa.exe-->NtResumeThread, Type: Address change 0x805D495A-->F5B5B3F0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtSecureConnectPort, Type: Address change 0x805A3D2A-->F5B5BB00 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtSetContextThread, Type: Address change 0x805D16F4-->865C6D28 [Unknown module filename]
ntkrnlpa.exe-->NtSetInformationKey, Type: Address change 0x806224E2-->865C5760 [Unknown module filename]
ntkrnlpa.exe-->NtSetInformationProcess, Type: Address change 0x805CDE44-->865C5A38 [Unknown module filename]
ntkrnlpa.exe-->NtSetInformationThread, Type: Address change 0x805CC0C8-->865C6DA0 [Unknown module filename]
ntkrnlpa.exe-->NtSetValueKey, Type: Address change 0x80621D3A-->F5B5A7C0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtSuspendProcess, Type: Address change 0x805D4A22-->865C71C0 [Unknown module filename]
ntkrnlpa.exe-->NtSuspendThread, Type: Address change 0x805D4894-->865C6CB0 [Unknown module filename]
ntkrnlpa.exe-->NtTerminateProcess, Type: Address change 0x805D2982-->F5AC3620 [C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS]
ntkrnlpa.exe-->NtTerminateThread, Type: Address change 0x805D2B7C-->F5B5AE10 [C:\WINDOWS\system32\drivers\pwipf6.sys]
ntkrnlpa.exe-->NtWriteVirtualMemory, Type: Address change 0x805B4378-->865C6B48 [Unknown module filename]
==============================================
>Shadow
==============================================
win32k.sys-->NtUserAttachThreadInput, Type: Address change 0xBF8F555F-->F5B58EE0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserGetAsyncKeyState, Type: Address change 0xBF8B6B04-->F5B59220 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserGetKeyboardState, Type: Address change 0xBF86FE9B-->85474AB8 [Unknown module filename]
win32k.sys-->NtUserGetKeyState, Type: Address change 0xBF876E59-->F5B59150 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserMessageCall, Type: Address change 0xBF80EE79-->F5B58A60 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserPostMessage, Type: Address change 0xBF8082F2-->F5B58BF0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserPostThreadMessage, Type: Address change 0xBF89ED29-->F5B58D70 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserRegisterRawInputDevices, Type: Address change 0xBF916D59-->F5B58FF0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserSendInput, Type: Address change 0xBF8C3223-->F5B592F0 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserSetWindowsHookEx, Type: Address change 0xBF86FF5B-->F5B58840 [C:\WINDOWS\system32\drivers\pwipf6.sys]
win32k.sys-->NtUserSetWinEventHook, Type: Address change 0xBF8F98EB-->F5B58920 [C:\WINDOWS\system32\drivers\pwipf6.sys]
==============================================
>Processes
==============================================
0x865C4830 [4] System
0x855DD778 [152] C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation, Microsoft SeaPort Search Enhancement Broker)
0x854669B0 [180] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp., Realtek HD Audio Control Panel)
0x85465BC0 [228] C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation, igfxsrvc Module)
0x8545C778 [232] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated, Synaptics TouchPad Enhancements)
0x8558D5F8 [320] C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
0x85480948 [364] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8531E810 [384] C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation, Internet Explorer)
0x8634BDA0 [416] C:\WINDOWS\system32\smss.exe (Microsoft Corporation, Windows NT Session Manager)
0x862E0658 [476] C:\WINDOWS\system32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x85451670 [660] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc., Asus Eee PC ACPI Service)
0x854DFBE0 [684] C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation, Internet Explorer)
0x8638DBE0 [712] C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation, Windows NT Logon Application)
0x86330320 [756] C:\WINDOWS\system32\services.exe (Microsoft Corporation, Services and Controller app)
0x863B7AE0 [768] C:\WINDOWS\system32\lsass.exe (Microsoft Corporation, LSA Shell (Export Version))
0x8550D5A8 [816] C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc., AsEPCMon)
0x856AE3F0 [932] C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe (Webroot Software, Inc. , WRConsumerService)
0x856A0DA0 [952] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8569F788 [1040] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8568DC88 [1096] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x8547FDA0 [1156] C:\Program Files\Webroot\Security\Current\plugins\antimalware\AEI.exe (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Engine)
0x85674BC0 [1160] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x856919E0 [1252] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x85444BC0 [1264] C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. , WRTray)
0x85570458 [1280] C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe (ASUSTeK Computer Inc., Eee Super Hybrid Engine)
0x85582888 [1292] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc., Java(TM) Update Scheduler)
0x85434DA0 [1308] C:\WINDOWS\system32\igfxext.exe (Intel Corporation, igfxext Module)
0x85501DA0 [1344] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation, CTF Loader)
0x8552DDA0 [1456] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation, igfxTray Module)
0x8546C020 [1468] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation, hkcmd Module)
0x85649828 [1572] C:\WINDOWS\explorer.exe (Microsoft Corporation, Windows Explorer)
0x85656A90 [1632] C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)
0x85411020 [1716] C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org, OpenOffice.org 3.2)
0x8546CBC0 [1756] C:\WINDOWS\system32\PersistenceThread.exe (Intel Corporation, PersistenceThread Background App for Intel(R) GMA 500)
0x85611BC0 [1856] C:\WINDOWS\system32\svchost.exe (Microsoft Corporation, Generic Host Process for Win32 Services)
0x855F6918 [1972] C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc., Java(TM) Quick Starter Service)
0x85410800 [2052] C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org, OpenOffice.org 3.2)
0x854C34F8 [2084] C:\Program Files\Webroot\Security\Current\plugins\sync\WRSyncManager.exe (Sharpcast, Inc., Webroot Sync & Sharing)
0x855B5248 [2856] C:\Program Files\Webroot\Security\Current\plugins\antispam\wrhkisvc.exe (-, Webroot Hook Service)
0x85455C18 [2888] C:\WINDOWS\system32\alg.exe (Microsoft Corporation, Application Layer Gateway Service)
0x855F2DA0 [3188] C:\Program Files\Webroot\Security\Current\plugins\cleanup\WRCleanupEngine.exe (Webroot Software, Inc., WRCleanup)
