Computer Hope
Software => Computer viruses and spyware => Topic started by: padraig on August 18, 2012, 06:54:43 AM
-
About two weeks ago I received a notification of a "serious error" or something to that affect. It has disabled my Internet Explorer and Firefox from connecting to the internet. It has also hidden Control Panel, all programs and virtually everything from my desktop.
I have run Malwarebytes and Super AntiSpyware and it located a worm and trojan virus, removed them but upon reboot the problem comes back. I read through other solutions that have you find and delete "autorun.ini" and "scvhost.exe" files from windows/system32 but those files are not located in that directory.
I am a novice and would really appreciate any assistance from anyone with some patience that can walk me through removing this virus.
System is Windows XP and I have been successful in resetting Control Panel so it is visible and "unhiding" all files but IE8 and Firefox are blocked, my PC Tools Firewall Plus takes about 30 minutes to "initiialize" and locks up the PC, DDS only runs in Safe Mode.
Is it time to reformat? If so, how can I backup my documents, photos and music?
DDS (Ver_2011-08-26.01) - NTFSx86 MINIMAL
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_29
Run by Administrator at 16:58:16 on 2012-08-10
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.656 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: PC Tools Firewall Plus *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = www.msn.com
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061220
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
BHO: {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
BHO: Yontoo: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo\YontooIEClient.dll
TB: free-downloads.net Toolbar: {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
TB: {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No File
uRun: [OE_OEM] "c:\program files\trend micro\internet security 12\tmas_oe\TMAS_OEMon.exe"
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\Iaanotif.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [00PCTFW] "c:\program files\pc tools firewall plus\FirewallGUI.exe" -s
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRunOnce: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [Autodesk] rundll32.exe "c:\documents and settings\patrick\local settings\application data\collectorz.com\autodesk\kzaayba.dll",CreateInstance
mExplorerRun: [NoActiveDesktopChanges] 00000000
mExplorerRun: [NoActiveDesktop] 0 (0x0)
mExplorerRun: [NoSaveSettings] 0 (0x0)
mExplorerRun: [ClassicShell] 0 (0x0)
uPolicies-system: NoDispBackgroundPage = 1 (0x1)
mPolicies-explorer: NoSimpleStartMenu = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\npjpi160_29.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1341148687936
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{ADAF9F37-7BA6-4D33-8326-4BA6B12F9E72} : DhcpNameServer = 209.18.47.61 209.18.47.62
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\tfpwaynx.default\
.
============= SERVICES / DRIVERS ===============
.
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-7-11 116608]
R2 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2012-4-7 821592]
R3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys [2012-7-5 54144]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys --> c:\windows\system32\drivers\avgidshx.sys [?]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2010-3-27 233136]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-11-17 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-11-17 67664]
S2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [2006-7-14 13824]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2011-8-25 13672]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2010-3-27 88040]
S2 PCToolsFirewallPlus;PC Tools Firewall Plus;c:\program files\pc tools firewall plus\FWService.exe [2010-3-27 818432]
S2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [2006-7-14 13696]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys --> c:\windows\system32\drivers\avgidsshimx.sys [?]
S3 cpuz132;cpuz132;\??\c:\docume~1\patrick\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\patrick\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 dlci_device;dlci_device;c:\windows\system32\dlcicoms.exe -service --> c:\windows\system32\dlcicoms.exe -service [?]
S3 FileMonitor;FileMonitor;c:\program files\iobit\iobit malware fighter\drivers\wxp_x86\FileMonitor.sys [2012-4-7 246816]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-5-5 113120]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010-3-27 70664]
S3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2010-3-27 58816]
S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2010-3-27 115216]
S3 RegFilter;RegFilter;c:\program files\iobit\iobit malware fighter\drivers\wxp_x86\RegFilter.sys [2012-4-7 30368]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-11-17 12872]
S3 UrlFilter;UrlFilter;c:\program files\iobit\iobit malware fighter\drivers\wxp_x86\UrlFilter.sys [2012-4-7 16208]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-11 14336]
.
=============== File Associations ===============
.
JSEFile=NOTEPAD.EXE %1
.
=============== Created Last 30 ================
.
2012-08-10 17:49:43 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Mozilla
2012-08-10 17:30:21 -------- d-----w- c:\documents and settings\administrator\application data\Windows Search
2012-08-10 14:50:57 -------- d-sh--w- c:\documents and settings\administrator\PrivacIE
2012-08-10 14:50:36 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
2012-08-05 21:12:25 68992 ----a-w- c:\windows\system32\drivers\ff82985559e36c89.sys
2012-08-05 20:25:55 340992 ----a-w- c:\documents and settings\all users\application data\bCwRoBpGTIRFPgh.exe
2012-08-05 15:49:26 -------- d-----w- c:\program files\DVD Decrypter
2012-07-29 21:20:58 1347344 ---ha-w- c:\windows\system32\MSVBVM50.dll
2012-07-28 21:19:11 770384 ----a-w- c:\program files\mozilla firefox\msvcr100.dll
2012-07-28 21:19:11 421200 ----a-w- c:\program files\mozilla firefox\msvcp100.dll
2012-07-14 12:55:16 -------- d-----w- c:\documents and settings\all users\application data\PC Utility Kit
.
==================== Find3M ====================
.
2012-08-05 15:39:48 70344 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-05 15:39:48 426184 ---ha-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-13 13:19:59 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50:25 1372672 ---ha-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50:25 1172480 ---ha-w- c:\windows\system32\msxml3.dll
2012-06-04 21:35:26 222448 ---ha-w- c:\windows\system32\muweb.dll
2012-06-04 04:32:08 152576 ---ha-w- c:\windows\system32\schannel.dll
2012-06-02 19:19:44 22040 ---ha-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 19:19:38 219160 ---ha-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19:38 15384 ---ha-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19:34 15384 ---ha-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19:30 17944 ---ha-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 19:18:58 275696 ---ha-w- c:\windows\system32\mucltui.dll
2012-06-02 19:18:58 17136 ---ha-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22:09 599040 ---ha-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08:26 916992 ---ha-w- c:\windows\system32\wininet.dll
1997-06-23 1750 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.
============= FINISH: 17:04:48.89 ===============
-
Please follow the instructions in the following link and post your logs:
http://www.computerhope.com/forum/index.php/topic,46313.0.html
-
PC will not connect to internet and will not read USB flash drive to enable me to run any other scan from the sources listed in the instructions. Is there any other way to solve this without reformatting the hard drive? If not, how can I make sure that I do not lose all of my photos, documents and music?
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please physically disconnect your computer from the electrical plug for a few seconds and then reconnect it. Try your USB ports to see if they're working now. If they are still not working you could use a CD/DVD-RW to transfer the programs to the computer.
As soon as you are able to do so, please save all your important data to an external harddrive or DVD's. You can use RW's which are re-usable.
Also, as soon as you're able please run MBAM and SAS again and post the logs.
- Please download Unhide by Grinler from here (http://download.bleepingcomputer.com/grinler/unhide.exe) and save it to your desktop.
- Double click unhide.exe to run the tool.
- It will take some time to go through all your files, so please be patient.
- If this tool doesn´t fix the problem, please let me know.
********************************************************
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
Save Rkill to your desktop.
There are 7 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
* Rkill.exe (http://download.bleepingcomputer.com/grinler/rkill.exe)
* Rkill.com (http://download.bleepingcomputer.com/grinler/rkill.com)
* Rkill.scr (http://download.bleepingcomputer.com/grinler/rkill.scr)
* WiNlOgOn.exe (http://download.bleepingcomputer.com/grinler/WiNlOgOn.exe)
* uSeRiNiT.exe (http://download.bleepingcomputer.com/grinler/uSeRiNiT.exe)
* iExplore.exe (http://download.bleepingcomputer.com/grinler/iExplore.exe)
* eXplorer.exe (http://download.bleepingcomputer.com/grinler/eXplorer.exe)
Once you've gotten one of them to run then try to immediately run the following.
********************************************************
•Please download Dial-A-Fix from one of the following mirrors:
Primary mirror (http://djlizard.net.nyud.net:8080/software/Dial-a-fix-v0.60.0.24.zip)
Secondary mirror (http://djlizard.net/software/Dial-a-fix-v0.60.0.24.zip)
•Extract the zip file to your desktop.
•Double click Dial-a-Fix.exe to start the program. Dial-A-Fix might give you a lot errors, just ignore them and Click
(http://i424.photobucket.com/albums/pp322/digistar/OK.jpg) to continue.
•Press the green double checkmark box (Looks like this:
(http://i424.photobucket.com/albums/pp322/digistar/checkmark.png)
UNcheck Empty Temp Folders, as well as Adjust Time/Date in the prep section. The prep section should then look like this:
(http://i424.photobucket.com/albums/pp322/digistar/ncheck.png)
(http://i424.photobucket.com/albums/pp322/digistar/Window.png)
•Click on Go
•Wait for Dial-A-Fix to finish (All the checks marks will be all gone)
•Close Dial-A-Fix.
-
Thanks for taking the time to assist me.
Here is what I have completed so far:
After another BSOD >:(
I have saved photos and other documents to an external hard drive.
Ran Malwarebytes (log follows)
Ran SuperAntiSpyware (log follows)
Downloaded the Rkill and ran (log follows)
Downloaded Dial-a-Fix and ran (several error messages, especially dlls, as you warned)
FYI: my Startup has the programs listed but the shortcuts to the program executables are "empty"
Unhide by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
http://www.bleepingcomputer.com/forums/topic405109.html
Program started at: 08/19/2012 04:22:40 PM
Windows Version: Windows XP
Please be patient while your files are made visible again.
Processing the A:\ drive
Finished processing the A:\ drive. 0 files processed.
Processing the C:\ drive
Finished processing the C:\ drive. 168373 files processed.
Processing the D:\ drive
Finished processing the D:\ drive. 44292 files processed.
Processing the H:\ drive
Finished processing the H:\ drive. 3981 files processed.
Processing the I:\ drive
Finished processing the I:\ drive. 13593 files processed.
Processing the J:\ drive
Finished processing the J:\ drive. 126 files processed.
The C:\DOCUME~1\Patrick\LOCALS~1\Temp\smtmp\ folder does not exist!!
Unhide cannot restore your missing shortcuts!!
Please see this topic in order to learn how to restore default
Start Menu shortcuts: http://www.bleepingcomputer.com/forums/topic405109.html
Searching for Windows Registry changes made by FakeHDD rogues.
- Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
- Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop
- Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
No registry changes detected.
Restarting Explorer.exe in order to apply changes.
Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3
8/19/2012 5:59:07 PM
mbam-log-2012-08-19 (17-59-07).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 294779
Time elapsed: 1 hour(s), 29 minute(s), 48 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 08/19/2012 at 06:40 PM
Application Version : 5.5.1012
Core Rules Database Version : 8324
Trace Rules Database Version: 6136
Scan type : Complete Scan
Total Scan Time : 02:09:20
Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator
Memory items scanned : 484
Memory threats detected : 1
Registry items scanned : 38459
Registry threats detected : 8
File items scanned : 81293
File threats detected : 28
Adware.Tracking Cookie
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\Z5MHQWX0.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\GTRI8D6P.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\HTS8J24I.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\JBE9MDX2.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\T7O8V58S.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\YM140FQJ.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\DZSVHZ50.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\4XX04TPW.txt [ Cookie:[email protected]/cgi-bin ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\LNA4ALTW.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\HNOO22JJ.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\YBU3IZN2.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\0T0RVP6A.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\DI2BSNLJ.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\ENZ5SY9R.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\P6XO1EKW.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\2ZH8SOZ7.txt [ Cookie:[email protected]/ ]
C:\DOCUMENTS AND SETTINGS\ANNA\Cookies\JLSW5SIY.txt [ Cookie:[email protected]/ ]
.apmebf.com [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.mediaplex.com [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.mediaplex.com [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.tribalfusion.com [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\PATRICK\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\9X4XQV4C.DEFAULT-1344721266250\COOKIES.SQLITE ]
Trojan.Agent/Gen-6TO4EX
HKLM\System\ControlSet003\Services\6TO4
C:\WINDOWS\SYSTEM32\6TO4EX.DLL
HKLM\System\ControlSet003\Enum\Root\LEGACY_6TO4
HKLM\System\ControlSet004\Services\6TO4
HKLM\System\ControlSet004\Enum\Root\LEGACY_6TO4
HKLM\System\CurrentControlSet\Services\6TO4
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_6TO4
C:\WINDOWS\SYSTEM32\6TO4EX.DLL
Worm.SYSHost
HKLM\system\controlset003\services\syshost32
C:\WINDOWS\INSTALLER\{21AFBFB6-53EF-36C2-120C-7E9BF1C4C429}\SYSHOST.EXE
HKLM\system\controlset004\services\syshost32
C:\WINDOWS\Prefetch\SYSHOST.EXE-21ACC27B.pf
Rkill 2.2.1 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 08/19/2012 06:46:09 PM in x86 mode.
Windows Version: Windows XP
Checking for Windows services to stop.
* No malware services found to stop.
Checking for processes to terminate.
* C:\WINDOWS\wanmpsvc.exe (PID: 1780) [WD-HEUR]
* C:\WINDOWS\System32\DLA\DLACTRLW.EXE (PID: 3112) [WD-HEUR]
* C:\Documents and Settings\Patrick\govkhca.exe (PID: 3180) [UP-HEUR]
3 proccesses terminated!
Checking Registry for malware related settings.
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\.com "@" has been changed to ComFile!
* HKLM\Software\Classes\.com "@"was reset to comfile!
Performing miscellaneous checks.
* ALERT: ZEROACCESS rootkit symptoms found!
* HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 [ZA Reg Hijack]
* HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 [ZA Reg Hijack]
* C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\ [ZA Dir]
* C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@ [ZA File]
* C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L\ [ZA Dir]
* C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n [ZA File]
* C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\ [ZA Dir]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\ [ZA Dir]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@ [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L\ [ZA Dir]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L\00000004.@ [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\ [ZA Dir]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000004.@ [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000008.@ [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\000000cb.@ [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000000.@ [ZA File]
* C:\WINDOWS\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000032.@ [ZA File]
Checking Windows Service Integrity:
* BITS [Missing Service]
* wscsvc [Missing Service]
* wuauserv [Missing Service]
* SharedAccess [Missing ImagePath]
* COMSysApp => %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} [Incorrect ImagePath]
* ImapiService => %systemroot%\system32\imapi.exe [Incorrect ImagePath]
* MSIServer => %systemroot%\system32\msiexec.exe /V [Incorrect ImagePath]
* atapi => \SystemRoot\system32\DRIVERS\atapi.sys [Incorrect ImagePath]
* srservice => %SystemRoot%\system32\srsvc.dll [Incorrect ServiceDLL]
* W32Time => %systemroot%\system32\w32time.dll [Incorrect ServiceDLL]
Searching for Missing Digital Signatures:
* No issues found.
Program finished at: 08/19/2012 06:46:26 PM
Execution time: 0 hours(s), 0 minute(s), and 16 seconds(s)
-
- Download TDSSKiller (http://support.kaspersky.com/downloads/utils/tdsskiller.zip) and save it to your Desktop.
- Extract its contents to your desktop.
- Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
- If an infected file is detected, the default action will be Cure, click on Continue.
- If a suspicious file is detected, the default action will be Skip, click on Continue.
- It may ask you to reboot the computer to complete the process. Click on Reboot Now.
- Click the Report button and copy/paste the contents of it into your next reply
Note:It will also create a log in the C:\ directory..
****************************************************************
Please download aswMBR.exe (http://public.avast.com/%7Egmerek/aswMBR.exe) ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
(http://i424.photobucket.com/albums/pp322/digistar/aswMBR_Scan.jpg)
Click the "Scan" button to start scan
Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives
(http://i424.photobucket.com/albums/pp322/digistar/aswMBR_SaveLog.png)
On completion of the scan click save log, save it to your desktop and post in your next reply.
