TechSpot

Another Vista Anti-Spyware victim

By sonoftheflame
May 14, 2011
  1. Standard symptoms. When trying to access the internet via web browser I recive messages such at "Vista Anti-Spyware thinks this site may be harmful to your computer".

    When attempting to access windows firewall settings or windows security center the Malware is also activated.

    Currently the PC is disconnected from the internet (removed wireless usb adapter) and I have an external hard drive to move any needed files to the infected pc.


    Thanks in advance.
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Welcome to TechSpot!

    If you would like us to check the system for malware, please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

    NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

    Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.

    You can downlaod the programs to a flash drive and then install them on the problem computer if necessary.
     
  3. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    Thanks for the welcome!

    My logs in order are the malwarebytes, gmer, and then DDS

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5363

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.19048

    5/14/2011 11:19:56 AM
    mbam-log-2011-05-14 (11-19-56).txt

    Scan type: Quick scan
    Objects scanned: 175681
    Time elapsed: 5 minute(s), 4 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 2
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("C:\Users\owner\AppData\Local\mmw.exe" -a "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Users\owner\AppData\Roaming\cglogs.dat (Malware.Trace) -> Quarantined and deleted successfully.

    GMER 1.0.15.15627 - http://www.gmer.net
    Rootkit quick scan 2011-05-14 11:33:05
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000070 WDC_WD50 rev.01.0
    Running: 95e6csyz.exe; Driver: C:\Users\owner\AppData\Local\Temp\kwloapow.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
    AttachedDevice \Driver\tdx \Device\Tcp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
    AttachedDevice \Driver\tdx \Device\Udp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 VMkbd.sys

    ---- EOF - GMER 1.0.15 ----

    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by owner at 11:33:39.79 on Sat 05/14/2011
    Internet Explorer: 8.0.6001.19048 BrowserJavaVersion: 1.6.0_20
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.2082 [GMT -4:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\System32\svchost.exe -k Akamai
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\system32\atieclxx.exe
    C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
    C:\Windows\system32\vmnat.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\VMware\VMware Player\vmware-authd.exe
    C:\Windows\system32\vmnetdhcp.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\IOI\ButtonMonitor.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\WINDOWS\RtHDVCpl.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\VMware\VMware Player\hqtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Electronic Arts\EADM\Core.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\ehome\ehsched.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\ehome\ehRecvr.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\owner\Desktop\dds.scr
    .
    ============== Pseudo HJT Report ===============
    .
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110510020022.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
    uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
    uRun: [HKCU] c:\users\owner\appdata\local\temp\temp1_my pics.zip\my pics\my pics\me14323.jpg image hosted on mediafire.exe
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [auditadmin] c:\windows\options\auditadmin.cmd
    mRun: [ButtonMonitor] c:\program files\ioi\ButtonMonitor.exe
    mRun: [RtHDVCpl] RtHDVCpl.exe
    mRun: [jswtrayutil] "c:\program files\netgear\wn111v2\jswtrayutil.exe"
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
    mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
    mRun: [VMware hqtray] "c:\program files\vmware\vmware player\hqtray.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wn111v2\WN111v2.exe
    uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    LSP: c:\program files\vmware\vmware player\vsocklib.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\dnw9cq3x.default\
    FF - prefs.js: browser.search.selectedEngine - Secure Search
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\mcafee\SiteAdvisor
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
    FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-9-11 387480]
    R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2008-10-1 20384]
    R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-9-11 64584]
    R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-9-11 165032]
    R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [2011-2-4 158736]
    R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [2011-2-4 42960]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2010-2-19 21504]
    R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-3-3 172032]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-2-19 21504]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-11 271480]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-11 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-11 271480]
    R2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-11 271480]
    R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-9-11 171168]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-9-11 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-9-11 141792]
    R2 OrbisClient.Services;LabSim Configuration and Security;c:\program files\testout\orbis\OrbisClient.Services.exe [2008-12-1 12288]
    R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2010-11-11 70768]
    R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2010-11-11 539248]
    R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atipmdag.sys [2010-3-3 5340160]
    R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2010-3-2 152064]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-9-11 56064]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-9-11 153280]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-9-11 314088]
    R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [2011-1-18 120208]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
    R3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\drivers\xcbda.sys [2007-5-29 156672]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\system32\drivers\DNIMP50.sys [2006-11-16 21504]
    S3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\system32\drivers\DNISP50.sys [2006-11-16 20480]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\netgear\wn111v2\jswpsapi.exe [2008-2-29 942080]
    S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-9-11 52320]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-9-11 84488]
    S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184]
    S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [2011-1-18 109328]
    S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [2011-1-18 31888]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2v.sys [2008-9-30 449536]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2011-05-14 15:09:15 -------- d-----w- c:\users\owner\appdata\roaming\Malwarebytes
    2011-05-14 15:08:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-05-14 15:08:25 -------- d-----w- c:\progra~2\Malwarebytes
    2011-05-14 15:08:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-05-14 15:08:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-05-14 13:02:03 335872 --sha-w- c:\users\owner\appdata\local\mmw.exe
    2011-05-11 14:15:12 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    2011-05-10 17:57:48 -------- d-----w- c:\program files\Conduit
    2011-05-10 17:57:23 -------- d-----w- c:\program files\ConduitEngine
    2011-05-10 17:57:16 -------- d-----w- c:\program files\uTorrentBar
    2011-05-10 17:56:53 -------- d-----w- c:\program files\uTorrent
    2011-05-10 17:56:12 -------- d-----w- c:\users\owner\appdata\roaming\uTorrent
    2011-05-09 20:14:38 -------- d-----w- c:\program files\iPod
    2011-05-09 20:05:02 -------- d-----w- c:\program files\Bonjour
    2011-04-27 22:15:52 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2011-04-27 22:15:52 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2011-04-27 22:15:41 876032 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-04-23 00:38:43 -------- d-----w- c:\users\owner\appdata\roaming\Kalypso Media
    2011-04-23 00:30:30 -------- d-----w- c:\program files\Kalypso Media
    2011-04-18 23:46:13 -------- d-----w- c:\users\owner\appdata\roaming\Barnes & Noble
    2011-04-18 23:46:09 -------- d-----w- c:\program files\Barnes & Noble
    2011-04-14 17:58:07 -------- d-----w- c:\progra~2\EA Core
    .
    ==================== Find3M ====================
    .
    2011-04-06 20:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 20:20:16 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-04-06 20:20:16 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2011-04-06 20:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2011-03-10 17:03:51 1162240 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-10 17:03:51 1136640 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-03 15:42:03 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 15:40:07 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
    2011-03-03 15:40:05 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
    2011-03-03 15:40:05 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
    2011-03-03 15:40:04 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
    2011-03-03 13:25:11 2041856 ----a-w- c:\windows\system32\win32k.sys
    2011-03-02 15:44:27 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-02-22 14:13:01 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-22 13:33:12 1068544 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-22 13:33:09 797696 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-22 06:21:28 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-02-22 06:17:08 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 06:16:53 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-02-22 06:16:40 71680 ----a-w- c:\windows\system32\iesetup.dll
    2011-02-22 06:16:40 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2011-02-22 05:20:39 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-22 04:43:54 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-02-22 04:42:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2011-02-18 20:36:58 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    2011-02-17 06:23:50 420864 ----a-w- c:\windows\system32\vbscript.dll
    2011-02-16 16:16:37 34304 ----a-w- c:\windows\system32\atmlib.dll
    2011-02-16 14:02:23 292864 ----a-w- c:\windows\system32\atmfd.dll
    .
    =================== ROOTKIT ====================
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 6.0.6002 Disk: WDC_WD50 rev.01.0 -> Harddisk0\DR0 -> \Device\00000071
    .
    device: opened successfully
    user: MBR read successfully
    .
    Disk trace:
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
    c:\windows\system32\drivers\nvstor32.sys NVIDIA Corporation NVIDIA nForce(TM) SATA Driver
    1 ntkrnlpa!IofCallDriver[0x8265A912] -> \Device\Harddisk0\DR0[0x86BC4AC8]
    3 CLASSPNP[0x8ABA08B3] -> ntkrnlpa!IofCallDriver[0x8265A912] -> [0x84F7E4F0]
    5 acpi[0x806156BC] -> ntkrnlpa!IofCallDriver[0x8265A912] -> \Device\00000070[0x85A999C0]
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
    user != kernel MBR !!!
    .
    ============= FINISH: 11:34:28.77 ===============
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Okay, you've picked up a rootkit, so we'll start with that:
    Please download MBRCheck and save to your desktop
    • Double click on MBRCheck.exeto run.(Vista and Windows 7 users will have to confirm the UAC prompt)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      [o] Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      [o] Found non-standard or infected MBR.
      [o] Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Paste this log to your next message.
    ============================================
    There is also a second log for DDS named Attach.txt. Please find that an included it next post. You do not need to zip it.
    ===========================================
    It looks like you have already had Mbam on the system. But the database isn't current. Please rerun the scan, taking care to update first> The Version you have is okay- just the database isn't current. This can cause Mbam to miss more current entries.
    ==========================================
    You can the run this: Please note: If you have Combofix on the desktop already, please uninstall it. The download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    -----------------
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    Logs to include in next Reply:
    MBR Check
    Malwarebytes rescan
    Combofix
     