0x8549A3E0 [3360] C:\Program Files\Webroot\Security\current\plugins\antimalware\SSU.EXE (Webroot Software, Inc. (www.webroot.com), Spy Sweeper SSU)
0x854F5C70 [3724] C:\Documents and Settings\Kelly\Desktop\RkU3.8.388.590\MustBeRandomlyNamed\iodw4EkA.exe (UG North, RKULE, SR2 Normandy)
0x8564D958 [4040] C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation, Internet Explorer)
==============================================
>Drivers
==============================================
0xF5D57000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 5259264 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0xF6670000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5099520 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF01E000 C:\WINDOWS\System32\igxpdd32.dll 1781760 bytes (Intel Corporation, Intel Graphics DirectDraw Driver)
0xF64BE000 C:\WINDOWS\system32\DRIVERS\athw.sys 1531904 bytes (Atheros Communications, Inc., Driver for Atheros AR5008 Wireless Network Adapter)
0xF7345000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xF63EC000 C:\WINDOWS\System32\Drivers\wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)
0xF59F6000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF6343000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xF5B9F000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xEBD97000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xF5B4B000 C:\WINDOWS\system32\drivers\pwipf6.sys 344064 bytes (Privacyware/PWI, Inc., pwipf6)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xEB494000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF6468000 C:\WINDOWS\system32\DRIVERS\SynTP.sys 204800 bytes (Synaptics Incorporated, Synaptics Touchpad Driver)
0xF747F000 ssidrv.sys 200704 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Interdiction Driver)
0xF74C1000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xEC032000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF7452000 C:\WINDOWS\system32\DRIVERS\NDIS.SYS 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB9E27000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xF5A8E000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF6634000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xF5AFD000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF5B25000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xF5D33000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF649A000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF63A1000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF5ADB000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xF5AB9000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x806E4000 ACPI_HAL 134400 bytes
0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF73FB000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF7433000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF59D8000 C:\WINDOWS\System32\Drivers\usbvideo.sys 122880 bytes (Microsoft Corporation, USB Video Class Driver)
0xF732B000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF741B000 ATAPI.SYS 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xF59C0000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF73D2000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF63D5000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xEBF2D000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF665C000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xF5BF8000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF73E9000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF74B0000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF63C4000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF7830000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xEC177000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF7850000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF7780000 C:\WINDOWS\system32\DRIVERS\l1c51x86.sys 57344 bytes (Atheros Communications, Inc., Atheros AR8131/AR8132 PCI-E Ethernet Controller ndis miniport driver)
0xF76A0000 C:\WINDOWS\system32\DRIVERS\ssfmonm.sys 57344 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper FileSystem Filter Driver)
0xF7640000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF7790000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF77B0000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF7620000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF77A0000 C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xBF012000 C:\WINDOWS\System32\igxprd32.dll 49152 bytes (Intel Corporation, Intel Graphics Rotation Driver)
0xF77D0000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF76B0000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF7610000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF77C0000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF75F0000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF7820000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF7600000 sshrmd.sys 40960 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Mini Driver)
0xF7810000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF76D0000 C:\WINDOWS\system32\DRIVERS\uvclf.sys 40960 bytes (GenesysLogic Technologies, Inc., uvclf.sys)
0xF7630000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF76E0000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF7770000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF7800000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF7680000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xBA0E7000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF7740000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF7890000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7948000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF78D8000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF7878000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7958000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF7960000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF78B8000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xF7940000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF79E0000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF79F0000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7880000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF7980000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF7990000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF7870000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF78F0000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF7A08000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver)
0xF7AD8000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0xF72F7000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xEC393000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF7A0C000 ACPIEC.sys 12288 bytes (Microsoft Corporation, ACPI Embedded Controller Driver)