-
okay, I downloaded both files and ran the TDSSKiller (log pasted below); the aswMBR will not run on my desktop under my log in nor as an Administrator
12:11:44.0390 2676 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
12:11:44.0437 2676 ============================================================
12:11:44.0437 2676 Current date / time: 2012/08/24 12:11:44.0437
12:11:44.0437 2676 SystemInfo:
12:11:44.0437 2676
12:11:44.0437 2676 OS Version: 5.1.2600 ServicePack: 3.0
12:11:44.0437 2676 Product type: Workstation
12:11:44.0437 2676 ComputerName: FAMILYROOM
12:11:44.0437 2676 UserName: Patrick
12:11:44.0437 2676 Windows directory: C:\WINDOWS
12:11:44.0437 2676 System windows directory: C:\WINDOWS
12:11:44.0437 2676 Processor architecture: Intel x86
12:11:44.0437 2676 Number of processors: 2
12:11:44.0437 2676 Page size: 0x1000
12:11:44.0437 2676 Boot type: Normal boot
12:11:44.0437 2676 ============================================================
12:11:47.0968 2676 !crdlk
12:11:47.0968 2676 Drive \Device\Harddisk0\DR0 - Size: 0x3A35000000 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76B9, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:11:47.0984 2676 Drive \Device\Harddisk1\DR5 - Size: 0x7446E00000 (465.11 Gb), SectorSize: 0x200, Cylinders: 0xED2B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:11:48.0015 2676 Drive \Device\Harddisk2\DR7 - Size: 0xE8DED00000 (931.48 Gb), SectorSize: 0x200, Cylinders: 0x1DAFD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:11:48.0031 2676 Drive \Device\Harddisk3\DR9 - Size: 0x1E3000000 (7.55 Gb), SectorSize: 0x200, Cylinders: 0x3D9, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:11:48.0031 2676 ============================================================
12:11:48.0031 2676 \Device\Harddisk0\DR0:
12:11:48.0031 2676 MBR partitions:
12:11:48.0031 2676 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1B747, BlocksNum 0x156DD1AB
12:11:48.0062 2676 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x156F8931, BlocksNum 0x7342164
12:11:48.0062 2676 \Device\Harddisk1\DR5:
12:11:48.0062 2676 MBR partitions:
12:11:48.0062 2676 \Device\Harddisk1\DR5\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A236FC0
12:11:48.0062 2676 \Device\Harddisk2\DR7:
12:11:48.0062 2676 MBR partitions:
12:11:48.0062 2676 \Device\Harddisk2\DR7\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x746F6000
12:11:48.0062 2676 \Device\Harddisk3\DR9:
12:11:48.0062 2676 MBR partitions:
12:11:48.0062 2676 \Device\Harddisk3\DR9\Partition1: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0xF17FC1
12:11:48.0062 2676 ============================================================
12:11:48.0093 2676 C: <-> \Device\Harddisk0\DR0\Partition1
12:11:48.0140 2676 D: <-> \Device\Harddisk0\DR0\Partition2
12:11:48.0171 2676 H: <-> \Device\Harddisk1\DR5\Partition1
12:11:48.0234 2676 I: <-> \Device\Harddisk2\DR7\Partition1
12:11:48.0234 2676 ============================================================
12:11:48.0234 2676 Initialize success
12:11:48.0234 2676 ============================================================
12:11:50.0234 1120 ============================================================
12:11:50.0234 1120 Scan started
12:11:50.0234 1120 Mode: Manual;
12:11:50.0234 1120 ============================================================
12:11:50.0421 1120 ================ Scan system memory ========================
12:11:50.0421 1120 System memory - ok
12:11:50.0421 1120 ================ Scan services =============================
12:11:50.0546 1120 [ C0393EB99A6C72C6BEF9BFC4A72B33A6 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
12:11:50.0546 1120 !SASCORE - ok
12:11:50.0703 1120 [ 60335C9FC69E34A7CC68B496F402FB17 ] 6to4 C:\WINDOWS\system32\6to4ex.dll
12:11:50.0718 1120 6to4 - ok
12:11:50.0718 1120 Suspicious service (NoAccess): 9445fee0eea6d169
12:11:50.0765 1120 [ 7B35FA55C4E1D85B70BA0743D2DA9899 ] 9445fee0eea6d169 C:\WINDOWS\System32\Drivers\9445fee0eea6d169.sys
12:11:50.0765 1120 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\9445fee0eea6d169.sys. md5: 7B35FA55C4E1D85B70BA0743D2DA9899
12:11:51.0437 1120 9445fee0eea6d169 ( Rootkit.Win32.Necurs.gen ) - infected
12:11:51.0437 1120 9445fee0eea6d169 - detected Rootkit.Win32.Necurs.gen (0)
12:11:51.0484 1120 Abiosdsk - ok
12:11:51.0531 1120 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
12:11:51.0546 1120 abp480n5 - ok
12:11:51.0593 1120 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
12:11:51.0609 1120 ACPI - ok
12:11:51.0640 1120 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
12:11:51.0640 1120 ACPIEC - ok
12:11:51.0656 1120 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys
12:11:51.0671 1120 adpu160m - ok
12:11:51.0703 1120 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
12:11:51.0703 1120 aec - ok
12:11:51.0734 1120 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
12:11:51.0734 1120 AFD - ok
12:11:51.0781 1120 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
12:11:51.0796 1120 agp440 - ok
12:11:51.0796 1120 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
12:11:51.0796 1120 agpCPQ - ok
12:11:51.0828 1120 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys
12:11:51.0828 1120 Aha154x - ok
12:11:51.0843 1120 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys
12:11:51.0875 1120 aic78u2 - ok
12:11:51.0890 1120 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys
12:11:51.0890 1120 aic78xx - ok
12:11:51.0921 1120 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
12:11:51.0921 1120 Alerter - ok
12:11:51.0937 1120 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
12:11:51.0937 1120 ALG - ok
12:11:51.0953 1120 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys
12:11:51.0953 1120 AliIde - ok
12:11:51.0984 1120 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys
12:11:51.0984 1120 alim1541 - ok
12:11:52.0000 1120 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys
12:11:52.0000 1120 amdagp - ok
12:11:52.0015 1120 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys
12:11:52.0015 1120 amsint - ok
12:11:52.0062 1120 [ 85180CF88C5EBAD73B452A43A004CA51 ] AOL ACS C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
12:11:52.0062 1120 AOL ACS - ok
12:11:52.0109 1120 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
12:11:52.0125 1120 AppMgmt - ok
12:11:52.0156 1120 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys
12:11:52.0156 1120 asc - ok
12:11:52.0171 1120 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys
12:11:52.0171 1120 asc3350p - ok
12:11:52.0203 1120 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys
12:11:52.0203 1120 asc3550 - ok
12:11:52.0281 1120 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
12:11:52.0296 1120 aspnet_state - ok
12:11:52.0312 1120 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
12:11:52.0312 1120 AsyncMac - ok
12:11:52.0328 1120 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
12:11:52.0343 1120 atapi - ok
12:11:52.0343 1120 Atdisk - ok
12:11:52.0359 1120 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
12:11:52.0359 1120 Atmarpc - ok
12:11:52.0390 1120 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
12:11:52.0390 1120 AudioSrv - ok
12:11:52.0406 1120 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
12:11:52.0406 1120 audstub - ok
12:11:52.0406 1120 AVGIDSHX - ok
12:11:52.0421 1120 AVGIDSShim - ok
12:11:52.0453 1120 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
12:11:52.0453 1120 Beep - ok
12:11:52.0468 1120 [ A06CE3399D16DB864F55FAEB1F1927A9 ] Browser C:\WINDOWS\System32\browser.dll
12:11:52.0468 1120 Browser - ok
12:11:52.0484 1120 bvrp_pci - ok
12:11:52.0531 1120 catchme - ok
12:11:52.0546 1120 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
12:11:52.0546 1120 cbidf - ok
12:11:52.0562 1120 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
12:11:52.0562 1120 cbidf2k - ok
12:11:52.0578 1120 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
12:11:52.0578 1120 cd20xrnt - ok
12:11:52.0593 1120 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
12:11:52.0593 1120 Cdaudio - ok
12:11:52.0625 1120 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
12:11:52.0625 1120 Cdfs - ok
12:11:52.0640 1120 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
12:11:52.0640 1120 Cdrom - ok
12:11:52.0671 1120 CFcatchme - ok
12:11:52.0687 1120 Changer - ok
12:11:52.0718 1120 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
12:11:52.0718 1120 CiSvc - ok
12:11:52.0734 1120 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
12:11:52.0734 1120 ClipSrv - ok
12:11:52.0781 1120 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:11:52.0781 1120 clr_optimization_v2.0.50727_32 - ok
12:11:52.0812 1120 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:11:52.0812 1120 clr_optimization_v4.0.30319_32 - ok
12:11:52.0828 1120 [ E5DCB56C533014ECBC556A8357C929D5 ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys
12:11:52.0828 1120 CmdIde - ok
12:11:52.0843 1120 COMSysApp - ok
12:11:52.0890 1120 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys
12:11:52.0890 1120 Cpqarray - ok
12:11:52.0890 1120 cpuz132 - ok
12:11:52.0937 1120 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
12:11:52.0937 1120 CryptSvc - ok
12:11:52.0968 1120 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
12:11:52.0968 1120 dac2w2k - ok
12:11:52.0984 1120 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys
12:11:52.0984 1120 dac960nt - ok
12:11:53.0046 1120 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
12:11:53.0078 1120 DcomLaunch - ok
12:11:53.0109 1120 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
12:11:53.0125 1120 Dhcp - ok
12:11:53.0140 1120 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
12:11:53.0140 1120 Disk - ok
12:11:53.0171 1120 [ E2D0DE31442390C35E3163C87CB6A9EB ] DLABOIOM C:\WINDOWS\system32\DLA\DLABOIOM.SYS
12:11:53.0171 1120 DLABOIOM - ok
12:11:53.0187 1120 [ D979BEBCF7EDCC9C9EE1857D1A68C67B ] DLACDBHM C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
12:11:53.0187 1120 DLACDBHM - ok
12:11:53.0203 1120 [ 83545593E297F50A8E2524B4C071A153 ] DLADResN C:\WINDOWS\system32\DLA\DLADResN.SYS
12:11:53.0203 1120 DLADResN - ok
12:11:53.0218 1120 [ 96E01D901CDC98C7817155CC057001BF ] DLAIFS_M C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
12:11:53.0218 1120 DLAIFS_M - ok
12:11:53.0234 1120 [ 0A60A39CC5E767980A31CA5D7238DFA9 ] DLAOPIOM C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
12:11:53.0234 1120 DLAOPIOM - ok
12:11:53.0250 1120 [ 9FE2B72558FC808357F427FD83314375 ] DLAPoolM C:\WINDOWS\system32\DLA\DLAPoolM.SYS
12:11:53.0250 1120 DLAPoolM - ok
12:11:53.0265 1120 [ 7EE0852AE8907689DF25049DCD2342E8 ] DLARTL_N C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
12:11:53.0265 1120 DLARTL_N - ok
12:11:53.0281 1120 [ F08E1DAFAC457893399E03430A6A1397 ] DLAUDFAM C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
12:11:53.0281 1120 DLAUDFAM - ok
12:11:53.0296 1120 [ E7D105ED1E694449D444A9933DF8E060 ] DLAUDF_M C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
12:11:53.0296 1120 DLAUDF_M - ok
12:11:53.0296 1120 dmadmin - ok
12:11:53.0359 1120 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
12:11:53.0390 1120 dmboot - ok
12:11:53.0437 1120 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
12:11:53.0437 1120 dmio - ok
12:11:53.0484 1120 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
12:11:53.0484 1120 dmload - ok
12:11:53.0515 1120 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
12:11:53.0515 1120 dmserver - ok
12:11:53.0531 1120 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
12:11:53.0531 1120 DMusic - ok
12:11:53.0562 1120 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
12:11:53.0562 1120 Dnscache - ok
12:11:53.0593 1120 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
12:11:53.0609 1120 Dot3svc - ok
12:11:53.0656 1120 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys
12:11:53.0656 1120 dpti2o - ok
12:11:53.0687 1120 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
12:11:53.0687 1120 drmkaud - ok
12:11:53.0687 1120 [ FD0F95981FEF9073659D8EC58E40AA3C ] DRVMCDB C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
12:11:53.0703 1120 DRVMCDB - ok
12:11:53.0703 1120 [ B4869D320428CDC5EC4D7F5E808E99B5 ] DRVNDDM C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
12:11:53.0703 1120 DRVNDDM - ok
12:11:53.0828 1120 [ 2AC2372FFAD9ADC85672CC8E8AE14BE9 ] DSproct C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys
12:11:53.0906 1120 DSproct - ok
12:11:53.0968 1120 [ 12986452237021FD48B08F8E23F6A7AB ] dvdfab C:\WINDOWS\system32\drivers\dvdfab.sys
12:11:53.0968 1120 dvdfab - ok
12:11:53.0984 1120 [ 3FCA03CBCA11269F973B70FA483C88EF ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
12:11:53.0984 1120 E100B - ok
12:11:54.0046 1120 [ 00192F0C612591D585594E9467E6CA8B ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
12:11:54.0046 1120 e1express - ok
12:11:54.0078 1120 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
12:11:54.0078 1120 EapHost - ok
12:11:54.0125 1120 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
12:11:54.0125 1120 ERSvc - ok
12:11:54.0171 1120 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
12:11:54.0171 1120 Eventlog - ok
12:11:54.0234 1120 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
12:11:54.0250 1120 EventSystem - ok
12:11:54.0265 1120 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
12:11:54.0265 1120 Fastfat - ok
12:11:54.0312 1120 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
12:11:54.0312 1120 FastUserSwitchingCompatibility - ok
12:11:54.0343 1120 [ E97D6A8684466DF94FF3BC24FB787A07 ] Fax C:\WINDOWS\system32\fxssvc.exe
12:11:54.0343 1120 Fax - ok
12:11:54.0359 1120 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
12:11:54.0375 1120 Fdc - ok
12:11:54.0453 1120 [ 9200A69413D69AB86ADD9BC81960BE7B ] FileMonitor C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys
12:11:54.0453 1120 FileMonitor - ok
12:11:54.0484 1120 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
12:11:54.0484 1120 Fips - ok
12:11:54.0531 1120 [ D60EF46DC0E757FE5EB579DB95B88954 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
12:11:54.0546 1120 FLEXnet Licensing Service - ok
12:11:54.0578 1120 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
12:11:54.0578 1120 Flpydisk - ok
12:11:54.0609 1120 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
12:11:54.0609 1120 FltMgr - ok
12:11:54.0656 1120 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
12:11:54.0656 1120 FontCache3.0.0.0 - ok
12:11:54.0671 1120 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
12:11:54.0687 1120 Fs_Rec - ok
12:11:54.0703 1120 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
12:11:54.0703 1120 Ftdisk - ok
12:11:54.0734 1120 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
12:11:54.0734 1120 Gpc - ok
12:11:54.0781 1120 [ 751C1D2CA2ABF4A9F5A6B8D7D45B907C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
12:11:54.0812 1120 gusvc - ok
12:11:54.0890 1120 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
12:11:54.0890 1120 HDAudBus - ok
12:11:54.0984 1120 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
12:11:54.0984 1120 helpsvc - ok
12:11:55.0046 1120 HidServ - ok
12:11:55.0093 1120 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
12:11:55.0093 1120 HidUsb - ok
12:11:55.0125 1120 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
12:11:55.0125 1120 hkmsvc - ok
12:11:55.0171 1120 [ 55D7308E1437C629D2E52787BDA2CB45 ] hnmwrlspkt C:\WINDOWS\system32\DRIVERS\hnm_wrls_pkt.sys
12:11:55.0171 1120 hnmwrlspkt - ok
12:11:55.0187 1120 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys
12:11:55.0187 1120 hpn - ok
12:11:55.0234 1120 [ 77E4FF0B73BC0AEAAF39BF0C8104231F ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
12:11:55.0234 1120 HSFHWBS2 - ok
12:11:55.0265 1120 [ 60E1604729A15EF4A3B05F298427B3B1 ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
12:11:55.0296 1120 HSF_DP - ok
12:11:55.0359 1120 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
12:11:55.0359 1120 HTTP - ok
12:11:55.0406 1120 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
12:11:55.0406 1120 HTTPFilter - ok
12:11:55.0421 1120 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys
12:11:55.0421 1120 i2omgmt - ok
12:11:55.0453 1120 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys
12:11:55.0453 1120 i2omp - ok
12:11:55.0468 1120 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
12:11:55.0468 1120 i8042prt - ok
12:11:55.0515 1120 [ B122BE74E283A2BC7FEBC180BFD2EFD5 ] IAANTMON C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
12:11:55.0515 1120 IAANTMON - ok
12:11:55.0546 1120 [ 019CF5F31C67030841233C545A0E217A ] iaStor C:\WINDOWS\system32\drivers\iaStor.sys
12:11:55.0546 1120 iaStor - ok
12:11:55.0609 1120 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:11:55.0656 1120 idsvc - ok
12:11:55.0671 1120 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
12:11:55.0671 1120 Imapi - ok
12:11:55.0703 1120 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
12:11:55.0703 1120 ImapiService - ok
12:11:55.0750 1120 [ 8AE99EBE30E8338907361018D9030835 ] IMFservice C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
12:11:55.0765 1120 IMFservice - ok
12:11:55.0812 1120 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys
12:11:55.0812 1120 ini910u - ok
12:11:55.0890 1120 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
12:11:55.0890 1120 IntelIde - ok
12:11:55.0953 1120 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
12:11:55.0953 1120 intelppm - ok
12:11:56.0015 1120 [ 3DC635B66DD7412E1C9C3A77B8D78F25 ] IntuitUpdateService C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
12:11:56.0015 1120 IntuitUpdateService - ok
12:11:56.0062 1120 [ 1663A135865F0BA6E853353E98E67F2A ] IntuitUpdateServiceV4 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
12:11:56.0062 1120 IntuitUpdateServiceV4 - ok
12:11:56.0156 1120 [ B5A662956977407C6B9B88A846FEF9BD ] ioloSystemService C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
12:11:56.0187 1120 ioloSystemService - ok
12:11:56.0203 1120 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
12:11:56.0203 1120 Ip6Fw - ok
12:11:56.0218 1120 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
12:11:56.0218 1120 IpFilterDriver - ok
12:11:56.0250 1120 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
12:11:56.0250 1120 IpInIp - ok
12:11:56.0296 1120 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
12:11:56.0296 1120 IpNat - ok
12:11:56.0312 1120 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
12:11:56.0312 1120 IPSec - ok
12:11:56.0343 1120 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
12:11:56.0359 1120 IRENUM - ok
12:11:56.0375 1120 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
12:11:56.0375 1120 isapnp - ok
12:11:56.0453 1120 [ 381B25DC8E958D905B33130D500BBF29 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
12:11:56.0453 1120 JavaQuickStarterService - ok
12:11:56.0484 1120 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
12:11:56.0484 1120 Kbdclass - ok
12:11:56.0515 1120 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
12:11:56.0515 1120 kbdhid - ok
12:11:56.0562 1120 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
12:11:56.0562 1120 kmixer - ok
12:11:56.0593 1120 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
12:11:56.0593 1120 KSecDD - ok
12:11:56.0640 1120 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
12:11:56.0640 1120 lanmanserver - ok
12:11:56.0687 1120 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
12:11:56.0687 1120 lanmanworkstation - ok
12:11:56.0687 1120 lbrtfdc - ok
12:11:56.0734 1120 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
12:11:56.0734 1120 LmHosts - ok
12:11:56.0796 1120 [ 11F714F85530A2BD134074DC30E99FCA ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
12:11:56.0796 1120 MDM - ok
12:11:56.0812 1120 [ EEAEA6514BA7C9D273B5E87C4E1AAB30 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
12:11:56.0812 1120 mdmxsdk - ok
12:11:56.0875 1120 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
12:11:56.0906 1120 Messenger - ok
12:11:56.0968 1120 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
12:11:56.0984 1120 mnmdd - ok
12:11:57.0000 1120 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
12:11:57.0015 1120 mnmsrvc - ok
12:11:57.0062 1120 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
12:11:57.0062 1120 Modem - ok
12:11:57.0062 1120 [ 1992E0D143B09653AB0F9C5E04B0FD65 ] MODEMCSA C:\WINDOWS\system32\drivers\MODEMCSA.sys
12:11:57.0078 1120 MODEMCSA - ok
12:11:57.0078 1120 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
12:11:57.0078 1120 Mouclass - ok
12:11:57.0109 1120 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
12:11:57.0109 1120 mouhid - ok
12:11:57.0125 1120 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
12:11:57.0125 1120 MountMgr - ok
12:11:57.0156 1120 [ 46297FA8E30A6007F14118FC2B942FBC ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
12:11:57.0156 1120 MozillaMaintenance - ok
12:11:57.0187 1120 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys
12:11:57.0187 1120 mraid35x - ok
12:11:57.0218 1120 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
12:11:57.0218 1120 MRxDAV - ok
12:11:57.0281 1120 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
12:11:57.0281 1120 MRxSmb - ok
12:11:57.0328 1120 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
12:11:57.0328 1120 MSDTC - ok
12:11:57.0375 1120 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
12:11:57.0375 1120 Msfs - ok
12:11:57.0390 1120 MSIServer - ok
12:11:57.0406 1120 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
12:11:57.0406 1120 MSKSSRV - ok
12:11:57.0421 1120 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
12:11:57.0421 1120 MSPCLOCK - ok
12:11:57.0437 1120 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
12:11:57.0453 1120 MSPQM - ok
12:11:57.0468 1120 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
12:11:57.0468 1120 mssmbios - ok
12:11:57.0703 1120 [ 1B959A0614D575D0AB3B09095F0A8B83 ] MSSQL$MICROSOFTSMLBIZ C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
12:11:58.0015 1120 MSSQL$MICROSOFTSMLBIZ - ok
12:11:58.0062 1120 [ 1D1B22613EAB9287AF902398867BC93C ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
12:11:58.0062 1120 MSSQLServerADHelper - ok
12:11:58.0078 1120 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
12:11:58.0078 1120 Mup - ok
12:11:58.0125 1120 [ 1E59AAED42A5E3A5ED86EC403F9C0776 ] NAL C:\WINDOWS\system32\Drivers\iqvw32.sys
12:11:58.0125 1120 NAL - ok
12:11:58.0156 1120 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
12:11:58.0156 1120 napagent - ok
12:11:58.0203 1120 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
12:11:58.0203 1120 NDIS - ok
12:11:58.0234 1120 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