  5. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    Logs are in the order of attatch.txt, combofix, and updated mbam. mbr check is in second post due to size restrictions.

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 2/17/2010 9:52:37 AM
    System Uptime: 5/14/2011 11:28:40 AM (2 hours ago)
    .
    Motherboard: ECS | | MCP61PM-GM
    Processor: AMD Phenom(tm) 9600 Quad-Core Processor | Socket AM2 | 2300/1mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 455 GiB total, 144.553 GiB free.
    D: is FIXED (NTFS) - 11 GiB total, 5.442 GiB free.
    E: is CDROM (CDFS)
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable
    J: is FIXED (NTFS) - 466 GiB total, 448.027 GiB free.
    K: is CDROM (UDF)
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: VirtualBox Host-Only Ethernet Adapter
    Device ID: ROOT\NET\0000
    Manufacturer: Oracle Corporation
    Name: VirtualBox Host-Only Ethernet Adapter
    PNP Device ID: ROOT\NET\0000
    Service: VBoxNetAdp
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: VMware Virtual Ethernet Adapter for VMnet1
    Device ID: ROOT\VMWARE\0000
    Manufacturer: VMware, Inc.
    Name: VMware Virtual Ethernet Adapter for VMnet1
    PNP Device ID: ROOT\VMWARE\0000
    Service: VMnetAdapter
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: VMware Virtual Ethernet Adapter for VMnet8
    Device ID: ROOT\VMWARE\0001
    Manufacturer: VMware, Inc.
    Name: VMware Virtual Ethernet Adapter for VMnet8
    PNP Device ID: ROOT\VMWARE\0001
    Service: VMnetAdapter
    .
    ==== System Restore Points ===================
    .
    RP442: 4/22/2011 8:28:47 PM - Installed DUNGEONS
    RP443: 4/24/2011 9:59:41 AM - Scheduled Checkpoint
    RP444: 4/25/2011 8:14:19 AM - Scheduled Checkpoint
    RP445: 4/25/2011 10:47:52 AM - Removed Microsoft Silverlight
    RP446: 4/26/2011 12:00:05 AM - Scheduled Checkpoint
    RP447: 4/27/2011 12:00:05 AM - Scheduled Checkpoint
    RP448: 4/28/2011 3:00:15 AM - Windows Update
    RP449: 4/29/2011 12:00:03 AM - Scheduled Checkpoint
    RP450: 4/30/2011 12:00:06 AM - Scheduled Checkpoint
    RP451: 5/4/2011 3:51:06 AM - Scheduled Checkpoint
    RP455: 5/7/2011 10:39:03 PM - Scheduled Checkpoint
    RP456: 5/9/2011 12:00:07 AM - Scheduled Checkpoint
    RP457: 5/9/2011 4:06:30 PM - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
    RP458: 5/9/2011 4:07:25 PM - Device Driver Package Install: Apple Network adapters
    RP459: 5/10/2011 12:36:55 PM - Scheduled Checkpoint
    RP460: 5/12/2011 12:00:07 AM - Scheduled Checkpoint
    RP461: 5/12/2011 3:00:11 AM - Windows Update
    RP462: 5/13/2011 12:00:03 AM - Scheduled Checkpoint
    RP463: 5/14/2011 12:00:03 AM - Scheduled Checkpoint
    RP464: 5/14/2011 12:15:30 PM - Scheduled Checkpoint
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    µTorrent
    7-Zip 4.65
    Adobe AIR
    Adobe Community Help
    Adobe Dreamweaver CS5
    Adobe Flash Player 10 Plugin
    Adobe Flash Player ActiveX
    Adobe Media Player
    Age of Empires III
    Age of Mythology Gold
    Akamai NetSession Interface
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Install Manager
    Bonjour
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center HydraVision Full
    Catalyst Control Center InstallProxy
    ccc-core-static
    ccc-utility
    CCC Help English
    Compact Wireless-G USB Adapter
    Conduit Engine
    Curse Client
    Diablo II
    DUNGEONS
    Dungeons & Dragons Online ®: Eberron Unlimited ™ v01.13.00.802
    EA Download Manager
    EMMA
    EVE Online (remove only)
    EVEMon
    File Shredder 2.0
    FileZilla Client 3.3.4.1
    FLV Player 2.0 (build 25)
    Free RAR Extract Frog
    Gothic III
    Half-Life 2
    Half-Life 2: Episode One
    Half-Life 2: Episode Two
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    ISXEVE 20100930.0006
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 20
    LabSim
    Malwarebytes' Anti-Malware
    McAfee Total Protection
    Medieval II Total War
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft .NET Framework 4 Multi-Targeting Pack
    Microsoft Application Error Reporting
    Microsoft Help Viewer 1.0
    Microsoft IntelliPoint 7.1
    Microsoft IntelliType Pro 7.1
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
    Microsoft SQL Server 2005 Tools Express Edition
    Microsoft SQL Server 2008 R2 Management Objects
    Microsoft SQL Server Compact 3.5 SP2 ENU
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server System CLR Types
    Microsoft SQL Server VSS Writer
    Microsoft Visual Basic 2010 Express - ENU
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
    Microsoft Windows XP Video Decoder Checkup Utility
    Microsoft WSE 3.0 Runtime
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    mIRC
    Mozilla Firefox (3.6.17)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML4 Parser
    Mumble and Murmur
    Neverwinter Nights 2: Platinum
    NOOK for PC
    NVIDIA Drivers
    Oblivion
    Octodad
    Oracle VM VirtualBox 4.0.2
    Pando Media Booster
    Portal
    QuickTime
    RangeMax Wireless-N USB Adapter WN111v2
    RAPTOR
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB2466156)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Microsoft Office Excel 2007 (KB2464583)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Sins of a Solar Empire
    Smart Copy
    Soft Data Fax Modem with SmartCP
    SPORE™
    Steam
    Stranded II 1.0.0.1
    Team Fortress 2
    TeamSpeak 2 RC2
    TeamSpeak 3 Client
    The Lord of the Rings FREE Trial
    The Sims Medieval
    The Sims™ 3
    tools-windows
    TortoiseSVN 1.6.12.20536 (32 bit)
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    uTorrentBar Toolbar
    Ventrilo Client
    Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
    VLC media player 1.0.5
    VMware Player
    Windows Driver Package - ViXS Systems Inc. ViXS PureTV-U (05/29/2007 6.2.100.7)
    WinRAR 4.00 (32-bit)
    WN111v2
    World of Warcraft
    Xfire (remove only)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    5/9/2011 4:08:01 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    5/9/2011 4:06:03 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    5/7/2011 9:15:46 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
    5/7/2011 9:15:46 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/14/2011 9:14:26 AM, Error: Service Control Manager [7022] - The McAfee Network Agent service hung on starting.
    5/14/2011 11:30:51 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
    5/14/2011 11:29:43 AM, Error: EventLog [6008] - The previous system shutdown at 11:26:13 AM on 5/14/2011 was unexpected.
    5/14/2011 10:35:08 AM, Error: EventLog [6008] - The previous system shutdown at 10:32:54 AM on 5/14/2011 was unexpected.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC eeCtrl i8042prt jswpslwf mfehidk mfenlfk mfewfpk NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr SRTSPX SYMTDI tdx VBoxDrv VBoxUSBMon Wanarpv6 ws2ifsl
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The McAfee Personal Firewall Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The McAfee Anti-Spam Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    5/14/2011 10:29:40 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    5/14/2011 10:29:39 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}
    5/14/2011 10:29:28 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    5/14/2011 10:28:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    5/14/2011 10:28:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    5/14/2011 10:28:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    5/14/2011 10:28:46 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    5/14/2011 10:28:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    5/14/2011 10:28:18 AM, Error: EventLog [6008] - The previous system shutdown at 10:26:31 AM on 5/14/2011 was unexpected.
    5/14/2011 1:20:27 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.112 for the Network Card with network address 0026F2F2972B has been denied by the DHCP server 172.31.15.246 (The DHCP Server sent a DHCPNACK message).
    5/12/2011 3:01:30 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
    5/12/2011 3:01:30 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/12/2011 3:01:29 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    5/10/2011 11:30:24 AM, Error: Microsoft-Windows-Dhcp-Client [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0026F2F2972B. The following error occurred: The operation was canceled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
    5/10/2011 11:29:22 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
    5/10/2011 11:25:52 AM, Error: EventLog [6008] - The previous system shutdown at 11:23:33 AM on 5/10/2011 was unexpected.
    5/10/2011 11:22:45 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the McNaiAnn service.
    5/10/2011 11:22:15 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the mcmscsvc service.
    5/10/2011 11:21:45 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the McMPFSvc service.
    5/10/2011 11:21:15 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the McAfee SiteAdvisor Service service.
    5/10/2011 1:59:34 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the McNASvc service.
    5/10/2011 1:59:03 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the McProxy service.
    5/10/2011 1:58:32 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MSK80Service service.
    .
    ==== End Of File ===========================
    ComboFix 11-05-13.03 - owner 05/14/2011 13:42:31.1.4 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.1987 [GMT -4:00]
    Running from: c:\users\owner\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\owner\AppData\Roaming\SQLite3.dll
    J:\start.bat
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-14 to 2011-05-14 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-14 17:52 . 2011-05-14 17:52 -------- d-----w- c:\users\owner\AppData\Local\temp
    2011-05-14 17:52 . 2011-05-14 17:52 -------- d-----w- c:\users\miner\AppData\Local\temp
    2011-05-14 15:09 . 2011-05-14 15:09 -------- d-----w- c:\users\owner\AppData\Roaming\Malwarebytes
    2011-05-14 15:08 . 2011-05-14 15:08 -------- d-----w- c:\programdata\Malwarebytes
    2011-05-14 15:08 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-05-14 15:08 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-05-14 15:08 . 2011-05-14 15:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-05-11 14:15 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-05-10 17:57 . 2011-05-10 17:57 -------- d-----w- c:\program files\Conduit