0xF7ADC000 C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys 12288 bytes (ASUSTeK Computer Inc., ASUS ACPI Device Driver)
0xF7A00000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF7A04000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0xF7AC8000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF5D17000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF5D0F000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF7AEC000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF7303000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7AE4000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0xF7B58000 C:\WINDOWS\system32\drivers\AsUpIO.sys 8192 bytes
0xF7B4A000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7B6A000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7B46000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7AF0000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7B4E000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7B52000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF7B2C000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7B1A000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7AF2000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7C95000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7C2F000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7D00000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7BB9000 C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 4096 bytes (Microsoft Corporation, ACPI Operation Registration Driver)
0xF7BB8000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x86368270 unknown_irp_handler 3472 bytes
0x86313280 unknown_irp_handler 3456 bytes
0x8635D280 unknown_irp_handler 3456 bytes
0x8635B310 unknown_irp_handler 3312 bytes
0x862F8440 unknown_irp_handler 3008 bytes
0x865194D0 unknown_irp_handler 2864 bytes
0x86519548 unknown_irp_handler 2744 bytes
0x862E5618 unknown_irp_handler 2536 bytes
0x862E5690 unknown_irp_handler 2416 bytes
0x862CD6B0 unknown_irp_handler 2384 bytes
0x862E5708 unknown_irp_handler 2296 bytes
0x862CD728 unknown_irp_handler 2264 bytes
0x862E5780 unknown_irp_handler 2176 bytes
0x862CD7A0 unknown_irp_handler 2144 bytes
0x862E57F8 unknown_irp_handler 2056 bytes
0x862E5870 unknown_irp_handler 1936 bytes
0x862E58E8 unknown_irp_handler 1816 bytes
0x862E5960 unknown_irp_handler 1696 bytes
0x862FADC8 unknown_irp_handler 568 bytes
0x8639EDE8 unknown_irp_handler 536 bytes
0x862FAE40 unknown_irp_handler 448 bytes
0x862FAEB8 unknown_irp_handler 328 bytes
0x862FAF30 unknown_irp_handler 208 bytes
0x862FAFA8 unknown_irp_handler 88 bytes
==============================================
>Stealth
==============================================
==============================================
>Files
==============================================
!-->[Hidden] C:\Documents and Settings\Kelly\Local Settings\Temporary Internet Files\Content.IE5\FKDTCVIF\received_notifications[3].txt
!-->[Hidden] C:\Documents and Settings\Kelly\Local Settings\Temporary Internet Files\Content.IE5\GV8X3QIE\index[2].gif
!-->[Hidden] C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x0002D4FC, Type: Inline - RelativeJump 0x805044FC-->805044BB [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002D554, Type: Inline - RelativeJump 0x80504554-->8050451D [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002D680, Type: Inline - RelativeJump 0x80504680-->80504625 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0006ECBE, Type: Inline - RelativeJump 0x80545CBE-->80545CC5 [ntkrnlpa.exe]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification 0xF5BDE460-->865C6A58 [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification 0xF7745B1C-->865C6960 [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification 0xF7745B28-->865C6A58 [unknown_code_page]
[1572]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[1572]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[1572]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]
[1572]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[1572]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[1572]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]
[1572]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[3360]SSU.exe-->kernel32.dll-->CreateFileA, Type: Inline - RelativeJump 0x7C801A28-->00000000 [SSU.exe]
[3360]SSU.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - PushRet 0x7C801AF5-->00000000 [kernel32.dll]
[3360]SSU.exe-->kernel32.dll-->VirtualAlloc, Type: Inline - RelativeJump 0x7C809AF1-->00000000 [SSU.exe]
[3360]SSU.exe-->kernel32.dll-->VirtualFree, Type: Inline - RelativeJump 0x7C809B84-->00000000 [SSU.exe]
[3360]SSU.exe-->kernel32.dll-->VirtualProtect, Type: Inline - RelativeJump 0x7C801AD4-->00000000 [SSU.exe]
[3360]SSU.exe-->ntdll.dll+0x00003428, Type: Inline - RelativeJump 0x7C903428-->00000000 [ntdll.dll]
[3360]SSU.exe-->ntdll.dll-->KiUserApcDispatcher, Type: Inline - RelativeJump 0x7C90E450-->00000000 [SSUDLL.dll]
[3360]SSU.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x7C90E485-->00000000 [SSU.exe]
[384]iexplore.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[384]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]
[384]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]
[384]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]
[384]iexplore.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[384]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]
[384]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]
[384]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]
[384]iexplore.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040106C-->00000000 [shimeng.dll]
[384]iexplore.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x00401098-->00000000 [aclayers.dll]
[384]iexplore.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x004010E8-->00000000 [aclayers.dll]
[384]iexplore.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x004010C0-->00000000 [aclayers.dll]
[384]iexplore.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]
[384]iexplore.exe-->mswsock.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71A51184-->00000000 [aclayers.dll]
[384]iexplore.exe-->mswsock.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x71A511A0-->00000000 [aclayers.dll]
[384]iexplore.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[384]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]
[384]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]
[384]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]
[384]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]
[384]iexplore.exe-->user32.dll-->CallNextHookEx, Type: Inline - RelativeJump 0x7E42B3C6-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[384]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]