12:11:58.0234 1120 NdisTapi - ok
12:11:58.0250 1120 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
12:11:58.0250 1120 Ndisuio - ok
12:11:58.0265 1120 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
12:11:58.0281 1120 NdisWan - ok
12:11:58.0296 1120 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
12:11:58.0296 1120 NDProxy - ok
12:11:58.0312 1120 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
12:11:58.0312 1120 NetBIOS - ok
12:11:58.0343 1120 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
12:11:58.0343 1120 NetBT - ok
12:11:58.0390 1120 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
12:11:58.0390 1120 NetDDE - ok
12:11:58.0437 1120 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
12:11:58.0437 1120 NetDDEdsdm - ok
12:11:58.0453 1120 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
12:11:58.0453 1120 Netlogon - ok
12:11:58.0500 1120 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
12:11:58.0500 1120 Netman - ok
12:11:58.0531 1120 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:11:58.0562 1120 NetTcpPortSharing - ok
12:11:58.0593 1120 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
12:11:58.0609 1120 Nla - ok
12:11:58.0625 1120 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
12:11:58.0625 1120 Npfs - ok
12:11:58.0671 1120 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
12:11:58.0687 1120 Ntfs - ok
12:11:58.0703 1120 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
12:11:58.0703 1120 NtLmSsp - ok
12:11:58.0734 1120 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
12:11:58.0765 1120 NtmsSvc - ok
12:11:58.0781 1120 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
12:11:58.0781 1120 Null - ok
12:11:58.0968 1120 [ 5950E6CC9FB3FABB61604D395DBC8550 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
12:11:59.0125 1120 nv - ok
12:11:59.0187 1120 [ 9FE764D5EECCA13B0932FAB81A4A5A6F ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
12:11:59.0187 1120 NVSvc - ok
12:11:59.0218 1120 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
12:11:59.0218 1120 NwlnkFlt - ok
12:11:59.0234 1120 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
12:11:59.0234 1120 NwlnkFwd - ok
12:11:59.0281 1120 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:11:59.0281 1120 ose - ok
12:11:59.0312 1120 [ 9A7FD6B64E78A8A0D79F372CFCC43E19 ] Packet C:\WINDOWS\system32\DRIVERS\packet.sys
12:11:59.0312 1120 Packet - ok
12:11:59.0343 1120 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
12:11:59.0343 1120 Parport - ok
12:11:59.0343 1120 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
12:11:59.0343 1120 PartMgr - ok
12:11:59.0390 1120 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
12:11:59.0390 1120 ParVdm - ok
12:11:59.0390 1120 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
12:11:59.0390 1120 PCI - ok
12:11:59.0406 1120 PCIDump - ok
12:11:59.0421 1120 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
12:11:59.0421 1120 PCIIde - ok
12:11:59.0437 1120 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
12:11:59.0453 1120 Pcmcia - ok
12:11:59.0468 1120 [ 5B6C11DE7E839C05248CED8825470FEF ] pcouffin C:\WINDOWS\system32\Drivers\pcouffin.sys
12:11:59.0468 1120 pcouffin - ok
12:11:59.0500 1120 [ 7EA0EBD6E5AA687E116EB185A7CFB667 ] PCTAppEvent C:\WINDOWS\system32\drivers\PCTAppEvent.sys
12:11:59.0515 1120 PCTAppEvent - ok
12:11:59.0546 1120 [ 60AF5FA418EFE284FB81DBBF5A0391FB ] PCTFW-PacketFilter C:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys
12:11:59.0546 1120 PCTFW-PacketFilter - ok
12:11:59.0593 1120 [ 5BE722C8C9BBA995693C8CD524D83B27 ] pctgntdi C:\WINDOWS\system32\drivers\pctgntdi.sys
12:11:59.0609 1120 pctgntdi - ok
12:11:59.0640 1120 [ 3EC79CFB2E0E74AADA8B561ED8904577 ] pctNDIS C:\WINDOWS\system32\DRIVERS\pctNdis.sys
12:11:59.0640 1120 pctNDIS - ok
12:11:59.0703 1120 [ 86D511370A217B554916E3A45D091042 ] PCToolsFirewallPlus C:\Program Files\PC Tools Firewall Plus\FWService.exe
12:11:59.0718 1120 PCToolsFirewallPlus - ok
12:11:59.0750 1120 [ FE6803AF91DDB32FF8EDF5D6C0D370AF ] pctplfw C:\WINDOWS\system32\drivers\pctplfw.sys
12:11:59.0750 1120 pctplfw - ok
12:11:59.0781 1120 PDCOMP - ok
12:11:59.0796 1120 PDFRAME - ok
12:11:59.0812 1120 [ 40C611622882C3FCAFEB845C1E12A10F ] PDFsFilter C:\WINDOWS\system32\DRIVERS\PDFsFilter.sys
12:11:59.0812 1120 PDFsFilter - ok
12:11:59.0812 1120 PDRELI - ok
12:11:59.0828 1120 PDRFRAME - ok
12:11:59.0859 1120 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys
12:11:59.0859 1120 perc2 - ok
12:11:59.0921 1120 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys
12:11:59.0921 1120 perc2hib - ok
12:11:59.0984 1120 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
12:11:59.0984 1120 PlugPlay - ok
12:12:00.0015 1120 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
12:12:00.0031 1120 PolicyAgent - ok
12:12:00.0078 1120 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
12:12:00.0078 1120 PptpMiniport - ok
12:12:00.0093 1120 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
12:12:00.0093 1120 ProtectedStorage - ok
12:12:00.0109 1120 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
12:12:00.0109 1120 PSched - ok
12:12:00.0156 1120 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
12:12:00.0156 1120 Ptilink - ok
12:12:00.0203 1120 [ D86B4A68565E444D76457F14172C875A ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
12:12:00.0203 1120 PxHelp20 - ok
12:12:00.0234 1120 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys
12:12:00.0234 1120 ql1080 - ok
12:12:00.0234 1120 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
12:12:00.0234 1120 Ql10wnt - ok
12:12:00.0250 1120 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys
12:12:00.0250 1120 ql12160 - ok
12:12:00.0281 1120 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys
12:12:00.0281 1120 ql1240 - ok
12:12:00.0296 1120 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys
12:12:00.0296 1120 ql1280 - ok
12:12:00.0312 1120 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
12:12:00.0312 1120 RasAcd - ok
12:12:00.0343 1120 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
12:12:00.0359 1120 RasAuto - ok
12:12:00.0375 1120 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
12:12:00.0375 1120 Rasl2tp - ok
12:12:00.0406 1120 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
12:12:00.0406 1120 RasMan - ok
12:12:00.0453 1120 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
12:12:00.0453 1120 RasPppoe - ok
12:12:00.0468 1120 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
12:12:00.0468 1120 Raspti - ok
12:12:00.0515 1120 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
12:12:00.0515 1120 Rdbss - ok
12:12:00.0531 1120 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
12:12:00.0531 1120 RDPCDD - ok
12:12:00.0546 1120 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
12:12:00.0546 1120 rdpdr - ok
12:12:00.0593 1120 [ 6589DB6E5969F8EEE594CF71171C5028 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
12:12:00.0609 1120 RDPWD - ok
12:12:00.0640 1120 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
12:12:00.0671 1120 RDSessMgr - ok
12:12:00.0703 1120 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
12:12:00.0703 1120 redbook - ok
12:12:00.0734 1120 [ 2CA761CE3ABB7BBBB9C5519B2FB54F5E ] RegFilter C:\Program Files\IObit\IObit Malware Fighter\drivers\wxp_x86\regfilter.sys
12:12:00.0734 1120 RegFilter - ok
12:12:00.0750 1120 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
12:12:00.0750 1120 RemoteAccess - ok
12:12:00.0781 1120 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
12:12:00.0781 1120 RemoteRegistry - ok
12:12:00.0796 1120 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
12:12:00.0796 1120 RpcLocator - ok
12:12:00.0843 1120 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
12:12:00.0859 1120 RpcSs - ok
12:12:00.0921 1120 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
12:12:00.0953 1120 RSVP - ok
12:12:01.0000 1120 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
12:12:01.0000 1120 SamSs - ok
12:12:01.0046 1120 [ 39763504067962108505BFF25F024345 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
12:12:01.0046 1120 SASDIFSV - ok
12:12:01.0078 1120 [ 7CE61C25C159F50F9EAF6D77FC83FA35 ] SASENUM C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
12:12:01.0078 1120 SASENUM - ok
12:12:01.0093 1120 [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
12:12:01.0093 1120 SASKUTIL - ok
12:12:01.0125 1120 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
12:12:01.0125 1120 SCardSvr - ok
12:12:01.0156 1120 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
12:12:01.0156 1120 Schedule - ok
12:12:01.0187 1120 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
12:12:01.0187 1120 Secdrv - ok
12:12:01.0234 1120 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
12:12:01.0234 1120 seclogon - ok
12:12:01.0250 1120 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
12:12:01.0250 1120 SENS - ok
12:12:01.0265 1120 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
12:12:01.0265 1120 serenum - ok
12:12:01.0281 1120 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
12:12:01.0281 1120 Serial - ok
12:12:01.0312 1120 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
12:12:01.0312 1120 Sfloppy - ok
12:12:01.0359 1120 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
12:12:01.0359 1120 ShellHWDetection - ok
12:12:01.0375 1120 Simbad - ok
12:12:01.0406 1120 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys
12:12:01.0406 1120 sisagp - ok
12:12:01.0437 1120 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys
12:12:01.0437 1120 Sparrow - ok
12:12:01.0468 1120 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
12:12:01.0468 1120 splitter - ok
12:12:01.0500 1120 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
12:12:01.0500 1120 Spooler - ok
12:12:01.0546 1120 [ 0C1DAD75274CB6E31F053CE3E08BF9C3 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys
12:12:01.0578 1120 sptd - ok
12:12:01.0625 1120 [ 352E375AB298C23B0F9BC307652C7F50 ] SQLAgent$MICROSOFTSMLBIZ C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE
12:12:01.0656 1120 SQLAgent$MICROSOFTSMLBIZ - ok
12:12:01.0687 1120 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
12:12:01.0687 1120 sr - ok
12:12:01.0718 1120 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
12:12:01.0718 1120 srservice - ok
12:12:01.0750 1120 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
12:12:01.0765 1120 Srv - ok
12:12:01.0796 1120 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
12:12:01.0796 1120 SSDPSRV - ok
12:12:01.0906 1120 [ 797FCC1D859B203958E915BB82528DA9 ] STHDA C:\WINDOWS\system32\drivers\sthda.sys
12:12:01.0937 1120 STHDA - ok
12:12:01.0984 1120 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
12:12:02.0062 1120 stisvc - ok
12:12:02.0109 1120 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
12:12:02.0109 1120 swenum - ok
12:12:02.0156 1120 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
12:12:02.0156 1120 swmidi - ok
12:12:02.0171 1120 SwPrv - ok
12:12:02.0187 1120 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys
12:12:02.0187 1120 symc810 - ok
12:12:02.0218 1120 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys
12:12:02.0218 1120 symc8xx - ok
12:12:02.0234 1120 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys
12:12:02.0234 1120 sym_hi - ok
12:12:02.0250 1120 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys
12:12:02.0250 1120 sym_u3 - ok
12:12:02.0265 1120 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
12:12:02.0265 1120 sysaudio - ok
12:12:02.0281 1120 Suspicious service (NoAccess): syshost32
12:12:02.0359 1120 [ 81F49679A3E51F10B1DD20BEFDEF7772 ] syshost32 C:\WINDOWS\Installer\{21AFBFB6-53EF-36C2-120C-7E9BF1C4C429}\syshost.exe
12:12:02.0359 1120 Suspicious file (NoAccess): C:\WINDOWS\Installer\{21AFBFB6-53EF-36C2-120C-7E9BF1C4C429}\syshost.exe. md5: 81F49679A3E51F10B1DD20BEFDEF7772
12:12:02.0453 1120 syshost32 ( Rootkit.Win32.Necurs.gen ) - infected
12:12:02.0453 1120 syshost32 - detected Rootkit.Win32.Necurs.gen (0)
12:12:02.0500 1120 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
12:12:02.0515 1120 SysmonLog - ok
12:12:02.0546 1120 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
12:12:02.0546 1120 TapiSrv - ok
12:12:02.0609 1120 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
12:12:02.0609 1120 Tcpip - ok
12:12:02.0656 1120 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
12:12:02.0656 1120 TDPIPE - ok
12:12:02.0671 1120 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
12:12:02.0671 1120 TDTCP - ok
12:12:02.0703 1120 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
12:12:02.0703 1120 TermDD - ok
12:12:02.0750 1120 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
12:12:02.0765 1120 TermService - ok
12:12:02.0781 1120 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
12:12:02.0781 1120 Themes - ok
12:12:02.0828 1120 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
12:12:02.0828 1120 TlntSvr - ok
12:12:02.0921 1120 [ F2790F6AF01321B172AA62F8E1E187D9 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys
12:12:02.0921 1120 TosIde - ok
12:12:02.0984 1120 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
12:12:02.0984 1120 TrkWks - ok
12:12:03.0031 1120 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
12:12:03.0031 1120 Udfs - ok
12:12:03.0046 1120 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys
12:12:03.0046 1120 ultra - ok
12:12:03.0078 1120 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
12:12:03.0093 1120 Update - ok
12:12:03.0125 1120 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
12:12:03.0156 1120 upnphost - ok
12:12:03.0187 1120 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
12:12:03.0187 1120 UPS - ok
12:12:03.0203 1120 [ 62551BA687F1D0F582810CFA37384BB0 ] UrlFilter C:\Program Files\IObit\IObit Malware Fighter\drivers\wxp_x86\UrlFilter.sys
12:12:03.0203 1120 UrlFilter - ok
12:12:03.0234 1120 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
12:12:03.0250 1120 usbccgp - ok
12:12:03.0265 1120 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
12:12:03.0265 1120 usbehci - ok
12:12:03.0281 1120 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
12:12:03.0281 1120 usbhub - ok
12:12:03.0312 1120 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
12:12:03.0312 1120 usbprint - ok
12:12:03.0343 1120 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
12:12:03.0343 1120 usbscan - ok
12:12:03.0359 1120 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
12:12:03.0359 1120 USBSTOR - ok
12:12:03.0375 1120 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
12:12:03.0375 1120 usbuhci - ok
12:12:03.0390 1120 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
12:12:03.0390 1120 usb_rndisx - ok
12:12:03.0406 1120 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
12:12:03.0406 1120 VgaSave - ok
12:12:03.0421 1120 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys
12:12:03.0421 1120 viaagp - ok
12:12:03.0437 1120 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys
12:12:03.0437 1120 ViaIde - ok
12:12:03.0453 1120 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
12:12:03.0453 1120 VolSnap - ok
12:12:03.0468 1120 VPROEVENTMONITOR - ok
12:12:03.0468 1120 Vsapint - ok
12:12:03.0515 1120 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
12:12:03.0531 1120 VSS - ok
12:12:03.0562 1120 [ 54AF4B1D5459500EF0937F6D33B1914F ] w32time C:\WINDOWS\system32\w32time.dll
12:12:03.0562 1120 w32time - ok
12:12:03.0593 1120 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
12:12:03.0593 1120 Wanarp - ok
12:12:03.0640 1120 [ 0A716C08CB13C3A8F4F51E882DBF7416 ] wanatw C:\WINDOWS\system32\DRIVERS\wanatw4.sys
12:12:03.0640 1120 wanatw - ok
12:12:03.0656 1120 [ EB9A99AB5D17B1727034FF191E6448D7 ] WANMiniportService C:\WINDOWS\wanmpsvc.exe
12:12:03.0703 1120 WANMiniportService - ok
12:12:03.0734 1120 [ 46A247F6617526AFE38B6F12F5512120 ] wceusbsh C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
12:12:03.0734 1120 wceusbsh - ok
12:12:03.0750 1120 [ D6EFAF429FD30C5DF613D220E344CCE7 ] WDC_SAM C:\WINDOWS\system32\DRIVERS\wdcsam.sys
12:12:03.0750 1120 WDC_SAM - ok
12:12:03.0750 1120 WDICA - ok
12:12:03.0781 1120 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
12:12:03.0781 1120 wdmaud - ok
12:12:03.0796 1120 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
12:12:03.0812 1120 WebClient - ok
12:12:03.0843 1120 [ F59ED5A43B988A18EF582BB07B2327A7 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
12:12:03.0859 1120 winachsf - ok
12:12:04.0000 1120 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
12:12:04.0000 1120 winmgmt - ok
12:12:04.0062 1120 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll
12:12:04.0109 1120 WinRM - ok
12:12:04.0218 1120 [ 5144AE67D60EC653F97DDF3FEED29E77 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
12:12:04.0265 1120 wlidsvc - ok
12:12:04.0312 1120 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
12:12:04.0312 1120 WmdmPmSN - ok
12:12:04.0359 1120 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
12:12:04.0390 1120 Wmi - ok
12:12:04.0437 1120 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
12:12:04.0437 1120 WmiApSrv - ok
12:12:04.0515 1120 [ 6BAB4DC65515A098505F8B3D01FB6FE5 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
12:12:04.0546 1120 WMPNetworkSvc - ok
12:12:04.0562 1120 [ C60DC16D4E406810FAD54B98DC92D5EC ] WpdUsb C:\WINDOWS\system32\Drivers\wpdusb.sys
12:12:04.0562 1120 WpdUsb - ok
12:12:04.0671 1120 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
12:12:04.0750 1120 WPFFontCache_v0400 - ok
12:12:04.0796 1120 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
12:12:04.0796 1120 WS2IFSL - ok
12:12:04.0796 1120 WSearch - ok
12:12:04.0828 1120 [ E068D1F5D4ABC1111566BCEFE85F1AC2 ] wsppkt C:\WINDOWS\system32\DRIVERS\wsp_pkt.sys
12:12:04.0828 1120 wsppkt - ok
12:12:04.0875 1120 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
12:12:04.0921 1120 WudfPf - ok
12:12:05.0000 1120 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
12:12:05.0031 1120 WudfRd - ok
12:12:05.0062 1120 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
12:12:05.0078 1120 WudfSvc - ok
12:12:05.0156 1120 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
12:12:05.0171 1120 WZCSVC - ok
12:12:05.0234 1120 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
12:12:05.0234 1120 xmlprov - ok
12:12:05.0250 1120 ================ Scan global ===============================
12:12:05.0312 1120 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
12:12:05.0359 1120 [ 8C7DCA
-
the aswMBR will not run on my desktop under my log in nor as an Administrator
Do you get an error message?
- Download RogueKiller (http://tigzy.geekstogo.com/Tools/RogueKiller.exe) on the desktop
- Close all the running programs
- Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
- Otherwise just double-click on RogueKiller.exe
- Pre-scan will start. Let it finish.
- Click on SCAN button.
- A report (RKreport.txt) should open. Post its content in your next reply. (RKreport could also be found on your desktop)
- If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
************************************************************
Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/rootrepeal/MBRCheck.exe)
Link 2 (http://ad13.geekstogo.com/MBRCheck.exe)
Link 3 (http://www.kernelmode.info/MBRCheck.exe)
•Double-click on MBRCheck.exe to run it.
•It will open a black window...please do not fix anything (if it gives you an option).
•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.
-
When trying to run the aswMBR application, it does not react, no application, no error message, etc.
here are the RogueKiller and MBRCheck reports:
RogueKiller V7.6.6 [08/10/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com
Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Patrick [Admin rights]
Mode: Scan -- Date: 08/24/2012 20:34:12
¤¤¤ Bad processes: 1 ¤¤¤
[SUSP PATH] govkhca.exe -- C:\Documents and Settings\Patrick\govkhca.exe -> KILLED [TermProc]
¤¤¤ Registry Entries: 12 ¤¤¤
[BLACKLIST DLL] HKCU\[...]\Run : Autodesk (rundll32.exe "C:\Documents and Settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll",CreateInstance) -> FOUND
[BLACKLIST DLL] HKUS\.DEFAULT[...]\Run : Autodesk (rundll32.exe "C:\Documents and Settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll",CreateInstance) -> FOUND
[BLACKLIST DLL] HKUS\S-1-5-21-2796421550-788906634-1267632633-1006[...]\Run : Autodesk (rundll32.exe "C:\Documents and Settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll",CreateInstance) -> FOUND
[BLACKLIST DLL] HKUS\S-1-5-18[...]\Run : Autodesk (rundll32.exe "C:\Documents and Settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll",CreateInstance) -> FOUND
[ZeroAccess] HKCR\[...]\InprocServer32 : (\\.\globalroot\systemroot\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n.) -> FOUND
[ZeroAccess] HKLM\[...]\InprocServer32 : (\\.\globalroot\systemroot\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n.) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HIDDEN VAL] HKCU\[...]\Run : govShell (C:\Documents and Settings\Patrick\govkhca.exe) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] n : c:\windows\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n --> FOUND
[ZeroAccess][FILE] @ : c:\windows\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@ --> FOUND
[ZeroAccess][FOLDER] U : c:\windows\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U --> FOUND
[ZeroAccess][FOLDER] L : c:\windows\installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L --> FOUND
[ZeroAccess][FILE] n : c:\documents and settings\patrick\local settings\application data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n --> FOUND
[ZeroAccess][FILE] @ : c:\documents and settings\patrick\local settings\application data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@ --> FOUND
[ZeroAccess][FOLDER] U : c:\documents and settings\patrick\local settings\application data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U --> FOUND
[ZeroAccess][FOLDER] L : c:\documents and settings\patrick\local settings\application data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L --> FOUND
[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac\desktop.ini --> FOUND
¤¤¤ Driver: [NOT LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess|Root.MBR ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: ARRAY +++++
--- User ---
[MBR] 1774f3d5b49f9f2b75a45da1c8507bd6
[BSP] dfe4c0bfa859120fb83a6a1aa43abcee : MBR Code unknown
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 112455 | Size: 175546 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 359631090 | Size: 59012 Mo
3 - [XXXXXX] UNKNOWN (0xdb) [VISIBLE] Offset (sectors): 480488085 | Size: 3796 Mo
User != LL1 ... KO!