    2011-05-10 17:56 . 2011-05-10 17:56 -------- d-----w- c:\program files\uTorrent
    2011-05-10 17:56 . 2011-05-14 13:04 -------- d-----w- c:\users\owner\AppData\Roaming\uTorrent
    2011-05-09 20:14 . 2011-05-09 20:14 -------- d-----w- c:\program files\iPod
    2011-05-09 20:05 . 2011-05-09 20:05 -------- d-----w- c:\program files\Bonjour
    2011-04-27 22:15 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2011-04-27 22:15 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2011-04-27 22:15 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-04-23 00:38 . 2011-04-23 00:38 -------- d-----w- c:\users\owner\AppData\Roaming\Kalypso Media
    2011-04-23 00:30 . 2011-04-23 00:30 -------- d-----w- c:\program files\Kalypso Media
    2011-04-18 23:46 . 2011-04-18 23:46 -------- d-----w- c:\users\owner\AppData\Roaming\Barnes & Noble
    2011-04-18 23:46 . 2011-04-18 23:46 -------- d-----w- c:\program files\Barnes & Noble
    2011-04-14 17:58 . 2011-04-14 17:58 -------- d-----w- c:\programdata\EA Core
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-14 18:01 . 2010-09-11 04:15 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 95824 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 84488 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2011-04-14 18:01 . 2010-09-11 04:15 64584 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 56064 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2011-04-14 18:01 . 2010-09-11 04:15 52320 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 387480 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 314088 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2011-04-14 18:01 . 2010-09-11 04:15 165032 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 153280 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2011-04-06 20:20 . 2011-04-06 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 20:20 . 2011-04-06 20:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-04-06 20:20 . 2011-04-06 20:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2011-04-06 20:20 . 2011-04-06 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2011-04-05 17:19 . 2011-04-05 17:17 205984 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1033\ResourceCache.dll
    2011-03-10 17:03 . 2011-04-13 23:54 1162240 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-10 17:03 . 2011-04-13 23:54 1136640 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-03 15:42 . 2011-04-13 23:54 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 15:40 . 2011-04-27 22:15 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
    2011-03-03 15:40 . 2011-04-27 22:15 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
    2011-03-03 15:40 . 2011-04-27 22:15 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
    2011-03-03 15:40 . 2011-04-27 22:15 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
    2011-03-03 13:25 . 2011-04-13 23:54 2041856 ----a-w- c:\windows\system32\win32k.sys
    2011-03-02 15:44 . 2011-04-13 23:54 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-02-22 14:13 . 2011-03-22 18:43 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-22 13:33 . 2011-03-22 18:43 1068544 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-22 13:33 . 2011-03-22 18:43 797696 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-22 13:24 . 2011-04-13 23:54 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-02-22 13:24 . 2011-04-13 23:54 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-02-22 13:23 . 2011-04-13 23:54 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-22 13:23 . 2011-04-13 23:54 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
    2011-02-22 06:21 . 2011-04-13 23:54 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-02-22 06:17 . 2011-04-13 23:54 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 06:16 . 2011-04-13 23:54 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-02-22 06:16 . 2011-04-13 23:54 71680 ----a-w- c:\windows\system32\iesetup.dll
    2011-02-22 06:16 . 2011-04-13 23:54 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2011-02-22 05:20 . 2011-04-13 23:54 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-22 04:43 . 2011-04-13 23:54 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-02-22 04:42 . 2011-04-13 23:54 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2011-02-18 20:36 . 2011-02-18 20:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2011-02-18 20:36 . 2011-02-18 20:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    2011-02-18 14:03 . 2011-04-13 23:54 305152 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-02-18 14:03 . 2011-04-13 23:54 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-02-18 14:03 . 2011-04-13 23:54 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-02-17 06:23 . 2011-04-13 23:54 420864 ----a-w- c:\windows\system32\vbscript.dll
    2011-02-16 16:16 . 2011-04-13 23:54 34304 ----a-w- c:\windows\system32\atmlib.dll
    2011-02-16 14:02 . 2011-04-13 23:54 292864 ----a-w- c:\windows\system32\atmfd.dll
    2011-04-14 18:01 . 2010-09-11 04:15 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
    @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
    @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
    @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
    @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
    @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
    @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
    @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
    @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
    @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
    "Steam"="c:\program files\Steam\Steam.exe" [2010-12-30 1242448]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "auditadmin"="c:\windows\options\auditadmin.cmd" [2007-04-06 476]
    "ButtonMonitor"="c:\program files\IOI\ButtonMonitor.exe" [2007-05-11 53248]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-10-31 4702208]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-03 98304]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-04-05 1195408]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
    "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-05 1505144]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-05 1468256]
    "VMware hqtray"="c:\program files\VMware\VMware Player\hqtray.exe" [2010-11-11 64112]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2008-12-2 1728512]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
    2007-10-11 21:04 1826816 ----a-w- c:\windows\SkyTel.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\DNIMp50.sys [2006-11-16 21504]
    R3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2008-02-29 942080]
    R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-04-14 84488]
    R3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-01-18 109328]
    R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys [2011-01-18 31888]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\DRIVERS\jswpslwf.sys [2008-10-01 20384]
    S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-04-14 64584]
    S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-04-14 165032]
    S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-01-18 158736]
    S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-01-18 42960]
    S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-04-14 188136]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2011-04-14 141792]
    S2 OrbisClient.Services;LabSim Configuration and Security;c:\program files\TestOut\Orbis\OrbisClient.Services.exe [2008-12-01 12288]
    S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2010-11-11 70768]
    S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-11-11 539248]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-04-14 56064]
    S3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\system32\Drivers\DNISp50.sys [2006-11-16 20480]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-04-14 314088]
    S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-01-18 120208]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\DRIVERS\WN111v2v.sys [2008-09-30 449536]
    S3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\DRIVERS\xcbda.sys [2007-05-29 156672]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    Akamai REG_MULTI_SZ Akamai
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-14 c:\windows\Tasks\User_Feed_Synchronization-{D9EB8BBD-7F5A-429E-8F4C-38EBF7A0879E}.job
    - c:\windows\system32\msfeedssync.exe [2011-04-13 04:43]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    LSP: c:\program files\VMware\VMware Player\vsocklib.dll
    FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\dnw9cq3x.default\
    FF - prefs.js: browser.search.selectedEngine - Secure Search
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
    FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM-Run-jswtrayutil - c:\program files\NETGEAR\WN111v2\jswtrayutil.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-05-14 13:52
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    .
    c:\users\owner\AppData\Local\Temp\catchme.dll 53248 bytes executable
    .
    scan completed successfully
    hidden files: 1
    .
    **************************************************************************
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 6.0.6002 Disk: WDC_WD50 rev.01.0 -> Harddisk0\DR0 -> \Device\00000073
    .
    device: opened successfully
    user: MBR read successfully
    kernel: MBR read successfully
    user != kernel MBR !!!
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-3698616264-3336857704-4165822991-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    @Allowed: (Read) (RestrictedCode)
    "??"=hex:65,58,fa,5a,00,80,31,49,a5,c9,18,eb,9a,46,70,9f,de,bb,c4,0e,f6,ef,29,
    2c,b6,57,16,f2,8f,0d,01,98,4a,a7,a8,eb,1b,de,4f,e6,b0,ad,5a,7c,3f,b0,bc,5c,\
    "??"=hex:69,6f,5c,46,6a,89,f9,ee,2d,48,e0,10,87,42,1e,12
    .
    [HKEY_USERS\S-1-5-21-3698616264-3336857704-4165822991-1000\Software\SecuROM\License information*]
    "datasecu"=hex:78,9d,ab,7d,8b,75,cf,de,17,cf,eb,b8,8a,d5,d7,7b,65,94,12,54,e0,
    c2,87,44,2d,48,e2,45,48,9e,72,be,71,48,c5,e7,84,75,00,37,13,36,02,d4,6d,a7,\
    "rkeysecu"=hex:64,b6,bd,e1,3e,80,9e,c4,40,b4,90,83,87,8e,33,49
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-05-14 13:54:37
    ComboFix-quarantined-files.txt 2011-05-14 17:54
    .
    Pre-Run: 170,912,894,976 bytes free
    Post-Run: 170,978,914,304 bytes free
    .
    - - End Of File - - 6F18416504716F7F22AB27C3EB6CC962
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6579