[384]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]
[384]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]
[384]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump 0x7E450838-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00000000 [ieframe.dll]
[384]iexplore.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00000000 [ieframe.dll]
[384]iexplore.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]
[384]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x3D9314B4-->00000000 [aclayers.dll]
[384]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x3D931450-->00000000 [aclayers.dll]
[384]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x3D931350-->00000000 [aclayers.dll]
[384]iexplore.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[384]iexplore.exe-->ws2_32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71AB10A8-->00000000 [aclayers.dll]
[4040]iexplore.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[4040]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]
[4040]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]
[4040]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]
[4040]iexplore.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[4040]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]
[4040]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]
[4040]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]
[4040]iexplore.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040106C-->00000000 [shimeng.dll]
[4040]iexplore.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x00401098-->00000000 [aclayers.dll]
[4040]iexplore.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x004010E8-->00000000 [aclayers.dll]
[4040]iexplore.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x004010C0-->00000000 [aclayers.dll]
[4040]iexplore.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]
[4040]iexplore.exe-->mswsock.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71A51184-->00000000 [aclayers.dll]
[4040]iexplore.exe-->mswsock.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x71A511A0-->00000000 [aclayers.dll]
[4040]iexplore.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[4040]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]
[4040]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]
[4040]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]
[4040]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]
[4040]iexplore.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[4040]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]
[4040]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]
[4040]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]
[4040]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump 0x7E450838-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082-->00000000 [ieframe.dll]
[4040]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5-->00000000 [ieframe.dll]
[4040]iexplore.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]
[4040]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x3D9314B4-->00000000 [aclayers.dll]
[4040]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x3D931450-->00000000 [aclayers.dll]
[4040]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x3D931350-->00000000 [aclayers.dll]
[4040]iexplore.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[4040]iexplore.exe-->ws2_32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71AB10A8-->00000000 [aclayers.dll]
[684]iexplore.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[684]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]
[684]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]
[684]iexplore.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]
[684]iexplore.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[684]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]
[684]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]
[684]iexplore.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]
[684]iexplore.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0040106C-->00000000 [shimeng.dll]
[684]iexplore.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x00401098-->00000000 [aclayers.dll]
[684]iexplore.exe-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x004010E8-->00000000 [aclayers.dll]
[684]iexplore.exe-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x004010C0-->00000000 [aclayers.dll]
[684]iexplore.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]
[684]iexplore.exe-->mswsock.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71A51184-->00000000 [aclayers.dll]
[684]iexplore.exe-->mswsock.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x71A511A0-->00000000 [aclayers.dll]
[684]iexplore.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[684]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]
[684]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]
[684]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]
[684]iexplore.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]
[684]iexplore.exe-->user32.dll-->CallNextHookEx, Type: Inline - RelativeJump 0x7E42B3C6-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->CreateWindowExW, Type: Inline - RelativeJump 0x7E42D0A3-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x7E456D7D-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x7E432072-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump 0x7E43B144-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump 0x7E4247AB-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[684]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]
[684]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]
[684]iexplore.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]
[684]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump 0x7E45085C-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump 0x7E450838-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump 0x7E43A082-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump 0x7E4664D5-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00000000 [ieframe.dll]
[684]iexplore.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00000000 [ieframe.dll]
[684]iexplore.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]
[684]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x3D9314B4-->00000000 [aclayers.dll]
[684]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x3D931450-->00000000 [aclayers.dll]
[684]iexplore.exe-->wininet.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x3D931350-->00000000 [aclayers.dll]
[684]iexplore.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[684]iexplore.exe-->ws2_32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71AB10A8-->00000000 [aclayers.dll]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