--- LL1 ---
[MBR] 3ddd9a84be42a4625b85406fe08106cf
[BSP] 0006296a8c957eeb80ed14c405f8c64b : MaxSS MBR Code!
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 112455 | Size: 175546 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 359631090 | Size: 59012 Mo
3 - [XXXXXX] UNKNOWN (0xdb) [VISIBLE] Offset (sectors): 480488085 | Size: 3796 Mo
Error reading LL2 MBR!
+++++ PhysicalDrive1: HP External HDD USB Device +++++
--- User ---
[MBR] 388d886274f3aa36ea2affb5823c2b27
[BSP] 0dd43184484a6815ab20400bf39e3619 : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476269 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
+++++ PhysicalDrive2: WD My Passport 0740 USB Device +++++
--- User ---
[MBR] 10e93ad5e841512afefef1b41a97e15d
[BSP] a2afca834be8506a95112da9d22fbe5f : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953836 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
+++++ PhysicalDrive3: PNY USB 2.0 FD USB Device +++++
--- User ---
[MBR] 3c31d08e3f9f8b450abd984fa861adc5
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 63 | Size: 7727 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
+++++ PhysicalDrive4: WD 1200BEVExternal USB Device +++++
--- User ---
[MBR] 9f4041c9c71d2e55c9dc1d8d2a7e2e72
[BSP] d0ec2211ba2260ee6d54a28c5292c11f : Windows XP MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 63 | Size: 114470 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[1].txt >>
RKreport[1].txt
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000007fd
Kernel Drivers (total 134):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xF7B44000 \WINDOWS\system32\KDCOM.DLL
0xF7A54000 \WINDOWS\system32\BOOTVID.dll
0x86F93000 9445fee0eea6d169.sys
0xF7520000 pci.sys
0xF7644000 isapnp.sys
0xF74F2000 ACPI.sys
0xF7B46000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7654000 MountMgr.sys
0xF74D3000 ftdisk.sys
0xF7B48000 dmload.sys
0xF74AD000 dmio.sys
0xF78C4000 PartMgr.sys
0xF7664000 VolSnap.sys
0xF73F6000 iaStor.sys
0xF7674000 disk.sys
0xF7684000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73D6000 fltmgr.sys
0xF73C4000 sr.sys
0xF73AE000 DRVMCDB.SYS
0xF7694000 PxHelp20.sys
0xF7397000 KSecDD.sys
0xF7384000 WudfPf.sys
0xF72F7000 Ntfs.sys
0xF72CA000 NDIS.sys
0xF72B0000 Mup.sys
0xF7784000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6123000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF610F000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF60D6000 \SystemRoot\system32\DRIVERS\e1e5132.sys
0xF7934000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF08AE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7944000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF0886000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF0852000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys
0xF082F000 \SystemRoot\system32\DRIVERS\ks.sys
0xF0730000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
0xF0689000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xF795C000 \SystemRoot\System32\Drivers\Modem.SYS
0xF796C000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF76C4000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7BD8000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xF76E4000 \SystemRoot\system32\drivers\dvdfab.sys
0xF76F4000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7734000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF0B22000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7894000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF0D06000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF1B6B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF1B4B000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF1BC3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xEBA40000 \SystemRoot\system32\DRIVERS\psched.sys
0xF1AEB000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF1BA3000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF1CA7000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF1D18000 \SystemRoot\system32\DRIVERS\wanatw4.sys
0xF20E9000 \SystemRoot\System32\Drivers\pcouffin.sys
0xEBA10000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF4634000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF1D10000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF1EC3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7B9A000 \SystemRoot\system32\DRIVERS\swenum.sys
0xEB9B2000 \SystemRoot\system32\DRIVERS\update.sys
0xF1617000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF160F000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF680D000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF77C4000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF15DD000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xEB2E2000 \SystemRoot\system32\drivers\sthda.sys
0xEB2BE000 \SystemRoot\system32\drivers\portcls.sys
0xF1484000 \SystemRoot\system32\drivers\drmk.sys
0xF1E69000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7B34000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF1CBF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C26000 \SystemRoot\System32\Drivers\Null.SYS
0xF1CBB000 \SystemRoot\System32\Drivers\Beep.SYS
0xF1E49000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
0xF7994000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF79A4000 \SystemRoot\System32\drivers\vga.sys
0xF1CB7000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF1CB3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF79B4000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF79C4000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7277000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEB28B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEB232000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEB20A000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF7263000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xEB1E8000 \SystemRoot\System32\drivers\afd.sys
0xF7854000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEB1C6000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0xF79DC000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xEB19B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEB12B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF14B4000 \SystemRoot\System32\Drivers\Fips.SYS
0xF79E4000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF1B3B000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF6D53000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF1AFB000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF4C9E000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF6D4F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF6D47000 \SystemRoot\system32\DRIVERS\wdcsam.sys
0xEB074000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xED0ED000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7A1C000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C20000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF596000 \SystemRoot\System32\ATMFD.DLL
0xF0B35000 \SystemRoot\system32\DRIVERS\PDFsFilter.sys
0xF0B25000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
0xF41A7000 \SystemRoot\System32\DLA\DLADResN.SYS
0xBA589000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
0xF230C000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
0xF7BFA000 \SystemRoot\System32\DLA\DLAPoolM.SYS
0xF7A44000 \SystemRoot\System32\DLA\DLABOIOM.SYS
0xBA571000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
0xBA55B000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
0xEE2A9000 \SystemRoot\system32\DRIVERS\hnm_wrls_pkt.sys
0xED0E5000 \SystemRoot\system32\DRIVERS\packet.sys
0xEBFFF000 \SystemRoot\system32\DRIVERS\wsp_pkt.sys
0xF4345000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB9C6D000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB9B75000 \SystemRoot\system32\DRIVERS\srv.sys
0xB9C29000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB96B0000 \SystemRoot\system32\drivers\wdmaud.sys
0xF1B2B000 \SystemRoot\system32\drivers\sysaudio.sys
0xB8337000 \SystemRoot\System32\Drivers\HTTP.sys
0xB824B000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB65D1000 \SystemRoot\System32\Drivers\Udfs.SYS
0xB65A6000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll
Processes (total 40):
0 System Idle Process
4 System
324 C:\WINDOWS\system32\smss.exe
372 csrss.exe
396 C:\WINDOWS\system32\winlogon.exe
444 C:\WINDOWS\system32\services.exe
456 C:\WINDOWS\system32\lsass.exe
664 C:\WINDOWS\system32\svchost.exe
756 svchost.exe
796 C:\WINDOWS\system32\svchost.exe
832 C:\WINDOWS\system32\svchost.exe
936 svchost.exe
1000 svchost.exe
1088 C:\WINDOWS\system32\spoolsv.exe
1136 C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
1196 svchost.exe
1228 C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
1248 C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
1308 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
1324 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
1364 C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
1432 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
1464 C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
1500 C:\WINDOWS\system32\nvsvc32.exe
1516 C:\Program Files\PC Tools Firewall Plus\FWService.exe
1564 C:\WINDOWS\system32\svchost.exe
1592 C:\WINDOWS\Installer\{21AFBFB6-53EF-36C2-120C-7E9BF1C4C429}\syshost.exe
1704 C:\WINDOWS\wanmpsvc.exe
1792 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
1820 C:\WINDOWS\system32\searchindexer.exe
2292 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2720 C:\WINDOWS\explorer.exe
2896 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
2904 C:\WINDOWS\system32\DLA\DLACTRLW.EXE
2916 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
2952 C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
3000 C:\WINDOWS\system32\ctfmon.exe
364 C:\WINDOWS\system32\searchprotocolhost.exe
3964 searchfilterhost.exe
3860 C:\Documents and Settings\Patrick\Desktop\MBRCheck.exe
\\.\C: --> error 5
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000002a`df126200 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\I: --> \\.\PhysicalDrive2 at offset 0x00000000`00100000 (NTFS)
\\.\K: --> \\.\PhysicalDrive4 at offset 0x00000000`00007e00 (FAT32)
PhysicalDrive0 Model Number:
PhysicalDrive1 Model Number: HPExternal HDD, Rev: 1024
PhysicalDrive2 Model Number: WDMy Passport 0740, Rev: 1007
PhysicalDrive4 Model Number: WD1200BEVExternal, Rev: 1.02
Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 320B4BB7E26AFF40A97FBDF13347B08E2C55A6F 7
465 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: 6A37A193FEC4E5EEA53FC922E7D439AFEDE6B8D 2
931 GB \\.\PhysicalDrive2 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644 A
111 GB \\.\PhysicalDrive4 RE: Unknown MBR code
SHA1: 2BE9ACE700A45722604874D4A10E3B6A212931F 3
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice:
Done!
-
- Download OTLPENet.exe (http://'http://oldtimer.geekstogo.com/OTLPENet.exe') to your desktop
- Download Farbar Recovery Scan Tool (http://download.bleepingcomputer.com/farbar/FRST.exe) and save it to a flash drive.
- Ensure that you have a blank CD in the drive
- Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
- Reboot your system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://'http://www.hiren.info/pages/bios-boot-cdrom')
- As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads (http://forum.avast.com/Smileys/default/smiley.gif)
- Your system should now display a Reatogo desktop.
Note : as you are running from CD it is not exactly speedy
- Insert the flash drive with FRST on it
- Locate the flash drive and run FSRT
- The tool will start to run.
(http://i1224.photobucket.com/albums/ee362/Essexboy3/Farbar/FRST2.gif)
- When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
-
do you have another link for the OTLPENet.exe as the one above cannot be accessed
-
I downloaded OTLPENet.exe from another online resource and burnt the CD; the link to how to boot from the CD is dead and I made a guess and tried a few attempts only to get an error message "Forced network boot attempt failed, check cable and settings-strike F1 to retry boot, F2 for setup utility; I got nothing!
-
after much trial and error I was able to boot from the CD-ROM :P; but I doubt that I could return the system to the correct order without help;
ran the FSRT and here is the log file:
Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 25-08-2012
Ran by SYSTEM at 26-08-2012 17:44:31
Running from G:\
Microsoft Windows XP (X86) OS Language: English(US)
The current controlset is ControlSet003
========================== Registry (Whitelisted) =============
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [8491008 2007-09-17] (NVIDIA Corporation)
HKLM\...\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-07-06] (Intel Corporation)
HKLM\...\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE [122940 2005-09-08] (Sonic Solutions)
HKLM\...\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon [1983816 2009-07-26] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon [767312 2009-03-17] (CANON INC.)
HKLM\...\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s [2672600 2011-04-07] (PC Tools)
HKU\Administrator\...\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [20553 2005-08-15] (Trend Micro Inc.)
HKU\Administrator\...\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [395776 2006-08-28] (Gteko Ltd.)
HKU\Administrator\...\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [15360 2008-04-13] (Microsoft Corporation)
HKU\Administrator\...\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [1289000 2006-11-13] (Microsoft Corporation)
HKU\Administrator\...\Policies\system: [NoDispBackgroundPage] 1
HKU\Anna\...\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [20553 2005-08-15] (Trend Micro Inc.)
HKU\Anna\...\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [15360 2008-04-13] (Microsoft Corporation)
HKU\Anna\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
HKU\Anna\...\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [1289000 2006-11-13] (Microsoft Corporation)
HKU\Anna\...\Policies\system: [NoDispScrSavPage] 0
HKU\Anna\...\Policies\system: [NoDispCPL] 0
HKU\Anna\...\Policies\system: [NoDispBackgroundPage] 1
HKU\Default User\...\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [20553 2005-08-15] (Trend Micro Inc.)
HKU\Default User\...\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [395776 2006-08-28] (Gteko Ltd.)
HKU\Patrick\...\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [4777856 2012-07-27] (SUPERAntiSpyware.com)
HKU\Patrick\...\Run: [Autodesk] rundll32.exe "C:\Documents and Settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll",CreateInstance
HKU\Patrick\...\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [15360 2008-04-13] (Microsoft Corporation)
HKU\Patrick\...\Run: [govShell] C:\Documents and Settings\Patrick\govkhca.exe [157184 2012-08-12] (Teufel)
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62
Lsa: [Notification Packages]
scecli
HKLM\...\InprocServer32: [Default-wbem] \\.\globalroot\systemroot\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n. ATTENTION! ====> ZeroAccess
================================ Services (Whitelisted) ==================
2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE.EXE" [116608 2011-08-19] (SUPERAntiSpyware.com)
2 6to4; C:\WINDOWS\system32\6to4ex.dll [73748 2004-08-17] ()
2 AOL ACS; C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe [46640 2006-10-23] (AOL LLC)
2 Eventlog; C:\Windows\System32\services.exe [110592 2009-02-06] (Microsoft Corporation)
2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)
2 ioloSystemService; "C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe" [1027792 2012-08-02] (iolo technologies, LLC)
2 MSSQL$MICROSOFTSMLBIZ; "C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ [9158656 2008-12-18] (Microsoft Corporation)
3 MSSQLServerADHelper; "C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe" [73728 2005-05-03] (Microsoft Corporation)
2 PCToolsFirewallPlus; C:\Program Files\PC Tools Firewall Plus\FWService.exe [286000 2011-01-24] (PC Tools)
3 SQLAgent$MICROSOFTSMLBIZ; "C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ [323584 2005-05-03] (Microsoft Corporation)
2 syshost32; "C:\WINDOWS\Installer\{21AFBFB6-53EF-36C2-120C-7E9BF1C4C429}\syshost.exe" /service [347648 2012-08-16] (Kupa Kreative Tech)
2 WANMiniportService; "C:\WINDOWS\wanmpsvc.exe" [65536 2003-08-27] (America Online, Inc.)
4 HidServ; C:\Windows\System32\hidserv.dll
4 JavaQuickStarterService; "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"
========================== Drivers (Whitelisted) =============
0 9445fee0eea6d169; C:\Windows\System32\Drivers\9445fee0eea6d169.sys [70272 2012-08-12] () ATTENTION =====> Rootkit?
2 DLABOIOM; C:\Windows\System32\DLA\DLABOIOM.SYS [25628 2005-09-08] (Sonic Solutions)
1 DLACDBHM; C:\Windows\System32\Drivers\DLACDBHM.SYS [5628 2005-08-25] (Sonic Solutions)
2 DLADResN; C:\Windows\System32\DLA\DLADResN.SYS [2496 2005-09-08] (Sonic Solutions)
2 DLAIFS_M; C:\Windows\System32\DLA\DLAIFS_M.SYS [86524 2005-09-08] (Sonic Solutions)
2 DLAOPIOM; C:\Windows\System32\DLA\DLAOPIOM.SYS [14684 2005-09-08] (Sonic Solutions)
2 DLAPoolM; C:\Windows\System32\DLA\DLAPoolM.SYS [6364 2005-09-08] (Sonic Solutions)
1 DLARTL_N; C:\Windows\System32\Drivers\DLARTL_N.SYS [22684 2005-08-25] (Sonic Solutions)
2 DLAUDFAM; C:\Windows\System32\DLA\DLAUDFAM.SYS [94332 2005-09-08] (Sonic Solutions)
2 DLAUDF_M; C:\Windows\System32\DLA\DLAUDF_M.SYS [87036 2005-09-08] (Sonic Solutions)
2 DRVNDDM; C:\Windows\System32\Drivers\DRVNDDM.SYS [40544 2005-08-12] (Sonic Solutions)
3 DSproct; \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys [4864 2006-01-10] (GTek Technologies Ltd.)
3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [54144 2011-08-15] (Fengtao Software Inc.)
3 FileMonitor; \??\C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [246816 2012-01-05] (IObit)
3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
2 hnmwrlspkt; C:\Windows\System32\DRIVERS\hnm_wrls_pkt.sys [13824 2006-07-14] (SingleClick Systems)
3 NAL; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys [24064 2006-06-05] (Intel Corporation )
2 Packet; C:\Windows\System32\DRIVERS\packet.sys [11136 2006-10-15] (SingleClick Systems)
3 pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [47360 2011-07-02] (VSO Software)
2 PCTAppEvent; \??\C:\WINDOWS\system32\drivers\PCTAppEvent.sys [160576 2011-03-02] (PC Tools)
3 PCTFW-PacketFilter; \??\C:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys [89472 2011-01-12] (PC Tools)
1 pctgntdi; \??\C:\WINDOWS\system32\drivers\pctgntdi.sys [251560 2011-01-17] (PC Tools)
3 pctNDIS; C:\Windows\System32\DRIVERS\pctNdis.sys [57536 2010-07-08] (PC Tools)
3 pctplfw; \??\C:\WINDOWS\system32\drivers\pctplfw.sys [125248 2011-01-17] (PC Tools)
2 PDFsFilter; C:\Windows\System32\DRIVERS\PDFsFilter.sys [68464 2012-08-02] (Raxco Software, Inc.)
0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [43528 2009-09-25] (Sonic Solutions)
3 RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wxp_x86\regfilter.sys [30368 2011-09-20] (IObit.com)
1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-08-05] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
3 SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [12872 2010-04-03] ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [67664 2011-08-05] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
4 sptd; C:\Windows\System32\Drivers\sptd.sys [715248 2008-12-31] (Duplex Secure Ltd.)
3 STHDA; C:\Windows\System32\drivers\sthda.sys [1156648 2006-07-24] (SigmaTel, Inc.)
3 UrlFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wxp_x86\UrlFilter.sys [16208 2011-09-20] (IObit.com)
3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2003-01-10] (America Online, Inc.)