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.19048

    5/14/2011 1:27:12 PM
    mbam-log-2011-05-14 (13-27-12).txt

    Scan type: Quick scan
    Objects scanned: 185571
    Time elapsed: 6 minute(s), 6 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU (Backdoor.Agent.Gen) -> Value: HKCU -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Users\owner\local settings\application data\mmw.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.
     
  6. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows Vista Home Premium Edition
    Windows Information: Service Pack 2 (build 6002), 32-bit
    Base Board Manufacturer: ECS
    BIOS Manufacturer: Phoenix Technologies, LTD
    System Manufacturer: Gateway
    System Product Name: GM5664
    Logical Drives Mask: 0x000017fc

    Kernel Drivers (total 182):
    0x82618000 \SystemRoot\system32\ntkrnlpa.exe
    0x829D2000 \SystemRoot\system32\hal.dll
    0x80406000 \SystemRoot\system32\kdcom.dll
    0x8040D000 \SystemRoot\system32\PSHED.dll
    0x8041E000 \SystemRoot\system32\BOOTVID.dll
    0x80426000 \SystemRoot\system32\CLFS.SYS
    0x80467000 \SystemRoot\system32\CI.dll
    0x80547000 \SystemRoot\System32\drivers\kepmnbub.sys
    0x80555000 \SystemRoot\system32\drivers\Wdf01000.sys
    0x805C6000 \SystemRoot\system32\drivers\WDFLDR.SYS
    0x8060E000 \SystemRoot\system32\drivers\acpi.sys
    0x80654000 \SystemRoot\system32\drivers\WMILIB.SYS
    0x8065D000 \SystemRoot\system32\drivers\msisadrv.sys
    0x80665000 \SystemRoot\system32\drivers\pci.sys
    0x8068C000 \SystemRoot\System32\drivers\partmgr.sys
    0x8069B000 \SystemRoot\system32\DRIVERS\compbatt.sys
    0x8069E000 \SystemRoot\system32\DRIVERS\BATTC.SYS
    0x806A8000 \SystemRoot\system32\drivers\volmgr.sys
    0x806B7000 \SystemRoot\System32\drivers\volmgrx.sys
    0x80701000 \SystemRoot\system32\drivers\pciide.sys
    0x80708000 \SystemRoot\system32\drivers\PCIIDEX.SYS
    0x80716000 \SystemRoot\System32\drivers\mountmgr.sys
    0x80726000 \SystemRoot\system32\drivers\atapi.sys
    0x8072E000 \SystemRoot\system32\drivers\ataport.SYS
    0x8074C000 \SystemRoot\system32\drivers\nvstor.sys
    0x80759000 \SystemRoot\system32\drivers\storport.sys
    0x8079A000 \SystemRoot\system32\DRIVERS\nvstor32.sys
    0x807B7000 \SystemRoot\system32\drivers\fltmgr.sys
    0x807E9000 \SystemRoot\system32\drivers\fileinfo.sys
    0x8A80E000 \SystemRoot\system32\drivers\mfehidk.sys
    0x8A86B000 \SystemRoot\System32\Drivers\ksecdd.sys
    0x8A8DC000 \SystemRoot\system32\drivers\ndis.sys
    0x805D4000 \SystemRoot\system32\drivers\msrpc.sys
    0x8AA06000 \SystemRoot\system32\drivers\NETIO.SYS
    0x8AA41000 \SystemRoot\System32\drivers\tcpip.sys
    0x8AB2B000 \SystemRoot\System32\drivers\fwpkclnt.sys
    0x8AC0C000 \SystemRoot\System32\Drivers\Ntfs.sys
    0x8AD1C000 \SystemRoot\system32\drivers\volsnap.sys
    0x8AD55000 \SystemRoot\System32\Drivers\spldr.sys
    0x8AD5D000 \SystemRoot\System32\Drivers\mup.sys
    0x8AD6C000 \SystemRoot\System32\drivers\ecache.sys
    0x8AD93000 \SystemRoot\system32\drivers\disk.sys
    0x8ADA4000 \SystemRoot\system32\drivers\CLASSPNP.SYS
    0x8ADC5000 \SystemRoot\system32\drivers\crcdisk.sys
    0x8ADE5000 \SystemRoot\system32\DRIVERS\tunnel.sys
    0x8ADF0000 \SystemRoot\system32\DRIVERS\tunmp.sys
    0x8AB63000 \SystemRoot\system32\DRIVERS\processr.sys
    0x8AC00000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0x8AB72000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0x8ABB0000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0x8E604000 \SystemRoot\system32\DRIVERS\HSXHWBS2.sys
    0x8E650000 \SystemRoot\system32\DRIVERS\ks.sys
    0x8E67A000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
    0x8E809000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
    0x8E8BE000 \SystemRoot\system32\drivers\modem.sys
    0x8E8CB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0x8EA0B000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
    0x8EB0B000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0x8EB23000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    0x8EB29000 \SystemRoot\system32\DRIVERS\atikmpag.sys
    0x8F001000 \SystemRoot\system32\DRIVERS\atipmdag.sys
    0x8EB53000 \SystemRoot\System32\drivers\dxgkrnl.sys
    0x8F568000 \SystemRoot\System32\drivers\watchdog.sys
    0x8F574000 \SystemRoot\system32\DRIVERS\xcbda.sys
    0x8F59B000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
    0x8F60B000 \SystemRoot\system32\DRIVERS\xchal.sys
    0x8FB79000 \SystemRoot\system32\DRIVERS\xcmem.sys
    0x8E958000 \SystemRoot\system32\DRIVERS\xcfe.sys
    0x8FBD1000 \SystemRoot\system32\DRIVERS\msiscsi.sys
    0x8F600000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0x8F59E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0x8F5B5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0x8F5C0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0x8F5E3000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0x8E9CB000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0x8E9DF000 \SystemRoot\system32\DRIVERS\rassstp.sys
    0x8E77D000 \SystemRoot\system32\DRIVERS\termdd.sys
    0x8F5F2000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0x8EBF3000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0x8E78D000 \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys
    0x8F5FD000 \SystemRoot\system32\DRIVERS\swenum.sys
    0x8E7A9000 \SystemRoot\system32\DRIVERS\circlass.sys
    0x8EA00000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0x8E7B7000 \SystemRoot\system32\DRIVERS\umbus.sys