[Dr Jay]

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

[kelane317]

Can I and/or should I have already closed the Rootkit Unhooker application thing? I haven't done anything since i copied and pasted the scan report. When I just clicked to close it it asks me "Hmm, are you sure? " or should i just leave it as is when i run this eset one?

[Dr Jay]

Yeah. It's fine. The author of the program throws some "sick humor" in there. No big deal.

Go ahead with ESET scan please.

~DMJ

[kelane317]

Okay well one software author's "sick humor" is a massive panic attack for others!! So here is my reset log. I guess i should be happy that it didn't find anything, but it just feels like it is running so slow. Do any of the logs show if i have programs that don't need to be running? or does anything else look suspicious? Thanks for all your help!

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=c8dc28ffdfb86d47ad9be696e590fba9
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-12-21 09:11:49
# local_time=2010-12-21 01:11:49 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 121240 121240 0 0
# compatibility_mode=1024 16777215 100 0 24823187 24823187 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=46849
# found=0
# cleaned=0
# scan_time=9692

[Dr Jay]

Let's take a look with this tool...

Please download the latest version of Kaspersky GetSystemInfo (GSI) from Kaspersky and save it to your Desktop.

Note: please close all other applications running on your system.

Double click GetSystemInfo.exe to open it. It will display an agreement. Click on I Agree to continue.

Click the Settings button.



Set the slider to Maximum.



IMPORTANT! Then, click Customize - choose Driver / Ports tab and uncheck Scan Ports.




On the General tab, make sure all of the boxes are checked.




On the Misc tab, make sure all the checkboxes are checked.

Then, click OK on the windows that you launched.



Click Create Report to run it.


It will begin scanning.

It will create a zip folder called GetSystemInfo_XXXXXXXXXXXXXX.zip on your Desktop.

It should automatically upload it to http://www.getsysteminfo.com. If it does not, then please submit it manually by going to the site and doing the upload process.

It will redirect to a page, where it will provide a sharing URL for specialists. Copy and paste the url of the GSI Parser report in your next reply.

~DMJ

[kelane317]

I am hoping this works and is what you are looking for

http://www.getsysteminfo.com/read.php?file=59e888c159995c82cc70cce1cd5f8c85&ms=0

[Dr Jay]

Everything checks out to be fine. Any more issues, or is it running better?

~DMJ

[kelane317]

it still feels kind of slow... but maybe its my imagination. thanks for all your help.