3 wceusbsh; C:\Windows\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
2 wsppkt; C:\Windows\System32\DRIVERS\wsp_pkt.sys [13696 2006-07-14] (SingleClick Systems)
4 Abiosdsk;
4 Atdisk;
0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys
3 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys
3 bvrp_pci;
3 catchme; \??\C:\DOCUME~1\Patrick\LOCALS~1\Temp\catchme.sys
3 CFcatchme; \??\C:\PCHelpForum\CFcatchme.sys
1 Changer;
3 cpuz132; \??\C:\DOCUME~1\Patrick\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys
1 lbrtfdc;
1 PCIDump;
3 PDCOMP;
3 PDFRAME;
3 PDRELI;
3 PDRFRAME;
4 Simbad;
3 VPROEVENTMONITOR; \??\C:\WINDOWS\system32\drivers\VProEventMonitor.sys
2 Vsapint; C:\Windows\System32\drivers\Vsapint.sys
3 WDICA;
========================== NetSvcs (Whitelisted) ===========
============ One Month Created Files and Folders ==============
2012-08-26 16:20 - 2012-08-26 16:20 - 127231689 ____A (Igor Pavlov) C:\Documents and Settings\Patrick\Desktop\OTLPENet.exe
2012-08-24 20:35 - 2012-08-24 20:36 - 00010142 ____A C:\Documents and Settings\Patrick\Desktop\MBRCheck_08.24.12_20.35.45.txt
2012-08-24 20:34 - 2012-08-24 20:34 - 00005623 ____A C:\Documents and Settings\Patrick\Desktop\RKreport[1].txt
2012-08-24 20:33 - 2012-08-24 20:34 - 01558528 ____A C:\Documents and Settings\Patrick\Desktop\RogueKiller.exe
2012-08-24 20:33 - 2012-08-24 20:34 - 00080384 ____A C:\Documents and Settings\Patrick\Desktop\MBRCheck.exe
2012-08-24 20:33 - 2012-08-24 20:34 - 00000000 ____D C:\Documents and Settings\Patrick\Desktop\RK_Quarantine
2012-08-24 12:11 - 2012-08-24 12:11 - 00000000 ____D C:\Documents and Settings\Patrick\Desktop\tdsskiller
2012-08-24 12:11 - 2012-08-24 09:06 - 04731392 ____A (AVAST Software) C:\Documents and Settings\Patrick\Desktop\aswMBR.exe
2012-08-24 12:11 - 2012-08-24 09:06 - 02193184 ____A C:\Documents and Settings\Patrick\Desktop\tdsskiller.zip
2012-08-19 19:05 - 2012-08-19 19:03 - 00324589 ____A C:\Documents and Settings\Patrick\Desktop\winxp-pro-32bit-sm-reset.exe
2012-08-19 18:50 - 2012-08-19 18:50 - 00003278 ____A C:\Windows\bitssetup.log
2012-08-19 18:46 - 2012-08-19 18:46 - 00007264 ____A C:\Documents and Settings\Patrick\Desktop\Rkill.txt
2012-08-19 18:46 - 2012-08-19 18:46 - 00000000 ____D C:\Documents and Settings\Patrick\Desktop\Dial-a-fix-v0.60.0.24
2012-08-19 16:23 - 2012-08-19 16:10 - 00335992 ____A C:\Documents and Settings\Patrick\Desktop\Dial-a-fix-v0.60.0.24.zip
2012-08-19 16:23 - 2012-08-19 16:09 - 01545120 ____A (Bleeping Computer, LLC) C:\Documents and Settings\Patrick\Desktop\rkill.exe
2012-08-19 16:22 - 2012-08-19 16:08 - 00399264 ____A (Bleeping Computer, LLC) C:\Documents and Settings\Patrick\Desktop\unhide.exe
2012-08-19 16:09 - 2012-08-19 16:09 - 00090112 ____A C:\Windows\Minidump\Mini081912-01.dmp
2012-08-18 08:03 - 2012-08-18 07:45 - 00607260 ____R (Swearware) C:\Documents and Settings\Patrick\Desktop\dds.exe
2012-08-18 08:00 - 2012-08-10 14:34 - 00607260 ___RA (Swearware) C:\Documents and Settings\Patrick\My Documents\dds.scr
2012-08-18 07:40 - 2012-08-18 07:40 - 00090112 ____A C:\Windows\Minidump\Mini081812-01.dmp
2012-08-17 17:31 - 2012-08-25 07:11 - 00052443 ____A C:\Documents and Settings\Patrick\govlog.dat
2012-08-12 21:27 - 2012-08-12 21:27 - 00070272 ____A C:\Windows\System32\Drivers\9445fee0eea6d169.sys
2012-08-12 21:26 - 2012-08-12 21:26 - 00157184 ____A (Teufel) C:\Documents and Settings\Patrick\govkhca.exe
2012-08-12 18:37 - 2012-08-12 18:37 - 00000000 ____D C:\Windows\System32\config\Original
2012-08-12 18:30 - 2012-08-12 18:30 - 00001689 ____A C:\Documents and Settings\Patrick\Desktop\System Mechanic.lnk
2012-08-12 18:30 - 2012-08-12 18:30 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\iolo
2012-08-12 18:30 - 2012-08-02 12:45 - 00040504 ____A (iolo technologies, LLC) C:\Windows\System32\iolobtdfg.exe
2012-08-12 18:30 - 2012-08-02 12:45 - 00022456 ____A (iolo technologies, LLC) C:\Windows\System32\smrgdf.exe
2012-08-12 18:30 - 2012-08-02 11:27 - 02096360 ____A (iolo technologies, LLC) C:\Windows\System32\Incinerator32.dll
2012-08-12 18:30 - 2012-08-02 11:21 - 00068464 ____A (Raxco Software, Inc.) C:\Windows\System32\Drivers\PDFsFilter.sys
2012-08-12 18:30 - 2012-08-02 11:21 - 00056200 ____A (Microsoft Corporation) C:\Windows\System32\offreg.dll
2012-08-12 18:26 - 2012-08-12 21:31 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\iolo
2012-08-12 18:26 - 2012-08-12 18:36 - 00000000 ____D C:\Documents and Settings\Patrick\Application Data\iolo
2012-08-12 18:26 - 2012-08-12 18:26 - 00074703 ____A C:\Windows\System32\mfc45.dat
2012-08-12 18:26 - 2012-08-12 18:26 - 00065536 ____A C:\Windows\System32\config\iolo App.evt
2012-08-12 18:20 - 2012-08-12 18:20 - 00074744 ____A C:\Windows\KB2699988-IE8.log
2012-08-12 18:19 - 2012-08-12 18:20 - 00078460 ____A C:\Windows\KB2618444-IE8.log
2012-08-12 18:19 - 2012-08-12 18:19 - 00070842 ____A C:\Windows\KB2598845-IE8.log
2012-08-12 18:18 - 2012-08-12 18:22 - 00006923 ____A C:\Windows\spupdsvc.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00033457 ____A C:\Windows\iis6.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00030798 ____A C:\Windows\FaxSetup.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00014780 ____A C:\Windows\ocgen.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00014105 ____A C:\Windows\tsoc.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00009474 ____A C:\Windows\msmqinst.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00006207 ____A C:\Windows\ntdtcsetup.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00005415 ____A C:\Windows\netfxocm.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00002125 ____A C:\Windows\MedCtrOC.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00001710 ____A C:\Windows\ocmsn.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00001555 ____A C:\Windows\tabletoc.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00001515 ____A C:\Windows\msgsocm.log
2012-08-12 18:18 - 2012-08-12 18:20 - 00001374 ____A C:\Windows\imsins.log
2012-08-12 18:18 - 2012-08-12 18:19 - 00091059 ____A C:\Windows\KB982381-IE8.log
2012-08-12 18:18 - 2012-08-12 18:18 - 00000000 ____A C:\Windows\setuperr.log
2012-08-12 18:18 - 2012-08-12 18:18 - 00000000 ____A C:\Windows\setupact.log
2012-08-12 18:17 - 2012-08-12 18:17 - 00000000 ___DC C:\Windows\ie8
2012-08-12 18:16 - 2012-08-12 18:18 - 00083130 ____A C:\Windows\ie8.log
2012-08-12 18:05 - 2012-08-12 18:20 - 00127300 ____A C:\Windows\ie8_main.log
2012-08-12 18:05 - 2012-08-12 18:20 - 00084347 ____A C:\Windows\updspapi.log
2012-08-12 18:05 - 2012-08-12 18:06 - 00045362 ____A C:\Windows\ie8Uninst.log
2012-08-12 16:35 - 2012-08-19 17:10 - 00003606 ____A C:\Documents and Settings\Patrick\Desktop\unhide.txt
2012-08-11 19:46 - 2012-08-11 19:46 - 00015410 ____A C:\ComboFix.txt
2012-08-11 18:38 - 2012-08-11 18:38 - 00000000 RASHD C:\cmdcons
2012-08-11 18:34 - 2012-08-11 19:47 - 00000000 ____D C:\PCHelpForum6050P
2012-08-11 18:22 - 2012-08-11 18:22 - 00109892 ____A C:\Documents and Settings\Patrick\Desktop\OTL.Txt
2012-08-11 18:22 - 2012-08-11 18:22 - 00048674 ____A C:\Documents and Settings\Patrick\Desktop\Extras.Txt
2012-08-11 18:16 - 2012-08-10 16:26 - 00596480 ____A (OldTimer Tools) C:\Documents and Settings\Patrick\Desktop\OTL.exe
2012-08-11 17:53 - 2012-08-11 17:53 - 00000495 ____A C:\Windows\nsw.log
2012-08-10 20:46 - 2012-08-10 20:46 - 00008192 ____A C:\Windows\System32\config\SECURITY.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\SYSTEM.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\SOFTWARE.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\SAM.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\DEFAULT.tmp.LOG
2012-08-10 19:45 - 2011-06-26 02:45 - 00256000 ____A C:\Windows\PEV.exe
2012-08-10 19:45 - 2010-11-07 13:20 - 00208896 ____A C:\Windows\MBR.exe
2012-08-10 19:45 - 2009-04-20 00:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-08-10 19:45 - 2000-08-30 20:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-08-10 19:45 - 2000-08-30 20:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-08-10 19:45 - 2000-08-30 20:00 - 00212480 ____A (SteelWerX) C:\Windows\SWXCACLS.exe
2012-08-10 19:45 - 2000-08-30 20:00 - 00098816 ____A C:\Windows\sed.exe
2012-08-10 19:45 - 2000-08-30 20:00 - 00080412 ____A C:\Windows\grep.exe
2012-08-10 19:45 - 2000-08-30 20:00 - 00068096 ____A C:\Windows\zip.exe
2012-08-10 19:43 - 2012-08-10 21:18 - 00000000 ____D C:\PCHelpForum
2012-08-10 19:20 - 2012-08-10 18:59 - 04728003 ____R (Swearware) C:\Documents and Settings\Patrick\Desktop\PCHelpForum.exe
2012-08-10 19:06 - 2012-08-10 19:43 - 00000000 ____D C:\ComboFix
2012-08-10 19:01 - 2012-08-11 19:46 - 00000000 ___AD C:\Qoobox
2012-08-10 18:54 - 2012-08-11 17:50 - 00000000 ____D C:\Documents and Settings\Patrick\Application Data\PCToolsFirewallPlus
2012-08-10 18:52 - 2012-08-10 18:52 - 00000000 ____D C:\Program Files\Common Files\PC Tools
2012-08-10 18:52 - 2011-03-02 12:40 - 00160576 ____A (PC Tools) C:\Windows\System32\Drivers\PCTAppEvent.sys
2012-08-10 18:52 - 2011-01-17 09:10 - 00251560 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi.sys
2012-08-10 18:52 - 2011-01-12 10:36 - 00089472 ____A (PC Tools) C:\Windows\System32\Drivers\pctNdis-PacketFilter.sys
2012-08-10 18:52 - 2010-07-08 08:49 - 00057536 ____A (PC Tools) C:\Windows\System32\Drivers\pctNdis.sys
2012-08-10 18:52 - 2010-03-29 11:06 - 00218592 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore.sys
2012-08-10 18:52 - 2010-02-05 08:26 - 00032808 ____A (PC Tools) C:\Windows\System32\Drivers\pctNdis-DNS.sys
2012-08-10 18:51 - 2012-08-13 00:24 - 00000000 ____D C:\Program Files\PC Tools Firewall Plus
2012-08-10 18:51 - 2011-01-17 08:11 - 00125248 ____A (PC Tools) C:\Windows\System32\Drivers\pctplfw.sys
2012-08-10 18:48 - 2012-08-10 18:48 - 00000088 ____A C:\Windows\System32\-1
2012-08-10 18:47 - 2012-08-10 18:47 - 00205072 ____A (Trend Micro Inc.) C:\Windows\System32\Drivers\tmcomm.sys
2012-08-10 18:22 - 2012-08-19 15:08 - 00032392 ____A C:\Windows\setupapi.log
2012-08-10 17:54 - 2012-08-26 16:24 - 00000339 ____A C:\Windows\wiadebug.log
2012-08-10 17:10 - 2012-08-10 18:52 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\PCToolsFirewallPlus
2012-08-10 17:07 - 2012-08-10 17:07 - 00012410 ____A C:\Documents and Settings\Administrator\Desktop\dds.txt
2012-08-10 16:31 - 2012-08-10 16:31 - 00129244 ____A C:\Documents and Settings\Administrator\Desktop\OTL.Txt
2012-08-10 16:31 - 2012-08-10 16:31 - 00046014 ____A C:\Documents and Settings\Administrator\Desktop\Extras.Txt
2012-08-10 16:24 - 2012-08-10 16:26 - 00596480 ____A (OldTimer Tools) C:\Documents and Settings\Administrator\Desktop\OTL.exe
2012-08-10 16:17 - 2012-08-10 16:18 - 02136664 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
2012-08-10 14:34 - 2012-08-10 14:34 - 00302592 ____A C:\Documents and Settings\Administrator\Desktop\k6rtwke4.exe
2012-08-10 14:33 - 2012-08-10 14:35 - 16373192 ____A (Microsoft Corporation) C:\Documents and Settings\Administrator\Desktop\Windows-KB890830-V4.10.exe
2012-08-10 14:33 - 2012-08-10 14:34 - 00607260 ____R (Swearware) C:\Documents and Settings\Administrator\Desktop\dds.scr
2012-08-10 14:33 - 2012-08-10 14:33 - 00050688 ____A (Atribune.org) C:\Documents and Settings\Administrator\Desktop\ATF-Cleaner.exe
2012-08-10 13:49 - 2012-08-10 13:49 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
2012-08-10 13:49 - 2012-08-10 13:49 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Mozilla
2012-08-10 13:30 - 2012-08-10 13:30 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Windows Search
2012-08-10 10:50 - 2012-08-10 10:50 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2012-08-10 10:50 - 2012-08-10 10:50 - 00000000 __SHD C:\Documents and Settings\Administrator\IETldCache
2012-08-10 10:49 - 2012-08-10 10:49 - 00383224 ____A C:\Windows\System32\FNTCACHE.DAT
2012-08-10 10:41 - 2012-08-26 16:24 - 00544987 ____A C:\Windows\WindowsUpdate.log
2012-08-05 20:53 - 2008-04-13 20:12 - 00146432 ____A (Microsoft Corporation) C:\Documents and Settings\Patrick\Desktop\regedit.exe
2012-08-05 16:58 - 2012-08-05 16:58 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Adobe
2012-08-05 16:32 - 2012-08-05 16:32 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Macromedia
2012-08-05 16:30 - 2012-08-05 16:30 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Adobe
2012-08-05 11:49 - 2012-08-05 11:49 - 00001635 ____A C:\Documents and Settings\Patrick\Desktop\DVD Decrypter.lnk
2012-08-05 11:49 - 2012-08-05 11:49 - 00000000 ____D C:\Program Files\DVD Decrypter
2012-07-29 17:20 - 1997-07-19 16:55 - 01347344 ____A (Microsoft Corporation) C:\Windows\System32\MSVBVM50.dll
2012-07-29 16:38 - 2012-07-29 16:38 - 20689176 ____A (Upperspace ) C:\Documents and Settings\Patrick\Desktop\Q_Landscape.exe
2012-07-29 16:30 - 2012-07-29 16:34 - 00000000 ____D C:\Documents and Settings\Patrick\Desktop\3
2012-07-29 13:51 - 2012-07-29 13:52 - 00000000 ____D C:\Documents and Settings\Patrick\Application Data\SmartDraw
============ 3 Months Modified Files ========================
2012-08-26 16:24 - 2012-08-10 17:54 - 00000339 ____A C:\Windows\wiadebug.log
2012-08-26 16:24 - 2012-08-10 10:41 - 00544987 ____A C:\Windows\WindowsUpdate.log
2012-08-26 16:24 - 2004-08-11 19:20 - 00032644 ____A C:\Windows\SchedLgU.Txt
2012-08-26 16:24 - 2004-08-11 19:20 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-08-26 16:20 - 2012-08-26 16:20 - 127231689 ____A (Igor Pavlov) C:\Documents and Settings\Patrick\Desktop\OTLPENet.exe
2012-08-26 12:19 - 2012-07-03 22:37 - 00002497 ____A C:\Documents and Settings\Patrick\Desktop\Microsoft Office Word 2003.lnk
2012-08-25 07:11 - 2012-08-17 17:31 - 00052443 ____A C:\Documents and Settings\Patrick\govlog.dat
2012-08-25 07:11 - 2006-12-24 14:51 - 00000062 __ASH C:\Documents and Settings\Patrick\Local Settings\desktop.ini
2012-08-25 07:11 - 2004-08-11 19:20 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2012-08-25 07:11 - 2004-08-11 19:20 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2012-08-25 07:11 - 2004-08-11 19:09 - 00000049 ____A C:\Windows\wiaservc.log
2012-08-25 07:11 - 2004-08-11 19:00 - 00002206 ____A C:\Windows\System32\wpa.dbl
2012-08-24 20:36 - 2012-08-24 20:35 - 00010142 ____A C:\Documents and Settings\Patrick\Desktop\MBRCheck_08.24.12_20.35.45.txt
2012-08-24 20:34 - 2012-08-24 20:34 - 00005623 ____A C:\Documents and Settings\Patrick\Desktop\RKreport[1].txt
2012-08-24 20:34 - 2012-08-24 20:33 - 01558528 ____A C:\Documents and Settings\Patrick\Desktop\RogueKiller.exe
2012-08-24 20:34 - 2012-08-24 20:33 - 00080384 ____A C:\Documents and Settings\Patrick\Desktop\MBRCheck.exe
2012-08-24 12:17 - 2004-08-11 19:20 - 00000178 __ASH C:\Documents and Settings\Administrator\ntuser.ini
2012-08-24 12:17 - 2004-08-11 19:20 - 00000062 __ASH C:\Documents and Settings\Administrator\Local Settings\desktop.ini
2012-08-24 09:06 - 2012-08-24 12:11 - 04731392 ____A (AVAST Software) C:\Documents and Settings\Patrick\Desktop\aswMBR.exe
2012-08-24 09:06 - 2012-08-24 12:11 - 02193184 ____A C:\Documents and Settings\Patrick\Desktop\tdsskiller.zip
2012-08-19 19:03 - 2012-08-19 19:05 - 00324589 ____A C:\Documents and Settings\Patrick\Desktop\winxp-pro-32bit-sm-reset.exe
2012-08-19 18:51 - 2010-10-03 08:31 - 00023392 ____A C:\Windows\System32\nscompat.tlb
2012-08-19 18:51 - 2010-10-03 08:31 - 00016832 ____A C:\Windows\System32\amcompat.tlb
2012-08-19 18:50 - 2012-08-19 18:50 - 00003278 ____A C:\Windows\bitssetup.log
2012-08-19 18:46 - 2012-08-19 18:46 - 00007264 ____A C:\Documents and Settings\Patrick\Desktop\Rkill.txt
2012-08-19 17:10 - 2012-08-12 16:35 - 00003606 ____A C:\Documents and Settings\Patrick\Desktop\unhide.txt
2012-08-19 16:10 - 2012-08-19 16:23 - 00335992 ____A C:\Documents and Settings\Patrick\Desktop\Dial-a-fix-v0.60.0.24.zip
2012-08-19 16:09 - 2012-08-19 16:23 - 01545120 ____A (Bleeping Computer, LLC) C:\Documents and Settings\Patrick\Desktop\rkill.exe
2012-08-19 16:09 - 2012-08-19 16:09 - 00090112 ____A C:\Windows\Minidump\Mini081912-01.dmp
2012-08-19 16:08 - 2012-08-19 16:22 - 00399264 ____A (Bleeping Computer, LLC) C:\Documents and Settings\Patrick\Desktop\unhide.exe
2012-08-19 15:08 - 2012-08-10 18:22 - 00032392 ____A C:\Windows\setupapi.log
2012-08-18 07:45 - 2012-08-18 08:03 - 00607260 ____R (Swearware) C:\Documents and Settings\Patrick\Desktop\dds.exe
2012-08-18 07:40 - 2012-08-18 07:40 - 00090112 ____A C:\Windows\Minidump\Mini081812-01.dmp
2012-08-12 21:27 - 2012-08-12 21:27 - 00070272 ____A C:\Windows\System32\Drivers\9445fee0eea6d169.sys
2012-08-12 21:26 - 2012-08-12 21:26 - 00157184 ____A (Teufel) C:\Documents and Settings\Patrick\govkhca.exe
2012-08-12 21:26 - 2010-05-01 07:32 - 00000664 ____A C:\Windows\System32\d3d9caps.dat
2012-08-12 21:05 - 2004-08-11 19:07 - 00631476 ____A C:\Windows\System32\PerfStringBackup.INI
2012-08-12 18:30 - 2012-08-12 18:30 - 00001689 ____A C:\Documents and Settings\Patrick\Desktop\System Mechanic.lnk
2012-08-12 18:26 - 2012-08-12 18:26 - 00074703 ____A C:\Windows\System32\mfc45.dat
2012-08-12 18:26 - 2012-08-12 18:26 - 00065536 ____A C:\Windows\System32\config\iolo App.evt
2012-08-12 18:22 - 2012-08-12 18:18 - 00006923 ____A C:\Windows\spupdsvc.log
2012-08-12 18:20 - 2012-08-12 18:20 - 00074744 ____A C:\Windows\KB2699988-IE8.log
2012-08-12 18:20 - 2012-08-12 18:19 - 00078460 ____A C:\Windows\KB2618444-IE8.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00033457 ____A C:\Windows\iis6.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00030798 ____A C:\Windows\FaxSetup.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00014780 ____A C:\Windows\ocgen.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00014105 ____A C:\Windows\tsoc.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00009474 ____A C:\Windows\msmqinst.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00006207 ____A C:\Windows\ntdtcsetup.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00005415 ____A C:\Windows\netfxocm.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00002125 ____A C:\Windows\MedCtrOC.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00001710 ____A C:\Windows\ocmsn.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00001555 ____A C:\Windows\tabletoc.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00001515 ____A C:\Windows\msgsocm.log
2012-08-12 18:20 - 2012-08-12 18:18 - 00001374 ____A C:\Windows\imsins.log
2012-08-12 18:20 - 2012-08-12 18:05 - 00127300 ____A C:\Windows\ie8_main.log
2012-08-12 18:20 - 2012-08-12 18:05 - 00084347 ____A C:\Windows\updspapi.log
2012-08-12 18:20 - 2006-12-24 14:51 - 00000278 ___SH C:\Documents and Settings\Patrick\ntuser.ini
2012-08-12 18:19 - 2012-08-12 18:19 - 00070842 ____A C:\Windows\KB2598845-IE8.log
2012-08-12 18:19 - 2012-08-12 18:18 - 00091059 ____A C:\Windows\KB982381-IE8.log
2012-08-12 18:18 - 2012-08-12 18:18 - 00000000 ____A C:\Windows\setuperr.log
2012-08-12 18:18 - 2012-08-12 18:18 - 00000000 ____A C:\Windows\setupact.log
2012-08-12 18:18 - 2012-08-12 18:16 - 00083130 ____A C:\Windows\ie8.log
2012-08-12 18:06 - 2012-08-12 18:05 - 00045362 ____A C:\Windows\ie8Uninst.log
2012-08-12 12:46 - 2004-08-11 19:13 - 00000749 ___RA C:\Windows\WindowsShell.Manifest
2012-08-12 12:46 - 2004-08-11 19:13 - 00000749 ___RA C:\Windows\System32\wuaucpl.cpl.manifest
2012-08-12 12:46 - 2004-08-11 19:13 - 00000749 ___RA C:\Windows\System32\sapi.cpl.manifest
2012-08-12 12:46 - 2004-08-11 19:13 - 00000749 ___RA C:\Windows\System32\nwc.cpl.manifest
2012-08-12 12:46 - 2004-08-11 19:13 - 00000749 ___RA C:\Windows\System32\ncpa.cpl.manifest
2012-08-12 12:46 - 2004-08-11 19:13 - 00000749 ___RA C:\Windows\System32\cdplayer.exe.manifest
2012-08-12 11:52 - 2006-12-28 16:50 - 00000062 __ASH C:\Documents and Settings\Anna\Local Settings\desktop.ini
2012-08-11 19:46 - 2012-08-11 19:46 - 00015410 ____A C:\ComboFix.txt
2012-08-11 19:29 - 2004-08-11 19:00 - 00000000 ____A C:\Windows\system.ini
2012-08-11 18:38 - 2004-08-11 19:00 - 00000327 ___SH C:\boot.ini
2012-08-11 18:22 - 2012-08-11 18:22 - 00109892 ____A C:\Documents and Settings\Patrick\Desktop\OTL.Txt
2012-08-11 18:22 - 2012-08-11 18:22 - 00048674 ____A C:\Documents and Settings\Patrick\Desktop\Extras.Txt
2012-08-11 17:53 - 2012-08-11 17:53 - 00000495 ____A C:\Windows\nsw.log