    0x8E7C4000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0x8ABBF000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0x90006000 \SystemRoot\system32\drivers\RTKVHDA.sys
    0x8ABD0000 \SystemRoot\system32\drivers\portcls.sys
    0x90205000 \SystemRoot\system32\drivers\drmk.sys
    0x9022A000 \SystemRoot\system32\drivers\AtiHdmi.sys
    0x90248000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0x90251000 \SystemRoot\System32\Drivers\Null.SYS
    0x90258000 \SystemRoot\System32\Drivers\Beep.SYS
    0x9027B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0x90282000 \SystemRoot\System32\drivers\vga.sys
    0x9028E000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
    0x902AF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0x902B7000 \SystemRoot\system32\drivers\rdpencdd.sys
    0x902BF000 \SystemRoot\System32\Drivers\Msfs.SYS
    0x902CA000 \SystemRoot\System32\Drivers\Npfs.SYS
    0x902D8000 \SystemRoot\System32\DRIVERS\rasacd.sys
    0x902E1000 \SystemRoot\system32\DRIVERS\tdx.sys
    0x902F7000 \SystemRoot\system32\drivers\mfewfpk.sys
    0x9031E000 \SystemRoot\system32\DRIVERS\smb.sys
    0x90332000 \SystemRoot\System32\DRIVERS\netbt.sys
    0x90364000 \SystemRoot\system32\drivers\afd.sys
    0x903AC000 \SystemRoot\system32\drivers\ws2ifsl.sys
    0x903B5000 \SystemRoot\system32\DRIVERS\pacer.sys
    0x903CB000 \SystemRoot\system32\DRIVERS\jswpslwf.sys
    0x903D0000 \SystemRoot\system32\DRIVERS\mfenlfk.sys
    0x903DF000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0x903F6000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0x9025F000 \SystemRoot\system32\DRIVERS\netbios.sys
    0x9026D000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0x901F0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0x8A9E7000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0x8E9F4000 \SystemRoot\system32\DRIVERS\VBoxUSBMon.sys
    0x8E800000 \SystemRoot\system32\DRIVERS\kbdhid.sys
    0x90600000 \SystemRoot\system32\DRIVERS\VBoxDrv.sys
    0x90626000 \??\C:\Windows\system32\drivers\VMkbd.sys
    0x9062B000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0x90667000 \SystemRoot\system32\DRIVERS\NuidFltr.sys
    0x9066E000 \SystemRoot\system32\drivers\nsiproxy.sys
    0x90678000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0x90680000 \SystemRoot\System32\Drivers\dfsc.sys
    0x90697000 \SystemRoot\system32\DRIVERS\point32k.sys
    0x906A2000 \SystemRoot\system32\drivers\mfeavfk.sys
    0x906C6000 \SystemRoot\system32\drivers\mfefirek.sys
    0x90711000 \SystemRoot\system32\DRIVERS\WN111v2v.sys
    0x907AA000 \SystemRoot\system32\DRIVERS\cdfs.sys
    0x907C0000 \SystemRoot\system32\drivers\RTSTOR.SYS
    0x907CF000 \SystemRoot\system32\DRIVERS\usbcir.sys
    0x907E5000 \SystemRoot\system32\DRIVERS\hidir.sys
    0x907F0000 \SystemRoot\System32\Drivers\crashdmp.sys
    0x8ADCE000 \SystemRoot\System32\Drivers\dump_diskdump.sys
    0x8AB46000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
    0x9BC10000 \SystemRoot\System32\win32k.sys
    0x8ADD8000 \SystemRoot\System32\drivers\Dxapi.sys
    0x9E20A000 \SystemRoot\system32\DRIVERS\monitor.sys
    0x9BE30000 \SystemRoot\System32\TSDDD.dll
    0x9BE50000 \SystemRoot\System32\ATMFD.DLL
    0x9E219000 \SystemRoot\system32\drivers\luafv.sys
    0x9BEA0000 \SystemRoot\System32\cdd.dll
    0x9E23C000 \SystemRoot\system32\drivers\spsys.sys
    0x9E2EC000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys
    0x9E2FA000 \SystemRoot\system32\DRIVERS\VMNET.SYS
    0x9E2FD000 \SystemRoot\system32\DRIVERS\lltdio.sys
    0x9E30D000 \SystemRoot\system32\DRIVERS\nwifi.sys
    0x9E337000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0x9E341000 \SystemRoot\system32\DRIVERS\rspndr.sys
    0x9E354000 \SystemRoot\system32\drivers\HTTP.sys
    0x9E3C1000 \SystemRoot\System32\DRIVERS\srvnet.sys
    0x9E3DE000 \SystemRoot\system32\DRIVERS\bowser.sys
    0xA280C000 \SystemRoot\System32\drivers\mpsdrv.sys
    0xA2821000 \SystemRoot\system32\drivers\mrxdav.sys
    0xA2842000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xA2861000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    0xA289A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    0xA28B2000 \SystemRoot\System32\DRIVERS\srv2.sys
    0xA28DA000 \SystemRoot\System32\DRIVERS\srv.sys
    0xA2929000 \??\C:\Windows\system32\drivers\hcmon.sys
    0xA2933000 \??\C:\Windows\system32\Drivers\vmci.sys
    0xA2C0C000 \??\C:\Windows\system32\Drivers\vmx86.sys
    0xA2CDB000 \SystemRoot\system32\DRIVERS\atksgt.sys
    0xA2D1E000 \SystemRoot\system32\DRIVERS\lirsgt.sys
    0xA2D23000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xA5807000 \SystemRoot\system32\drivers\peauth.sys
    0xA58E5000 \SystemRoot\System32\Drivers\secdrv.SYS
    0xA58EF000 \SystemRoot\System32\drivers\tcpipreg.sys
    0xA58FB000 \??\C:\Windows\system32\drivers\vmnetuserif.sys
    0xA5900000 \??\C:\Program Files\VMware\VMware Player\vstor2-ws60.sys
    0xA5904000 \SystemRoot\system32\DRIVERS\xaudio.sys
    0xA590C000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
    0xA5921000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
    0xA5957000 \SystemRoot\system32\drivers\cfwids.sys
    0xA5963000 \SystemRoot\system32\drivers\mfeapfk.sys
    0xA5979000 \SystemRoot\system32\drivers\MSPQM.sys
    0xA5993000 \SystemRoot\system32\DRIVERS\udfs.sys
    0xA59CE000 \SystemRoot\System32\Drivers\DNISp50.sys
    0xA59D8000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xA59ED000 \SystemRoot\system32\DRIVERS\wdcsam.sys
    0x77560000 \WINDOWS\System32\ntdll.dll