2012-08-10 20:46 - 2012-08-10 20:46 - 00008192 ____A C:\Windows\System32\config\SECURITY.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\SYSTEM.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\SOFTWARE.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\SAM.tmp.LOG
2012-08-10 20:46 - 2012-08-10 20:46 - 00000000 ____A C:\Windows\System32\config\DEFAULT.tmp.LOG
2012-08-10 18:59 - 2012-08-10 19:20 - 04728003 ____R (Swearware) C:\Documents and Settings\Patrick\Desktop\PCHelpForum.exe
2012-08-10 18:56 - 2004-08-11 19:20 - 00000178 ___SH C:\Documents and Settings\NetworkService\ntuser.ini
2012-08-10 18:56 - 2004-08-11 19:20 - 00000178 ___SH C:\Documents and Settings\LocalService\ntuser.ini
2012-08-10 18:48 - 2012-08-10 18:48 - 00000088 ____A C:\Windows\System32\-1
2012-08-10 18:47 - 2012-08-10 18:47 - 00205072 ____A (Trend Micro Inc.) C:\Windows\System32\Drivers\tmcomm.sys
2012-08-10 17:43 - 2004-08-11 19:00 - 00014336 ____A (Microsoft Corporation) C:\Windows\System32\svchost.exe
2012-08-10 17:07 - 2012-08-10 17:07 - 00012410 ____A C:\Documents and Settings\Administrator\Desktop\dds.txt
2012-08-10 16:31 - 2012-08-10 16:31 - 00129244 ____A C:\Documents and Settings\Administrator\Desktop\OTL.Txt
2012-08-10 16:31 - 2012-08-10 16:31 - 00046014 ____A C:\Documents and Settings\Administrator\Desktop\Extras.Txt
2012-08-10 16:26 - 2012-08-11 18:16 - 00596480 ____A (OldTimer Tools) C:\Documents and Settings\Patrick\Desktop\OTL.exe
2012-08-10 16:26 - 2012-08-10 16:24 - 00596480 ____A (OldTimer Tools) C:\Documents and Settings\Administrator\Desktop\OTL.exe
2012-08-10 16:18 - 2012-08-10 16:17 - 02136664 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
2012-08-10 14:35 - 2012-08-10 14:33 - 16373192 ____A (Microsoft Corporation) C:\Documents and Settings\Administrator\Desktop\Windows-KB890830-V4.10.exe
2012-08-10 14:34 - 2012-08-18 08:00 - 00607260 ___RA (Swearware) C:\Documents and Settings\Patrick\My Documents\dds.scr
2012-08-10 14:34 - 2012-08-10 14:34 - 00302592 ____A C:\Documents and Settings\Administrator\Desktop\k6rtwke4.exe
2012-08-10 14:34 - 2012-08-10 14:33 - 00607260 ____R (Swearware) C:\Documents and Settings\Administrator\Desktop\dds.scr
2012-08-10 14:33 - 2012-08-10 14:33 - 00050688 ____A (Atribune.org) C:\Documents and Settings\Administrator\Desktop\ATF-Cleaner.exe
2012-08-10 10:49 - 2012-08-10 10:49 - 00383224 ____A C:\Windows\System32\FNTCACHE.DAT
2012-08-05 16:34 - 2011-02-25 09:56 - 25740256 ____A (Microsoft Corporation) C:\Documents and Settings\Patrick\Desktop\wmp11-windowsxp-x86-enu.exe
2012-08-05 11:49 - 2012-08-05 11:49 - 00001635 ____A C:\Documents and Settings\Patrick\Desktop\DVD Decrypter.lnk
2012-08-05 11:39 - 2012-04-16 20:04 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-08-05 11:39 - 2011-05-14 16:03 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-08-03 09:49 - 2009-01-31 16:57 - 00000440 _RASH C:\Documents and Settings\Patrick\ntuser.pol
2012-08-03 08:37 - 2009-01-31 15:30 - 00000440 _RASH C:\Documents and Settings\Anna\ntuser.pol
2012-08-02 12:45 - 2012-08-12 18:30 - 00040504 ____A (iolo technologies, LLC) C:\Windows\System32\iolobtdfg.exe
2012-08-02 12:45 - 2012-08-12 18:30 - 00022456 ____A (iolo technologies, LLC) C:\Windows\System32\smrgdf.exe
2012-08-02 11:27 - 2012-08-12 18:30 - 02096360 ____A (iolo technologies, LLC) C:\Windows\System32\Incinerator32.dll
2012-08-02 11:21 - 2012-08-12 18:30 - 00068464 ____A (Raxco Software, Inc.) C:\Windows\System32\Drivers\PDFsFilter.sys
2012-08-02 11:21 - 2012-08-12 18:30 - 00056200 ____A (Microsoft Corporation) C:\Windows\System32\offreg.dll
2012-07-29 16:38 - 2012-07-29 16:38 - 20689176 ____A (Upperspace ) C:\Documents and Settings\Patrick\Desktop\Q_Landscape.exe
2012-07-15 18:35 - 2012-07-15 18:35 - 02135640 ____A (Kaspersky Lab ZAO) C:\Documents and Settings\All Users\Documents\tdsskiller.exe
2012-07-15 17:36 - 2012-07-15 17:36 - 00004450 ____A C:\Documents and Settings\Patrick\My Documents\startup.txt
2012-07-15 17:35 - 2012-07-15 17:35 - 00376744 ____A C:\Documents and Settings\Patrick\My Documents\cc_20120715_173529.reg
2012-07-14 12:30 - 2012-07-14 12:30 - 00027520 ____A C:\Documents and Settings\Patrick\Local Settings\Application Data\dt.dat
2012-07-06 17:03 - 2006-12-20 12:35 - 00112200 ____A C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2012-07-05 13:47 - 2012-07-05 13:47 - 00000728 ____A C:\Documents and Settings\Patrick\Desktop\DVDFab Profile Editor.lnk
2012-07-05 13:47 - 2012-07-05 13:47 - 00000691 ____A C:\Documents and Settings\Patrick\Desktop\DVDFab 8 Qt.lnk
2012-07-05 13:43 - 2012-07-05 13:43 - 00000749 ____A C:\Documents and Settings\Patrick\Desktop\DVDFab Passkey 8.lnk
2012-07-05 09:28 - 2004-08-11 19:00 - 00000289 ____A C:\Windows\win.ini
2012-07-05 09:20 - 2012-07-03 22:37 - 00002537 ____A C:\Documents and Settings\Patrick\Desktop\Microsoft Office Access 2003.lnk
2012-07-03 22:36 - 2012-07-03 22:22 - 00002495 ____A C:\Documents and Settings\Patrick\Desktop\Microsoft Office Excel 2003.lnk
2012-07-03 22:24 - 2006-12-20 12:31 - 00000376 ____A C:\Windows\ODBC.INI
2012-07-03 22:22 - 2012-07-03 22:37 - 00002016 ____A C:\Documents and Settings\Patrick\Desktop\Microsoft Office PowerPoint 2003.lnk
2012-07-03 03:13 - 2007-12-25 08:23 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-24 15:40 - 2012-06-24 15:40 - 00000000 ____A C:\Windows\mtstack16.INI
2012-06-16 19:05 - 2009-10-25 13:11 - 00019968 ____A C:\Documents and Settings\All Users\Documents\Assets.xls
2012-06-13 09:19 - 2008-10-15 22:50 - 01866112 ____N (Microsoft Corporation) C:\Windows\System32\dllcache\win32k.sys
2012-06-13 09:19 - 2004-08-11 19:00 - 01866112 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-09 18:41 - 2012-06-09 18:41 - 14415306 ____A C:\Documents and Settings\Patrick\Desktop\Dinosaur-Jr.-Freak-Scene.mp4
2012-06-08 10:26 - 2008-06-17 15:02 - 08462848 ____N (Microsoft Corporation) C:\Windows\System32\dllcache\shell32.dll
2012-06-08 10:26 - 2004-08-11 19:00 - 08462848 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-06-05 11:50 - 2008-08-17 14:02 - 01372672 ____N (Microsoft Corporation) C:\Windows\System32\dllcache\msxml6.dll
2012-06-05 11:50 - 2008-08-17 14:02 - 01372672 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-06-05 11:50 - 2006-09-13 01:01 - 01172480 ____N (Microsoft Corporation) C:\Windows\System32\dllcache\msxml3.dll
2012-06-05 11:50 - 2004-08-11 19:00 - 01172480 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-06-04 17:35 - 2009-08-06 19:23 - 00222448 ____A (Microsoft Corporation) C:\Windows\System32\muweb.dll
2012-06-04 00:32 - 2008-12-05 02:54 - 00152576 ____N (Microsoft Corporation) C:\Windows\System32\dllcache\schannel.dll
2012-06-04 00:32 - 2004-08-11 19:00 - 00152576 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-06-02 15:19 - 2007-06-21 21:57 - 00022040 ____A (Microsoft Corporation) C:\Windows\System32\wucltui.dll.mui
2012-06-02 15:19 - 2007-06-21 21:57 - 00017944 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll.mui
2012-06-02 15:19 - 2007-06-21 21:57 - 00015384 ____A (Microsoft Corporation) C:\Windows\System32\wuaucpl.cpl.mui
2012-06-02 15:19 - 2007-06-21 21:57 - 00015384 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll.mui
2012-06-02 15:19 - 2005-05-26 05:16 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wuaueng.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wuapi.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00329240 ____A (Microsoft Corporation) C:\Windows\System32\wucltui.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00329240 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wucltui.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00219160 ____A (Microsoft Corporation) C:\Windows\System32\wuaucpl.cpl
2012-06-02 15:19 - 2004-08-11 19:12 - 00219160 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wuaucpl.cpl
2012-06-02 15:19 - 2004-08-11 19:12 - 00210968 ____A (Microsoft Corporation) C:\Windows\System32\wuweb.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00210968 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wuweb.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 15:19 - 2004-08-11 19:12 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wuauclt.exe
2012-06-02 15:19 - 2004-08-11 19:12 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 15:19 - 2004-08-11 19:12 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\wups.dll
2012-06-02 15:19 - 2004-08-11 19:00 - 00097304 ____A (Microsoft Corporation) C:\Windows\System32\dllcache\cdm.dll
2012-06-02 15:19 - 2004-08-11 19:00 - 00097304 ____A (Microsoft Corporation) C:\Windows\System32\cdm.dll
2012-06-02 15:18 - 2010-05-11 11:20 - 00275696 ____A (Microsoft Corporation) C:\Windows\System32\mucltui.dll
2012-06-02 15:18 - 2010-05-11 11:20 - 00017136 ____A (Microsoft Corporation) C:\Windows\System32\mucltui.dll.mui
2012-05-31 09:22 - 2011-09-09 05:12 - 00599040 ____N (Microsoft Corporation) C:\Windows\System32\dllcache\crypt32.dll
2012-05-31 09:22 - 2004-08-11 19:00 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
ZeroAccess:
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L\00000004.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000004.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000008.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\000000cb.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000000.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000032.@
ZeroAccess:
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U
ZeroAccess:
C:\Windows\assembly\GAC\Desktop.ini
========================= Known DLLs (Whitelisted) ============
========================= Bamital & volsnap Check ============
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points (XP) =====================
RP: -> 2012-08-26 12:57 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP764
RP: -> 2012-08-25 12:14 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP763
RP: -> 2012-08-24 11:47 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP762
RP: -> 2012-08-23 10:47 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP761
RP: -> 2012-08-22 09:47 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP760
RP: -> 2012-08-21 08:47 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP759
RP: -> 2012-08-20 07:47 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP758
RP: -> 2012-08-19 07:05 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP757
RP: -> 2012-08-18 06:05 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP756
RP: -> 2012-08-17 05:30 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP755
RP: -> 2012-08-16 04:24 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP754
RP: -> 2012-08-15 03:42 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP753
RP: -> 2012-08-13 22:09 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP752
RP: -> 2012-08-12 21:02 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP751
RP: -> 2012-08-12 20:12 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP750
RP: -> 2012-08-12 18:18 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP749
RP: -> 2012-08-12 18:17 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP748
RP: -> 2012-08-04 20:28 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP746
RP: -> 2012-08-03 20:04 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP745
RP: -> 2012-08-02 19:26 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP744
RP: -> 2012-08-01 18:25 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP743
RP: -> 2012-07-31 18:20 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP742
RP: -> 2012-07-30 17:13 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP741
RP: -> 2012-07-29 16:45 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP740
RP: -> 2012-07-28 20:27 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP739
RP: -> 2012-07-27 20:04 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP738
RP: -> 2012-07-26 19:13 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP737
RP: -> 2012-07-25 18:13 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP736
RP: -> 2012-07-24 17:13 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP735
RP: -> 2012-07-23 16:44 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP734
RP: -> 2012-07-22 03:48 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP733
RP: -> 2012-07-21 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP732
RP: -> 2012-07-20 15:53 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP731
RP: -> 2012-07-16 19:43 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP730
RP: -> 2012-07-15 18:52 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP729
RP: -> 2012-07-14 20:17 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP728
RP: -> 2012-07-14 17:32 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP727
RP: -> 2012-07-14 15:17 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP726
RP: -> 2012-07-14 12:36 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP725
RP: -> 2012-07-14 11:19 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP724
RP: -> 2012-07-14 11:19 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP723
RP: -> 2012-07-13 18:16 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP722
RP: -> 2012-07-08 02:54 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP721
RP: -> 2012-07-07 16:06 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP720
RP: -> 2012-07-07 15:15 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP719
RP: -> 2012-07-07 13:24 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP718
RP: -> 2012-07-07 12:47 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP717
RP: -> 2012-07-07 10:44 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP716
RP: -> 2012-07-06 17:21 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP715
RP: -> 2012-07-06 15:36 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP714
RP: -> 2012-07-05 14:24 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP713
RP: -> 2012-07-05 13:45 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP712
RP: -> 2012-07-05 10:21 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP711
RP: -> 2012-07-05 09:05 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP710
RP: -> 2012-07-04 20:51 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP709
RP: -> 2012-07-04 17:50 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP708
RP: -> 2012-07-04 16:27 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP707
RP: -> 2012-07-04 13:21 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP706
RP: -> 2012-07-04 11:52 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP705
RP: -> 2012-07-04 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP704
RP: -> 2012-07-03 22:20 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP703
RP: -> 2012-07-03 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP702
RP: -> 2012-07-02 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP701
RP: -> 2012-07-01 21:03 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP700
RP: -> 2012-07-01 20:50 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP699
RP: -> 2012-07-01 18:44 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP698
RP: -> 2012-07-01 18:21 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP697
RP: -> 2012-07-01 17:10 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP696
RP: -> 2012-07-01 09:51 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP695
RP: -> 2012-07-01 09:17 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP694
RP: -> 2012-07-01 09:08 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP693
RP: -> 2012-07-01 09:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP692
RP: -> 2012-07-01 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP691
RP: -> 2012-06-30 13:51 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP690
RP: -> 2012-06-25 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP689
RP: -> 2012-06-24 17:45 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP688
RP: -> 2012-06-24 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP687
RP: -> 2012-06-23 08:38 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP686
RP: -> 2012-06-23 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP685
RP: -> 2012-06-22 22:45 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP684
RP: -> 2012-06-21 22:43 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP683
RP: -> 2012-06-21 21:40 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP682
RP: -> 2012-06-21 21:23 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP681
RP: -> 2012-06-14 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP680
RP: -> 2012-06-10 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP679
RP: -> 2012-06-09 19:37 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP678
RP: -> 2012-06-07 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP677
RP: -> 2012-06-04 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP676
RP: -> 2012-06-03 15:33 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP675
RP: -> 2012-06-03 14:41 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP674
RP: -> 2012-06-03 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP673
RP: -> 2012-06-02 06:54 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP672
RP: -> 2012-06-02 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP671
RP: -> 2012-06-01 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP670
RP: -> 2012-05-31 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP669
RP: -> 2012-05-30 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP668
RP: -> 2012-05-29 03:00 - 028672 _restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP667
===================== Memory info ==========================
Percentage of memory in use: 23%
Total physical RAM: 1021.85 MB
Available physical RAM: 777.55 MB
Total Pagefile: 905.54 MB
Available Pagefile: 841.31 MB
Total Virtual: 2047.88 MB
Available Virtual: 2002.18 MB
===================== Partitions ===========================
2 Drive b: (RAMDisk) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
3 Drive c: () (Fixed) (Total:171.43 GB) (Free:110.74 GB) NTFS ==>[Drive with boot components (Windows XP)]
4 Drive d: (HP SimpleSave) (Fixed) (Total:465.11 GB) (Free:265.42 GB) NTFS
5 Drive e: (My Passport) (Fixed) (Total:931.48 GB) (Free:539.2 GB) NTFS
6 Drive f: (Backup) (Fixed) (Total:57.63 GB) (Free:23 GB) NTFS
7 Drive g: (USB20FD) (Removable) (Total:7.53 GB) (Free:6.61 GB) FAT32
10 Drive x: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 233 GB 0 B
Disk 1 Online 465 GB 0 B
Disk 3 Online 931 GB 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 OEM 55 MB 32 KB
Partition 2 Primary 171 GB 55 MB
Partition 3 Extended 58 GB 171 GB
Partition 4 Logical 58 GB 171 GB
Partition 5 Unknown 3797 MB 229 GB
==================================================================================
Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 FAT Partition 55 MB Healthy
==================================================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 C NTFS Partition 171 GB Healthy
==================================================================================
Disk: 0
Partition 4
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 F Backup NTFS Partition 58 GB Healthy
==================================================================================
Disk: 0
Partition 5
Type : DB
Hidden: Yes
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 6 FAT32 Partition 3797 MB Healthy
==================================================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 465 GB 32 KB
==================================================================================
Disk: 1
Partition 1
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 7 D HP SimpleSa NTFS Partition 465 GB Healthy
==================================================================================
Partitions of Disk 3:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 931 GB 1024 KB
==================================================================================
Disk: 3
Partition 1
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 9 E My Passport NTFS Partition 931 GB Healthy
==================================================================================
======================= End Of Log ==========================
-
Good job in getting that scan to run. I apologize for the dead links. This is the first time I've used this tool and I didn't test it.
FRST Fixlist
Please run the following:
Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt
start
HKLM\...\InprocServer32: [Default-wbem] \\.\globalroot\systemroot\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n. ATTENTION! ====> ZeroAccess
0 9445fee0eea6d169; C:\Windows\System32\Drivers\9445fee0eea6d169.sys [70272 2012-08-12] () ATTENTION =====> Rootkit?
ZeroAccess:
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L\00000004.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000004.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000008.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\000000cb.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000000.@
C:\Windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000032.@
ZeroAccess:
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n
C:\Documents and Settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U
ZeroAccess:
C:\Windows\assembly\GAC\Desktop.ini
end
NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system
Now, please enter System Recovery Options then select Command Prompt.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
Now restart, let it boot normally and tell me how it went.
-
Notepad not available with Reatogo desktop
Did a cold reboot then received:
Error message: No boot device available- strike F1 to retry boot, F2 for setup utility
dead in the water here
-
tried to "reconfigure" the order in which it is booted....now able to get my desktop back; however how and/or where do I get "Now, please enter System Recovery Options then select Command Prompt.
"??
is this a new program that I have to download? can you tell me where I can find it?
-
sorry, tried everything including a Windows search for this System Recovery Options on my PC and it is not present. ???
I am out of town for five days that starts with my 9PM (EST) departure in which I will not have access to the infected PC.
sorry to leave you hanging on this one, but I will be offline until Friday PM. if this thread is closed then I will have to try it again or something else.
-
No problem. This is a new infection and I really want to put a licking on it. See you on Friday.
-
how and/or where do I get "Now, please enter System Recovery Options then select Command Prompt.
"??
-
Ok. Let's try to fix that problem. Please make sure that you install the Recovery Console when you run ComboFix below.
Download Combofix from any of the links below, and save it to your DESKTOP.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
To prevent your anti-virus application interfering with ComboFix we need to disable it. See here (http://www.pchelpforum.com/anti-virus/110194-how-disable-your-security-applications-4.html) for a tutorial regarding how to do so if you are unsure.
- Close any open windows and double click ComboFix.exe to run it.
You will see the following image:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_disclaimer_ENG.png)
Click I Agree to start the program.
ComboFix will then extract the necessary files and you will see this:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_extraction.png)
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7
It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
If you did not have it installed, you will see the prompt below. Choose YES.
(http://i424.photobucket.com/albums/pp322/digistar/RcAuto1.gif)
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
(http://i424.photobucket.com/albums/pp322/digistar/whatnext.png)
Click on Yes, to continue scanning for malware.
When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.
Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
-
combofix ran through it's routine and then nothing, no prompts, no scan, nothing
now what do i do??? ???
-
sorry, i guess that it is still running but about 10 minutes after i ran ComboFix I keep getting this error message :
"AVG Anti-Virus Free Edition 2012 is running"
I do not have this software on this PC!!!!!
-
Please us the AVG Removal tool below then try CF again.
AVG Antivirus - AVG Antivirus Remover utility (http://www.avg.com/download-tools)
-
reboot after combofix results in BSOD
-
Please try running CF in Safe mode.
-
ran AVG removal again (third time for this)
RUNDLL error message still present on reboot
Changed local time to GMT -3, instead of EDT (GMT -4); bloody *censored* :-X >:(
reran CF
CF error message: "ComboFix has detected AVG AntiVirus Free Edition 2012"
here is the log:
ComboFix 12-09-01.01 - Patrick 09/02/2012 21:30:23.10.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.567 [GMT -4:00]
Running from: c:\documents and settings\Patrick\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: PC Tools Firewall Plus *Enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Installer\{21AFBFB6-53EF-36C2-120C-7E9BF1C4C429}\syshost.exe
.
---- Previous Run -------
.
c:\documents and settings\Patrick\govkhca.exe
c:\documents and settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@
c:\documents and settings\Patrick\Local Settings\Application Data\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n
c:\windows\assembly\GAC\Desktop.ini
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\@
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\L\00000004.@
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\n
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000004.@
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\00000008.@
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\000000cb.@
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000000.@
c:\windows\Installer\{9cf427f7-c6f7-dc16-f24c-8f732255a696}\U\80000032.@
c:\windows\system32\6to4ex.dll
c:\windows\system32\drivers\9445fee0eea6d169.sys
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_6TO4
-------\Legacy_SYSHOST32
-------\Service_6to4
-------\Service_syshost32
-------\Legacy_9445fee0eea6d169
-------\Service_9445fee0eea6d169
.
.
((((((((((((((((((((((((( Files Created from 2012-08-03 to 2012-09-03 )))))))))))))))))))))))))))))))
.
.
2012-09-03 01:04 . 2012-09-03 01:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2012-08-26 21:44 . 2012-08-26 21:44 -------- d-----w- C:\FRST
2012-08-19 22:50 . 2012-09-03 01:08 -------- d-----w- c:\windows\system32\CatRoot2
2012-08-12 22:30 . 2012-08-12 22:30 -------- d-----w- c:\documents and settings\LocalService\Application Data\iolo
2012-08-12 22:30 . 2012-08-02 15:21 511328 ----a-w- c:\program files\Common Files\Microsoft Shared\CAPICOM\CAPICOM.DLL
2012-08-12 22:30 . 2012-08-02 15:27 2096360 ----a-w- c:\windows\system32\Incinerator32.dll
2012-08-12 22:30 . 2012-08-02 16:45 40504 ----a-w- c:\windows\system32\iolobtdfg.exe
2012-08-12 22:30 . 2012-08-02 16:45 22456 ----a-w- c:\windows\system32\smrgdf.exe
2012-08-12 22:30 . 2012-08-02 15:21 68464 ----a-w- c:\windows\system32\drivers\PDFsFilter.sys
2012-08-12 22:30 . 2012-08-02 15:21 56200 ----a-w- c:\windows\system32\offreg.dll
2012-08-12 22:26 . 2012-08-13 01:31 -------- d-----w- c:\documents and settings\All Users\Application Data\iolo
2012-08-12 22:26 . 2012-08-12 22:36 -------- d-----w- c:\documents and settings\Patrick\Application Data\iolo
2012-08-12 22:26 . 2012-08-12 22:26 74703 ----a-w- c:\windows\system32\mfc45.dat
2012-08-12 22:17 . 2012-08-12 22:17 -------- dc----w- c:\windows\ie8
2012-08-10 23:43 . 2012-08-11 01:18 -------- d-----w- C:\PCHelpForum
2012-08-10 22:54 . 2012-08-11 21:50 -------- d-----w- c:\documents and settings\Patrick\Application Data\PCToolsFirewallPlus
2012-08-10 22:52 . 2011-03-02 16:40 160576 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2012-08-10 22:52 . 2010-03-29 15:06 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2012-08-10 22:52 . 2011-01-17 13:10 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2012-08-10 22:52 . 2012-08-10 22:52 -------- d-----w- c:\program files\Common Files\PC Tools
2012-08-10 22:52 . 2011-01-12 14:36 89472 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys
2012-08-10 22:52 . 2010-07-08 12:49 57536 ----a-w- c:\windows\system32\drivers\pctNdis.sys
2012-08-10 22:52 . 2010-02-05 12:26 32808 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys
2012-08-10 22:51 . 2011-01-17 12:11 125248 ----a-w- c:\windows\system32\drivers\pctplfw.sys
2012-08-10 22:51 . 2012-08-13 04:24 -------- d-----w- c:\program files\PC Tools Firewall Plus
2012-08-10 22:47 . 2012-08-10 22:47 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-08-10 21:10 . 2012-08-10 22:52 -------- d-----w- c:\documents and settings\Administrator\Application Data\PCToolsFirewallPlus
2012-08-10 17:49 . 2012-08-10 17:49 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2012-08-10 17:30 . 2012-08-10 17:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2012-08-10 14:50 . 2012-08-10 14:50 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2012-08-10 14:50 . 2012-08-10 14:50 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2012-08-05 15:49 . 2012-08-05 15:49 -------- d-----w- c:\program files\DVD Decrypter
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-10 21:43 . 2004-08-11 23:00 14336 ----a-w- c:\windows\system32\svchost.exe
2012-08-05 15:39 . 2012-04-17 00:04 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-05 15:39 . 2011-05-14 20:03 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-13 13:19 . 2004-08-11 23:00 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2008-08-17 18:02 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-11 23:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-07-29 13:39 . 2012-02-12 23:34 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
1997-06-23 17:06 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-27 4777856]
"Autodesk"="c:\documents and settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-26 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-17 767312]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Autodesk"="c:\documents and settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll" [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-05 113024]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-04-03 22:43 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-phishing Domain Advisor]
2011-07-29 20:45 217256 ----a-w- c:\documents and settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 12:50 71216 ----a-w- c:\program files\Common Files\AOL\ACS\AOLDial.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDFab Passkey]
2012-06-28 18:51 1389088 ----a-w- c:\program files\DVDFab Passkey\DVDFabPasskey.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 17:39 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-26 00:52 50736 ----a-w- c:\program files\Common Files\AOL\1172251831\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [8/10/2012 6:52 PM 251560]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [11/17/2008 3:11 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/17/2008 3:11 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [7/11/2010 7:03 PM 116608]
R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [7/14/2006 3:01 AM 13824]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [4/7/2012 6:27 PM 821592]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 5:53 PM 13672]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [8/12/2012 6:30 PM 1027792]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [8/10/2012 6:52 PM 160576]
R2 PDFsFilter;PDFsFilter;c:\windows\system32\drivers\PDFsFilter.sys [8/12/2012 6:30 PM 68464]
R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [7/14/2006 3:02 AM 13696]
R3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys [7/5/2012 1:44 PM 54144]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [8/15/2010 8:55 AM 47360]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [8/10/2012 6:52 PM 89472]
R3 pctNDIS;PC Tools Firewall Intermediate Filter Service;c:\windows\system32\drivers\pctNdis.sys [8/10/2012 6:52 PM 57536]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [8/10/2012 6:51 PM 125248]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys --> c:\windows\system32\DRIVERS\avgidshx.sys [?]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys --> c:\windows\system32\DRIVERS\avgidsshimx.sys [?]
S3 CFcatchme;CFcatchme;\??\c:\combofix\CFcatchme.sys --> c:\combofix\CFcatchme.sys [?]
S3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [4/7/2012 6:27 PM 246816]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/5/2012 5:37 AM 113120]
S3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [4/7/2012 6:27 PM 30368]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/17/2008 3:11 PM 12872]
S3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [4/7/2012 6:27 PM 16208]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/31/2008 8:57 PM 715248]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\documents and settings\Patrick\Application Data\Mozilla\Firefox\Profiles\khir2fy2.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.type - 0
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)
HKCU-Run-govShell - c:\documents and settings\Patrick\govkhca.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-02 22:08
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1396)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-09-02 22:31:15
ComboFix-quarantined-files.txt 2012-09-03 02:30
ComboFix2.txt 2012-08-11 23:46
ComboFix3.txt 2012-08-11 01:17
ComboFix4.txt 2010-04-25 02:03
.
Pre-Run: 119,937,191,936 bytes free
Post-Run: 119,915,249,664 bytes free
.
- - End Of File - - 0BE5D27752058E14782DE24AC8EA5851
-
thanks for sticking with e through this mess
loggen in as Administrator in Safe Mode
ran AVG removal again
reran CF
CF error message: "ComboFix has detected AVG AntiVirus Free Edition 2012"
here is the log:
ComboFix 12-09-01.01 - Administrator 09/02/2012 23:13:04.11.2 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.725 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: PC Tools Firewall Plus *Enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
.
.
((((((((((((((((((((((((( Files Created from 2012-08-03 to 2012-09-03 )))))))))))))))))))))))))))))))
.
.
2012-09-03 03:20 . 2012-09-03 03:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\iolo
2012-09-03 02:55 . 2012-09-03 02:55 -------- d-----w- c:\documents and settings\NetworkService\Application Data\iolo
2012-08-26 21:44 . 2012-08-26 21:44 -------- d-----w- C:\FRST
2012-08-19 22:50 . 2012-09-03 03:08 -------- d-----w- c:\windows\system32\CatRoot2
2012-08-12 22:30 . 2012-08-02 15:21 511328 ----a-w- c:\program files\Common Files\Microsoft Shared\CAPICOM\CAPICOM.DLL
2012-08-12 22:30 . 2012-08-02 15:27 2096360 ----a-w- c:\windows\system32\Incinerator32.dll
2012-08-12 22:30 . 2012-08-02 16:45 40504 ----a-w- c:\windows\system32\iolobtdfg.exe
2012-08-12 22:30 . 2012-08-02 16:45 22456 ----a-w- c:\windows\system32\smrgdf.exe
2012-08-12 22:30 . 2012-08-02 15:21 68464 ----a-w- c:\windows\system32\drivers\PDFsFilter.sys
2012-08-12 22:30 . 2012-08-02 15:21 56200 ----a-w- c:\windows\system32\offreg.dll
2012-08-12 22:26 . 2012-08-13 01:31 -------- d-----w- c:\documents and settings\All Users\Application Data\iolo
2012-08-12 22:26 . 2012-08-12 22:36 -------- d-----w- c:\documents and settings\Patrick\Application Data\iolo
2012-08-12 22:26 . 2012-08-12 22:26 74703 ----a-w- c:\windows\system32\mfc45.dat
2012-08-12 22:17 . 2012-08-12 22:17 -------- dc----w- c:\windows\ie8
2012-08-10 23:43 . 2012-08-11 01:18 -------- d-----w- C:\PCHelpForum
2012-08-10 22:54 . 2012-08-11 21:50 -------- d-----w- c:\documents and settings\Patrick\Application Data\PCToolsFirewallPlus
2012-08-10 22:52 . 2011-03-02 16:40 160576 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2012-08-10 22:52 . 2010-03-29 15:06 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2012-08-10 22:52 . 2011-01-17 13:10 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2012-08-10 22:52 . 2012-08-10 22:52 -------- d-----w- c:\program files\Common Files\PC Tools
2012-08-10 22:52 . 2011-01-12 14:36 89472 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys
2012-08-10 22:52 . 2010-07-08 12:49 57536 ----a-w- c:\windows\system32\drivers\pctNdis.sys
2012-08-10 22:52 . 2010-02-05 12:26 32808 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys
2012-08-10 22:51 . 2011-01-17 12:11 125248 ----a-w- c:\windows\system32\drivers\pctplfw.sys
2012-08-10 22:51 . 2012-08-13 04:24 -------- d-----w- c:\program files\PC Tools Firewall Plus
2012-08-10 22:47 . 2012-08-10 22:47 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-08-10 21:10 . 2012-08-10 22:52 -------- d-----w- c:\documents and settings\Administrator\Application Data\PCToolsFirewallPlus
2012-08-10 17:49 . 2012-08-10 17:49 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2012-08-10 17:30 . 2012-08-10 17:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2012-08-10 14:50 . 2012-08-10 14:50 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2012-08-10 14:50 . 2012-08-10 14:50 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2012-08-05 15:49 . 2012-08-05 15:49 -------- d-----w- c:\program files\DVD Decrypter
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-10 21:43 . 2004-08-11 23:00 14336 ----a-w- c:\windows\system32\svchost.exe
2012-08-05 15:39 . 2012-04-17 00:04 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-05 15:39 . 2011-05-14 20:03 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-13 13:19 . 2004-08-11 23:00 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2008-08-17 18:02 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-11 23:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-07-29 13:39 . 2012-02-12 23:34 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
1997-06-23 17:06 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="c:\program files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2005-08-15 20553]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-26 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-17 767312]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2011-04-07 2672600]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Autodesk"="c:\documents and settings\Patrick\Local Settings\Application Data\Collectorz.com\Autodesk\kzaayba.dll" [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-05 113024]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-04-03 22:43 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-phishing Domain Advisor]
2011-07-29 20:45 217256 ----a-w- c:\documents and settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 12:50 71216 ----a-w- c:\program files\Common Files\AOL\ACS\AOLDial.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDFab Passkey]
2012-06-28 18:51 1389088 ----a-w- c:\program files\DVDFab Passkey\DVDFabPasskey.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 17:39 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-26 00:52 50736 ----a-w- c:\program files\Common Files\AOL\1172251831\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [7/11/2010 7:03 PM 116608]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [4/7/2012 6:27 PM 821592]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [8/12/2012 6:30 PM 1027792]
R3 dvdfab;dvdfab;c:\windows\system32\drivers\dvdfab.sys [7/5/2012 1:44 PM 54144]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys --> c:\windows\system32\DRIVERS\avgidshx.sys [?]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [8/10/2012 6:52 PM 251560]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [11/17/2008 3:11 PM 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/17/2008 3:11 PM 67664]
S2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [7/14/2006 3:01 AM 13824]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 5:53 PM 13672]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [8/10/2012 6:52 PM 160576]
S2 PDFsFilter;PDFsFilter;c:\windows\system32\drivers\PDFsFilter.sys [8/12/2012 6:30 PM 68464]
S2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [7/14/2006 3:02 AM 13696]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys --> c:\windows\system32\DRIVERS\avgidsshimx.sys [?]
S3 CFcatchme;CFcatchme;\??\c:\combofix\CFcatchme.sys --> c:\combofix\CFcatchme.sys [?]