    Processes (total 80):
    0 System Idle Process
    4 System
    568 C:\WINDOWS\System32\smss.exe
    676 csrss.exe
    740 C:\WINDOWS\System32\wininit.exe
    752 csrss.exe
    784 C:\WINDOWS\System32\services.exe
    796 C:\WINDOWS\System32\lsass.exe
    804 C:\WINDOWS\System32\lsm.exe
    956 C:\WINDOWS\System32\svchost.exe
    1016 C:\WINDOWS\System32\svchost.exe
    1120 C:\WINDOWS\System32\atiesrxx.exe
    1160 C:\WINDOWS\System32\winlogon.exe
    1188 C:\WINDOWS\System32\svchost.exe
    1216 C:\WINDOWS\System32\svchost.exe
    1228 C:\WINDOWS\System32\svchost.exe
    1300 C:\WINDOWS\System32\audiodg.exe
    1320 C:\WINDOWS\System32\svchost.exe
    1336 C:\WINDOWS\System32\SLsvc.exe
    1392 C:\WINDOWS\System32\svchost.exe
    1560 C:\WINDOWS\System32\svchost.exe
    1784 C:\WINDOWS\System32\spoolsv.exe
    1808 C:\WINDOWS\System32\svchost.exe
    2040 C:\WINDOWS\System32\svchost.exe
    288 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    356 C:\Program Files\Bonjour\mDNSResponder.exe
    544 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    1484 C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    1520 C:\WINDOWS\System32\atieclxx.exe
    2068 C:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe
    2100 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    2120 C:\WINDOWS\System32\rundll32.exe
    2140 C:\Program Files\TestOut\Orbis\OrbisClient.Services.exe
    2280 C:\WINDOWS\System32\svchost.exe
    2320 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    2340 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2356 C:\WINDOWS\System32\svchost.exe
    2448 C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
    2504 C:\WINDOWS\System32\vmnat.exe
    2524 C:\WINDOWS\System32\svchost.exe
    2544 C:\WINDOWS\System32\SearchIndexer.exe
    2596 C:\WINDOWS\System32\drivers\XAudio.exe
    2652 C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
    2728 C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
    2772 C:\Program Files\VMware\VMware Player\vmware-authd.exe
    2920 C:\WINDOWS\System32\vmnetdhcp.exe
    2928 WUDFHost.exe
    3588 C:\WINDOWS\System32\dwm.exe
    3648 C:\WINDOWS\explorer.exe
    3672 C:\WINDOWS\System32\taskeng.exe
    3860 C:\WINDOWS\System32\taskeng.exe
    4008 C:\Program Files\IOI\ButtonMonitor.exe
    4020 C:\WINDOWS\RtHDVCpl.exe
    4036 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    4052 C:\Program Files\McAfee.com\Agent\mcagent.exe
    4060 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    2532 C:\Program Files\Microsoft IntelliType Pro\itype.exe
    2840 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    2900 C:\Program Files\VMware\VMware Player\hqtray.exe
    2892 C:\Program Files\iTunes\iTunesHelper.exe
    3476 C:\Program Files\Windows Sidebar\sidebar.exe
    3576 C:\WINDOWS\ehome\ehtray.exe
    3548 C:\Program Files\Electronic Arts\EADM\Core.exe
    904 C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    308 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    2148 C:\WINDOWS\ehome\ehmsas.exe
    4100 C:\WINDOWS\ehome\ehsched.exe
    4408 C:\WINDOWS\System32\net1.exe
    4456 C:\WINDOWS\ehome\ehrecvr.exe
    5240 C:\WINDOWS\System32\SearchProtocolHost.exe
    5356 C:\WINDOWS\System32\SearchFilterHost.exe
    6052 C:\WINDOWS\System32\svchost.exe
    3844 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    3188 C:\Program Files\iPod\bin\iPodService.exe
    5156 WmiPrvSE.exe
    5540 WmiPrvSE.exe
    5884 C:\WINDOWS\System32\dllhost.exe
    4708 dllhost.exe
    4236 dllhost.exe
    5604 C:\Users\owner\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`bca00000 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
    \\.\J: --> \\.\PhysicalDrive1 at offset 0x00000000`00100000 (NTFS)
    \\.\M: --> \\.\PhysicalDrive6 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: WDC WD5000AADS-00S9B, Rev: 01.0
    PhysicalDrive1 Model Number: HitachiHDP725050GLA, Rev: GM4O
    PhysicalDrive6 Model Number: WDMy Passport 070A, Rev: 1030

    Size Device Name MBR Status
    --------------------------------------------
    465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
    SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
    465 GB \\.\PhysicalDrive1 Windows 2008 MBR code detected
    SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
    232 GB \\.\PhysicalDrive6 RE: Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
     
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Any time there is evidence of a rootkit, we usually run the rookkit scan first. For you, that was MBR Check. Scans have the date and time they were run. I went back to check your scans and there is no date and time in the header. So I can't tell if it was run before or after Combofix.

    When you have a program for a scan that we request already on the system, note is made asking that you uninstall it and download from the link we give, which will be the most current. You put Malwarebytes on the system 2010-12-20. The version was current, Malwarebytes' Anti-Malware 1.50.1.1100 but the database was not: Mbam Database version: 5363 When you ran Mbam again, you updated it and the database version was significantly greater: Database version: 6579

    The first Mbam scan found:
    The second Mbam with the udated data base found:
    So I have to ask myself> were the malwares found in the second scan new or were they already on the system but not found because the database wasn't current?
    ===============================================
    I recommend that you uninstall uTorrent and the uTorrent Toolbar because:
    Note: Even if you are using a "safe" P2P program, it is only the program that is safe.
    • As long as you are using file sharing networks and programs which are from sources that are not documented, you cannot verity that a download is legitimate.
    • Malware writers use these program to include malicious content.
    • File sharing is usually unmonitored and there is a danger that your private files might be accessed.
    • The 'sharing' also includes malware that the shared system has on it.
    • Files that are illegal can be spread through file sharing.

    Please read the information on P2P Warning to help you better understand these dangers.

    I also recommend that you uninstall the Conduit Engine- some of the same reasons as above also apply. Users of the Conduits are also usually 'tracked', something that may not be in your best interest. You will be running some script through Combofix. I have included the uTorrent Toolbar and Conduit entries. But if you decide to live dangerously and keep them, I'll remove the entries before giving you the script.

    There are extensions on Firefox for both Ext: Conduit Engine and Ext: uTorrentBar Community Toolbar: They should be removed also
    =================================================
    There are several new downloads on 5/9 and 5/10: If you got these from Torrent sites, that may very well have cause the current malware infection:
    c:\program files\Conduit
    c:\program files\uTorrent
    c:\program files\iPod
    c:\program files\Bonjour

    ==============================================
    Let me know if you want the uTorrent Toolbar and Conduit Engine included in the script. If so, you can go ahead and uninstall them and I will include left over entries and registry values for them in the script.
    ===============================================
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.

    Note: The MBR Check shows:
    What is Drive 6?
    ============================================
    Lastly, none of this is meant to sound 'picky'. I have said these things because I think it's important that you understand the how and why of what we're doing.
     
  8. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    no none of this sounds picky and i greatly appreciate your taking time to help me with this. i would like to keep utorent for now but i have no idea where i got the conduit engine so i would like it removed. The logs of the last scan are as folows:

    C:\Users\owner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\1e8e536c-548521ee a variant of Java/TrojanDownloader.OpenStream.NBV trojan

    edit: Also i beleive that drive 6 is my external hard drive but that is an educated guess
     
  9. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    Just checking in to see if your still helping me bobbye.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    I have had personal obligations that kept me away from the computer. Sorry for delay.

    The entry found by Eset is in the Java cache- so it needs to be emptied:
    To clear the Java Plug-in cache:

    • [1]. Click Start > Control Panel.
      [2]. Double-click the Java icon in the control panel. The Java Control Panel appears.
      [​IMG]
      [3].Click Settings under Temporary Internet Files.The Temporary Files Settings dialog box appears.
      [4] Click Delete Files.The Delete Temporary Files dialog box appears.
      [​IMG]
      There are three options on this window to clear the cache.Check all.
    • . Delete Files
    • .View Applications
    • .View Applets
      [5]. Click OK on Delete Temporary Files window.
      Note: This deletes all the Downloaded Applications and Applets from the cache.
      [6]. Click Apply> OK on Temporary Files Settings window.
    Note: If you want to delete a specific application and applet from the cache, click on View Application and View Applet options respectively.
    ===============================================
    I have removed the uTorrent script entries. Just a work of caution. While the program you downloaded for your phone (and also the system) may be legitimate programs, if you download from a torrent site,s plan on getting malware with them.
    ==============================================
    About the Conduit Engine: Many of these 'conduit toolbars are pre-checked on download screens so be sure you check the screen and uncheck all the pre=checks. It's like the Viewpoint Media Player- the Yahoo Toolbar and processes related to Ask.com> I don't know of anyone who intentionally downloads these. But they are pre-checked on dozens of sites, so be on your toes as all come with adware, some with spyware> or 'other.'
    I have included all the enties I see in the Combofix log for removal of the Conduit entries:
    ==============================================
    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    Registry::
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}].
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"=-
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=-
    DDS::
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    mRun: [auditadmin] c:\windows\options\auditadmin.cmd
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    RegNull::
    [HKEY_USERS\S-1-5-21-3698616264-3336857704-4165822991-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    [HKEY_USERS\S-1-5-21-3698616264-3336857704-4165822991-1000\Software\SecuROM\License information*]
    DDS::
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ===========================================
    Please open Firefox> Tools> Options> Extensions> Remove the following:
    FF - Ext: Java Console: Java v6u20
    FF - Ext: Conduit Engine

    ============================================
    Go to Add/Remove Programs and Uninstall entries related to Conduit
    Also in Add/Remove, uninstall Java v6u20
    Using Windows Explorer> Windows key + E> click on My Computer> Double click on Local Drive(usually C)> Programs> Do a right click> Delete on the program folder fo Conmduit.
    Exit Windows Explorer.
    =============================================
    Download HijackThis and save to your desktop.
    • Extract it to a directory on your hard drive called c:\HijackThis.
    • Then navigate to that directory and double-click on the hijackthis.exe file.
    • When started click on the Scan button and then the Save Log button to create a log of your information.
    • The log file and then the log will open in notepad. Be sure to click on Format> Uncheck Word Wrap when you open Notepad
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

    Update Java: Check this site .Java Updates Uninstall any earlier versions in Add/Remove Programs as they are vulnerabilities for the system.
    Note: You do not have to add a separate extension to Firefox.

    Give me an update on how the system is doing.
     
  11. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    It's no problem. Real life always comes first.