S3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [4/7/2012 6:27 PM 246816]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/5/2012 5:37 AM 113120]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [8/15/2010 8:55 AM 47360]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [8/10/2012 6:52 PM 89472]
S3 pctNDIS;PC Tools Firewall Intermediate Filter Service;c:\windows\system32\drivers\pctNdis.sys [8/10/2012 6:52 PM 57536]
S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [8/10/2012 6:51 PM 125248]
S3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [4/7/2012 6:27 PM 30368]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/17/2008 3:11 PM 12872]
S3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [4/7/2012 6:27 PM 16208]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/31/2008 8:57 PM 715248]
.
.
------- Supplementary Scan -------
.
uStart Page = www.msn.com
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tfpwaynx.default\
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-02 23:44
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2796421550-788906634-1267632633-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5 977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,39,92,62,f9,83,a0,c5,46,a8,5a,a9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839 E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,39,92,62,f9,83,a0,c5,46,a8,5a,a9,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(304)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\l3codeca.acm
.
- - - - - - - > 'explorer.exe'(1244)
c:\windows\system32\WININET.dll
c:\windows\system32\AcSignIcon.dll
.
Completion time: 2012-09-03 00:02:20
ComboFix-quarantined-files.txt 2012-09-03 04:01
ComboFix2.txt 2012-09-03 02:31
ComboFix3.txt 2012-08-11 23:46
ComboFix4.txt 2012-08-11 01:17
ComboFix5.txt 2012-09-03 03:04
.
Pre-Run: 121,009,709,056 bytes free
Post-Run: 120,988,876,800 bytes free
.
- - End Of File - - 1D82410EDBB2FBBC05A11D08574283C1
-
According to the CF log, AVG is the only AV you have on your computer. Do you want to get rid of it?
Download Security Check by screen317 from one of the following links and save it to your desktop.
Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)
* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.
Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
*****************************************************
SysProt Antirootkit
Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).
http://sites.google.com/site/sysprotantirootkit/ (http://sites.google.com/site/sysprotantirootkit/)
Unzip it into a folder on your desktop.
- Double click Sysprot.exe to start the program.
- Click on the Log tab.
- In the Write to log box select the following items.
- Process << Selected
- Kernel Modules << Selected
- SSDT << Selected
- Kernel Hooks << Selected
- IRP Hooks << NOT Selected
- Ports << NOT Selected
- Hidden Files << Selected
- At the bottom of the page
- Hidden Objects Only << Selected
- Click on the Create Log button on the bottom right.
- After a few seconds a new window should appear.
- Select Scan Root Drive. Click on the Start button.
- When it is complete a new window will appear to indicate that the scan is finished.
- The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.
-
FYI: USB flashdrive still cannot be ejected "safely"
FYI: the security check file saved as exe extension and would not run on the desktop. I renamed it to *.bat to enable it
No checkup.txt created on PC
Antirootkit log pasted below:
SysProt AntiRootkit v1.0.1.0
by swatkat
******************************************************************************************
******************************************************************************************
No Hidden Processes found
******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_iaStor.sys
Service Name: ---
Module Base: EBD57000
Module End: EBE0E000
Hidden: Yes
******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwTerminateProcess
Address: EDFEF640
Driver Base: EDFE5000
Driver End: EE007000
Driver Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
******************************************************************************************
******************************************************************************************
No Kernel Hooks found
******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\3baa40c85193c289d25516fa\1025\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1025\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1028\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1028\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1029\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1029\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1030\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1030\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1031\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1031\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1032\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1032\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1033\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1033\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1035\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1035\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1036\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1036\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1037\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1037\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1038\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1038\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1040\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1040\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1041\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1041\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1042\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1042\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1043\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1043\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1044\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1044\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1045\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1045\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1046\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1046\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1049\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1049\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1053\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1053\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1055\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\1055\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\2052\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\2052\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\2070\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\2070\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\3076\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\3076\HotFixInstallerUI.dll
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\3082\eula.rtf
Status: Access denied
Object: C:\3baa40c85193c289d25516fa\3082\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1025\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1025\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1028\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1028\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1029\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1029\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1030\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1030\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1031\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1031\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1032\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1032\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1033\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1033\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1035\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1035\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1036\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1036\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1037\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1037\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1038\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1038\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1040\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1040\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1041\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1041\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1042\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1042\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1043\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1043\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1044\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1044\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1045\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1045\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1046\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1046\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1049\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1049\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1053\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1053\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1055\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\1055\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\2052\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\2052\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\2070\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\2070\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\3076\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\3076\HotFixInstallerUI.dll
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\3082\eula.rtf
Status: Access denied
Object: C:\ad55f1e90f161b8a6b9f9d3b96cf\3082\HotFixInstallerUI.dll
Status: Access denied
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied
Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied
-
I'd like to scan your machine with ESET OnlineScan
•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan (http://eset.com/onlinescan)
•Click the (http://i424.photobucket.com/albums/pp322/digistar/esetOnline.png) button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on (http://i424.photobucket.com/albums/pp322/digistar/esetSmartInstall.png) to download the ESET Smart Installer. Save it to your desktop.
- Double click on the (http://i424.photobucket.com/albums/pp322/digistar/esetSmartInstallDesktopIcon-1.png) icon on your desktop.
•Check (http://i424.photobucket.com/albums/pp322/digistar/esetAcceptTerms.png)
•Click the (http://i424.photobucket.com/albums/pp322/digistar/esetStart.png) button.
•Accept any security warnings from your browser.
•Check (http://i424.photobucket.com/albums/pp322/digistar/esetScanArchives.png)
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push (http://i424.photobucket.com/albums/pp322/digistar/esetListThreats.png)
•Push (http://i424.photobucket.com/albums/pp322/digistar/esetExport.png), and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the (http://i424.photobucket.com/albums/pp322/digistar/esetBack.png) button.
•Push (http://i424.photobucket.com/albums/pp322/digistar/esetFinish.png)
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
-
I am sorry but since the PC will not connect to the internet I cannot run an online scan
I receive an error message "no connection to the internet is currently available." work offline is the only option
Do I have to wipe this PC "clean" and start from scratch?
I reran Security Check 317 and here is the log:
Results of screen317's Security Check version 0.99.50
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Disabled!
AVG Anti-Virus Free Edition 2012
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````[/u]
SpywareBlaster 4.4
SUPERAntiSpyware Free Edition
CCleaner
Java(TM) 6 Update 29
Java version out of Date!
Adobe Flash Player 11.3.300.270
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (14.0.1)
````````Process Check: objlist.exe by Laurent````````[/u]
IObit IObit Malware Fighter IMFsrv.exe
PC Tools Firewall Plus FWService.exe
PC Tools Firewall Plus FirewallGUI.exe
iolo Common Lib ioloServiceManager.exe
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C:: 24% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````[/u]
-
I am sorry but since the PC will not connect to the internet I cannot run an online scan
I receive an error message "no connection to the internet is currently available." work offline is the only option
Do I have to wipe this PC "clean" and start from scratch?
Let's see if we can fix the connectin problem.
Please download MiniToolBox (http://download.bleepingcomputer.com/farbar/MiniToolBox.exe) to Desktop and run it.
(http://i424.photobucket.com/albums/pp322/digistar/MiniToolBox.png)
Checkmark the following boxes:
- Flush DNS
- Report IE Proxy Settings
- Reset IE Proxy Settings
- List content of Hosts
- List IP Configuration
- Lst Last 10 Event Viewer Errors
- List Users, Partitions and Memory Size
[/b]
Click Go and copy/paste the log (Result.txt) into your next post.
**************************************************************
Please download Farbar Service Scanner (http://download.bleepingcomputer.com/farbar/FSS.exe) and run it on the computer with the issue.
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
*******************************************************
Total Fragmentation on Drive C:: 24% Defragment your hard drive soon! (Do NOT defrag if SSD!)
Please take time to defrag your harddrive.
-
how do I "defrag"?
here is the minitoolbox log:
MiniToolBox by Farbar Version: 23-07-2012
Ran by Patrick (administrator) on 04-09-2012 at 19:29:46
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************
========================= Flush DNS: ===================================
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========================= IE Proxy Settings: ==============================
Proxy is not enabled.
No Proxy Server is set.
"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================
127.0.0.1 localhost
========================= IP Configuration: ================================
Intel(R) 82566DC Gigabit Network Connection = Local Area Connection (Media disconnected)
# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip
# Interface IP Configuration for "Local Area Connection"
set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp
popd
# End of interface IP configuration
Windows IP Configuration
Host Name . . . . . . . . . . . . : FamilyRoom
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Intel(R) 82566DC Gigabit Network Connection
Physical Address. . . . . . . . . : 00-19-D1-1A-C7-71
Server: UnKnown
Address: 127.0.0.1
Ping request could not find host google.com. Please check the name and try again.
Server: UnKnown
Address: 127.0.0.1
Ping request could not find host yahoo.com. Please check the name and try again.
Server: UnKnown
Address: 127.0.0.1
Ping request could not find host bleepingcomputer.com. Please check the name and try again.
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 19 d1 1a c7 71 ...... Intel(R) 82566DC Gigabit Network Connection - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
255.255.255.255 255.255.255.255 255.255.255.255 2 1
===========================================================================
Persistent Routes:
None
========================= Event log errors: ===============================
Application errors:
==================
Error: (09/03/2012 07:59:11 PM) (Source: Application Hang) (User: )
Description: Hanging application SysProt.exe, version 1.0.1.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (09/03/2012 10:08:05 AM) (Source: MsiInstaller) (User: FAMILYROOM)FAMILYROOM
Description: Product: Microsoft Office Professional 2007 -- Error 1706.Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see SETUP.CHM.(NULL)(NULL)(NULL)(NULL)
Error: (09/01/2012 08:28:00 AM) (Source: WinMgmt) (User: )
Description: WinMgmt could not initialize the core parts. This could be due to a badly installed version of WinMgmt, WinMgmt repository upgrade failure, insufficient disk space or insufficient memory.
Error: (08/28/2012 00:56:36 AM) (Source: WinMgmt) (User: )
Description: WinMgmt could not initialize the core parts. This could be due to a badly installed version of WinMgmt, WinMgmt repository upgrade failure, insufficient disk space or insufficient memory.
Error: (08/26/2012 09:40:27 PM) (Source: WinMgmt) (User: )
Description: WinMgmt could not initialize the core parts. This could be due to a badly installed version of WinMgmt, WinMgmt repository upgrade failure, insufficient disk space or insufficient memory.
Error: (08/26/2012 00:36:41 PM) (Source: MsiInstaller) (User: FAMILYROOM)FAMILYROOM
Description: Product: Microsoft Office Professional 2007 -- Error 1706.Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see SETUP.CHM.(NULL)(NULL)(NULL)(NULL)
Error: (08/26/2012 00:36:12 PM) (Source: Application Hang) (User: )
Description: Hanging application WINWORD.EXE, version 11.0.8345.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (08/26/2012 00:35:44 PM) (Source: MsiInstaller) (User: FAMILYROOM)FAMILYROOM
Description: Product: Microsoft Office Professional 2007 -- Error 1706.Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see SETUP.CHM.(NULL)(NULL)(NULL)(NULL)
Error: (08/26/2012 00:24:31 PM) (Source: MsiInstaller) (User: FAMILYROOM)FAMILYROOM
Description: Product: Microsoft Office Professional 2007 -- Error 1706.Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see SETUP.CHM.(NULL)(NULL)(NULL)(NULL)
Error: (08/25/2012 07:11:09 AM) (Source: WinMgmt) (User: )
Description: WinMgmt could not initialize the core parts. This could be due to a badly installed version of WinMgmt, WinMgmt repository upgrade failure, insufficient disk space or insufficient memory.
System errors:
=============
Error: (09/04/2012 03:19:03 PM) (Source: Service Control Manager) (User: )
Description: The crd service failed to start due to the following error:
%%1053
Error: (09/04/2012 03:19:03 PM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 milliseconds) waiting for the crd service to connect.
Error: (09/03/2012 09:51:37 AM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
AVGIDSHX
Error: (09/03/2012 09:51:31 AM) (Source: Service Control Manager) (User: )
Description: The Vsapint service failed to start due to the following error:
%%2
Error: (09/03/2012 09:50:34 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
Error: (09/03/2012 09:40:15 AM) (Source: DCOM) (User: FAMILYROOM)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error: (09/03/2012 09:40:09 AM) (Source: DCOM) (User: FAMILYROOM)
Description: DCOM got error "%%1084" attempting to start the service netman with arguments ""
in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}
Error: (09/03/2012 09:39:53 AM) (Source: DCOM) (User: FAMILYROOM)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error: (09/03/2012 09:39:40 AM) (Source: DCOM) (User: FAMILYROOM)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error: (09/02/2012 10:59:39 PM) (Source: DCOM) (User: FAMILYROOM)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
Microsoft Office Sessions:
=========================
========================= Memory info: ===================================
Percentage of memory in use: 52%
Total physical RAM: 1021.83 MB
Available physical RAM: 484.08 MB
Total Pagefile: 2458.33 MB
Available Pagefile: 1795.52 MB
Total Virtual: 2047.88 MB
Available Virtual: 1966.93 MB
========================= Partitions: =====================================
2 Drive c: () (Fixed) (Total:171.43 GB) (Free:111.66 GB) NTFS
3 Drive d: (Backup) (Fixed) (Total:57.63 GB) (Free:23 GB) NTFS
7 Drive h: (HP SimpleSave) (Fixed) (Total:465.11 GB) (Free:261.06 GB) NTFS
8 Drive i: (My Passport) (Fixed) (Total:931.48 GB) (Free:547.54 GB) NTFS
9 Drive j: (USB20FD) (Removable) (Total:7.53 GB) (Free:6.6 GB) FAT32
========================= Users: ========================================
User accounts for \\FAMILYROOM
Administrator Anna Guest
HelpAssistant Patrick SUPPORT_388945a0
**** End of log ****
and the FSS log:
Farbar Service Scanner Version: 06-08-2012
Ran by Patrick (administrator) on 04-09-2012 at 19:30:38
Running from "C:\Documents and Settings\Patrick\Desktop"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error: Google IP is unreachable
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo IP returned error: Yahoo IP is unreachable
Attempt to access Yahoo.com returned error: Other errors
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit
Extra List:
=======
Gpc(6) hnmwrlspkt(9) IPSec(4) NetBT(5) Packet(8) pctgntdi(12) pctNDIS(11) PSched(7) Tcpip(3) wsppkt(10)
0x0F00000004000000010000000200000003000 0000C0000000D0000000E0000000F0000000500 0000060000000700000008000000090000000A0 000000B000000
IpSec Tag value is correct.
**** End of log ****
-
after a search on how to do it, I am defragmenting the hard drive
-
my employment takes me out of town for these next three days in which I will not have access to the infected PC.
I will be offline until Friday PM.
-
my employment takes me out of town for these next three days in which I will not have access to the infected PC.
I will be offline until Friday PM.
Ok. Is this computer hardwired to the modem? Did you try re-setting the modem? Disconnect the power supply for 30 secs. and then connect it.
-
PC and the laptop that I am using to post to this thread are hard cabled to ubee modem. Time Warner Cable replaced modem two weeks ago to restore telephone service. This was no less than two weeks after the virus blocked access to the internet for the PC only. I did disconnect the power supply to the new modem, waited about 1 minute, reconnected and internet service was restored to the laptop only. The PC will not connect to internet through IE8 or Firefox.
C: defragmentation has been completed.
-
The PC will not connect to internet through IE8 or Firefox.
Did you try another cable?
You will have to download this on your laptop and transfer it to your PC using a memory stick or disk.
Please download LSPFix (http://cexx.org/LSPFix.exe) © 2002-2006 Cexx.org.
Save it to your desktop. Alternate download site available here (http://download.bleepingcomputer.com/spyware/lspfix.zip)
Run LSPFix - Repair LSP Chain
PRINT these instructions... then disconnect from the Internet and close all browser windows.
- Double click the LSPFix.exe icon on your desktop.
- If you had to use the alternate download...double click the "lspfix.zip" file on your desktop.
- Use XPs Compressed File Extraction Wizard or your own 3rd party zip file program.
- Extract the "LSPFix.exe" file to your desktop... double click to start the program.
- Press the "Finish... button.
- Now...Reboot your computer, normally, to complete the process.
-
internet connection has been restored!!! ;D
-
Super Anti-Spy scan returned 33 threats, all Adware, no trojan or worm found
still have issue with empty program list or "shortcuts" in start menu and USB drive not able to stop to safely eject
-
Good news and bad news. It's good that your internet access is repaired. You could try running Rkill again. And now, the bad news. I'm required to give you this warning.
It appears your system is infected with a rootkit. A rootkit is a powerful piece of malware, that allows hackers full control over your computer for means of sending attacks over the Internet, or using your computer to generate revenue.
Malware experts have recommended that we make it clear that with the system under control of a hacker, your computer might become impossible to clean 100%.
Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. They can disable your antivirus and security tools to prevent detection and removal. This type of exploit allows them to steal sensitive information like passwords, personal and financial data which is sent back to the hacker. To learn more about these types of infections, you can refer to:
What danger is presented by rootkits? (http://www.pandasecurity.com/homeusers/security-info/types-malware/rootkit/#e2)
Rootkits and how to combat them (http://www.viruslist.com/en/analysis?pubid=168740859)
r00tkit Analysis: What Is A Rootkit (http://www.omninerd.com/articles/r00tkit_Analysis_What_Is_A_Rootkit)
If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable. Do NOT change passwords or do any transactions while using the infected computer because the attacker may get the new passwords and transaction information. (If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.) Banking and credit card institutions should be notified to apprise them of your situation (possible security breach). To protect your information that may have been compromised, I recommend reading these references:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? (http://www.dslreports.com/faq/10451)
What Should I Do If I've Become A Victim Of Identity Theft? (http://www.usdoj.gov/criminal/fraud/websites/idtheft.html#whatifvictim)
Identity Theft Victims Guide - What to do (http://www.privacyrights.org/fs/fs17a.htm)
It is dangerous and incorrect to assume the computer is secure even if the malware appears to have been removed. In some instances an infection may have caused so much damage to your system that it cannot
be completely cleaned or repaired so you can never be sure that you have completely removed a rootkit. The malware may leave so many remnants behind that security tools cannot find them. Tools that claim to be able to remove rootkits cannot guarantee that all traces of it will be removed. Many experts in the security community believe that once infected with such a piece of malware, the best course of action would be a reformat and clean reinstall of the OS. This is something I don't like to recommend normally, but in most cases it is the best solution for your safety. Making this decision is based on what the computer is used for, and what information can be accessed from it. For more information, please read these references very carefully:
When should I re-format? How should I reinstall? (http://www.dslreports.com/faq/10063)
Help: I Got Hacked. Now What Do I Do? (http://technet.microsoft.com/en-us/library/cc512587.aspx)
Help: I Got Hacked. Now What Do I Do? Part II (http://technet.microsoft.com/en-us/library/cc512595.aspx)
Where to draw the line? When to recommend a format and reinstall? (http://miekiemoes.blogspot.com/2008/06/malware-removal-where-to-draw-line.html)
Guides for format and reinstall: (http://www.GeekPolice.net/tutorials-guides-f13/how-to-reformat-and-reinstall-your-operating-system-t15119.htm#95115)
how-to-reformat-and-reinstall-your-operating-system-the-easy-way (http://www.helpmyos.com/tutorials-software-alternatives-to-proprietary-f19/how-to-reformat-and-reinstall-your-operating-system-the-easy-way-t1307.htm#3143)
However, if you do not have the resources to reinstall your computer's OS and would like me to attempt to clean it, I will be happy to do so. But please consider carefully before deciding against a reformat.
If you do make that decision, I will do my best to help you clean the computer of any infections, but you must understand that once a machine has been taken over by this type of malware, I cannot guarantee that it will be 100% secure even after disinfection or that the removal will be successful.
Please let me know what you have decided to do in your next post. Should you have any questions, please feel free to ask.