    ComboFix 11-05-16.04 - owner 05/17/2011 12:11:01.2.4 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.1481 [GMT -4:00]
    Running from: c:\users\owner\Desktop\ComboFix.exe
    Command switches used :: c:\users\owner\Desktop\CFScript.txt.txt
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\conduitengine\ConduitEngine.dll
    c:\windows\options\auditadmin.cmd
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-17 to 2011-05-17 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-17 16:19 . 2011-05-17 16:19 -------- d-----w- c:\users\miner\AppData\Local\temp
    2011-05-17 16:19 . 2011-05-17 16:19 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-05-15 19:13 . 2011-05-15 19:13 -------- d-----w- c:\program files\ESET
    2011-05-14 17:54 . 2011-05-17 16:19 -------- d-----w- c:\users\owner\AppData\Local\temp
    2011-05-14 15:09 . 2011-05-14 15:09 -------- d-----w- c:\users\owner\AppData\Roaming\Malwarebytes
    2011-05-14 15:08 . 2011-05-14 15:08 -------- d-----w- c:\programdata\Malwarebytes
    2011-05-14 15:08 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-05-14 15:08 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-05-14 15:08 . 2011-05-14 15:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-05-11 14:15 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-05-10 17:57 . 2011-05-10 17:57 -------- d-----w- c:\program files\Conduit
    2011-05-10 17:56 . 2011-05-10 17:56 -------- d-----w- c:\program files\uTorrent
    2011-05-10 17:56 . 2011-05-14 13:04 -------- d-----w- c:\users\owner\AppData\Roaming\uTorrent
    2011-05-09 20:14 . 2011-05-09 20:14 -------- d-----w- c:\program files\iPod
    2011-05-09 20:05 . 2011-05-09 20:05 -------- d-----w- c:\program files\Bonjour
    2011-04-27 22:15 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2011-04-27 22:15 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2011-04-27 22:15 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-04-23 00:38 . 2011-04-23 00:38 -------- d-----w- c:\users\owner\AppData\Roaming\Kalypso Media
    2011-04-23 00:30 . 2011-04-23 00:30 -------- d-----w- c:\program files\Kalypso Media
    2011-04-18 23:46 . 2011-04-18 23:46 -------- d-----w- c:\users\owner\AppData\Roaming\Barnes & Noble
    2011-04-18 23:46 . 2011-04-18 23:46 -------- d-----w- c:\program files\Barnes & Noble
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-14 18:01 . 2010-09-11 04:15 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 95824 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 84488 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2011-04-14 18:01 . 2010-09-11 04:15 64584 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 56064 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2011-04-14 18:01 . 2010-09-11 04:15 52320 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 387480 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 314088 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2011-04-14 18:01 . 2010-09-11 04:15 165032 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
    2011-04-14 18:01 . 2010-09-11 04:15 153280 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2011-04-06 20:20 . 2011-04-06 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 20:20 . 2011-04-06 20:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-04-06 20:20 . 2011-04-06 20:20 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2011-04-06 20:20 . 2011-04-06 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2011-04-05 17:19 . 2011-04-05 17:17 205984 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1033\ResourceCache.dll
    2011-03-10 17:03 . 2011-04-13 23:54 1162240 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-10 17:03 . 2011-04-13 23:54 1136640 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-03 15:42 . 2011-04-13 23:54 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 15:40 . 2011-04-27 22:15 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
    2011-03-03 15:40 . 2011-04-27 22:15 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
    2011-03-03 15:40 . 2011-04-27 22:15 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
    2011-03-03 15:40 . 2011-04-27 22:15 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
    2011-03-03 13:25 . 2011-04-13 23:54 2041856 ----a-w- c:\windows\system32\win32k.sys
    2011-03-02 15:44 . 2011-04-13 23:54 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-02-22 14:13 . 2011-03-22 18:43 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-22 13:33 . 2011-03-22 18:43 1068544 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-22 13:33 . 2011-03-22 18:43 797696 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-22 13:24 . 2011-04-13 23:54 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-02-22 13:24 . 2011-04-13 23:54 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-02-22 13:23 . 2011-04-13 23:54 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-22 13:23 . 2011-04-13 23:54 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
    2011-02-22 06:21 . 2011-04-13 23:54 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-02-22 06:17 . 2011-04-13 23:54 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 06:16 . 2011-04-13 23:54 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-02-22 06:16 . 2011-04-13 23:54 71680 ----a-w- c:\windows\system32\iesetup.dll
    2011-02-22 06:16 . 2011-04-13 23:54 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2011-02-22 05:20 . 2011-04-13 23:54 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-22 04:43 . 2011-04-13 23:54 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-02-22 04:42 . 2011-04-13 23:54 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2011-02-18 20:36 . 2011-02-18 20:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2011-02-18 20:36 . 2011-02-18 20:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    2011-02-18 14:03 . 2011-04-13 23:54 305152 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-02-18 14:03 . 2011-04-13 23:54 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-02-18 14:03 . 2011-04-13 23:54 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-02-17 06:23 . 2011-04-13 23:54 420864 ----a-w- c:\windows\system32\vbscript.dll
    2011-04-14 18:01 . 2010-09-11 04:15 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
    @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
    @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
    @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
    @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
    @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
    @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
    @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
    @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
    @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
    [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
    2010-03-21 13:55 87304 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
    "Steam"="c:\program files\Steam\Steam.exe" [2010-12-30 1242448]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ButtonMonitor"="c:\program files\IOI\ButtonMonitor.exe" [2007-05-11 53248]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-10-31 4702208]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-03 98304]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-04-05 1195408]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
    "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-05 1505144]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-05 1468256]
    "VMware hqtray"="c:\program files\VMware\VMware Player\hqtray.exe" [2010-11-11 64112]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2008-12-2 1728512]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
    2007-10-11 21:04 1826816 ----a-w- c:\windows\SkyTel.exe
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\DNIMp50.sys [2006-11-16 21504]
    R3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2008-02-29 942080]
    R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-04-14 84488]
    R3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-01-18 109328]
    R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys [2011-01-18 31888]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\DRIVERS\jswpslwf.sys [2008-10-01 20384]
    S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-04-14 64584]
    S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-04-14 165032]
    S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-01-18 158736]
    S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-01-18 42960]
    S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-04-14 188136]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2011-04-14 141792]
    S2 OrbisClient.Services;LabSim Configuration and Security;c:\program files\TestOut\Orbis\OrbisClient.Services.exe [2008-12-01 12288]
    S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2010-11-11 70768]
    S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-11-11 539248]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-04-14 56064]
    S3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\system32\Drivers\DNISp50.sys [2006-11-16 20480]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-04-14 314088]
    S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-01-18 120208]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
    S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\DRIVERS\WN111v2v.sys [2008-09-30 449536]
    S3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\DRIVERS\xcbda.sys [2007-05-29 156672]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    Akamai REG_MULTI_SZ Akamai
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-17 c:\windows\Tasks\User_Feed_Synchronization-{D9EB8BBD-7F5A-429E-8F4C-38EBF7A0879E}.job
    - c:\windows\system32\msfeedssync.exe [2011-04-13 04:43]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    LSP: c:\program files\VMware\VMware Player\vsocklib.dll
    FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\dnw9cq3x.default\
    FF - prefs.js: browser.search.selectedEngine - Secure Search
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
    FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-05-17 12:19
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 6.0.6002 Disk: WDC_WD50 rev.01.0 -> Harddisk0\DR0 -> \Device\00000074
    .
    device: opened successfully
    user: MBR read successfully
    kernel: MBR read successfully
    user != kernel MBR !!!
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-05-17 12:21:53
    ComboFix-quarantined-files.txt 2011-05-17 16:21
    ComboFix2.txt 2011-05-14 17:54
    .
    Pre-Run: 164,276,998,144 bytes free
    Post-Run: 164,241,932,288 bytes free
    .
    - - End Of File - - 6610D226E0376EB3C23B395C55D8030E


    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 12:31:45 PM, on 5/17/2011
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.19048)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\IOI\ButtonMonitor.exe
    C:\WINDOWS\RtHDVCpl.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\VMware\VMware Player\hqtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Electronic Arts\EADM\Core.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Windows\System32\mobsync.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\notepad.exe
    C:\Windows\explorer.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
    O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110510020022.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll
    O4 - HKLM\..\Run: [ButtonMonitor] C:\Program Files\IOI\ButtonMonitor.exe
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
    O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Player\hqtray.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
    O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
    O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    O23 - Service: LabSim Configuration and Security (OrbisClient.Services) - Unknown owner - C:\Program Files\TestOut\Orbis\OrbisClient.Services.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-ufad.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
    O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 8710 bytes
     
  12. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    So far the visual symptoms are gone
     
  13. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    It is almost painful to see all the uTorrent Toolbar entries!

    I am still concerned about possible rootkit remaining. Please run the following:

    Bootkit Remover:

    Download bootkitremover.rar and save to your desktop.
    1. Extract the remover.exe file from the RAR using a program capable of extracting RAR compressed files. (Use 7-Zip if you don't have an extraction program, )
    2. Double-click on the remover.exe file to run the program.
      NOTE: The tool should be run from a command line with Administrator privileges.
    3. Scanning should be completed quickly
    4. Paste the output in your next reply.
    =====================================
    Results should be one of the following:
    1. OK (DOS/Win32 Boot code found)
      - MBR boot code is clean.
    2. Unknown boot code
      - MBR boot code is modified. This practically corresponds to either
      an active bootkit infection, or a custom boot manager installed (such
      as GRUB).
    3. Controlled by rootkit!
      - a bootkit with self-hiding capabilities is detected.
    ==============================================
    Don't take any action- just leave the log. I will be pleased if it comes back #1.
     
  14. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    .\debug.cpp(238) : Debug log started at 19.05.2011 - 02:19:17
    .\boot_cleaner.cpp(527) : Bootkit Remover
    .\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
    .\boot_cleaner.cpp(529) : www.esagelab.com
    .\boot_cleaner.cpp(533) : Program version: 1.2.0.0
    .\boot_cleaner.cpp(540) : OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6002), 32-bit
    .\debug.cpp(248) : **********************************************
    .\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
    .\debug.cpp(250) : **********************************************
    .\debug.cpp(256) : 0x82618000 0x003ba000 "\SystemRoot\system32\ntkrnlpa.exe"
    .\debug.cpp(256) : 0x829d2000 0x00033000 "\SystemRoot\system32\hal.dll"
    .\debug.cpp(256) : 0x80406000 0x00007000 "\SystemRoot\system32\kdcom.dll"
    .\debug.cpp(256) : 0x8040d000 0x00011000 "\SystemRoot\system32\PSHED.dll"
    .\debug.cpp(256) : 0x8041e000 0x00008000 "\SystemRoot\system32\BOOTVID.dll"
    .\debug.cpp(256) : 0x80426000 0x00041000 "\SystemRoot\system32\CLFS.SYS"
    .\debug.cpp(256) : 0x80467000 0x000e0000 "\SystemRoot\system32\CI.dll"
    .\debug.cpp(256) : 0x80547000 0x00071000 "\SystemRoot\system32\drivers\Wdf01000.sys"
    .\debug.cpp(256) : 0x805b8000 0x0000e000 "\SystemRoot\system32\drivers\WDFLDR.SYS"
    .\debug.cpp(256) : 0x8060d000 0x00046000 "\SystemRoot\system32\drivers\acpi.sys"
    .\debug.cpp(256) : 0x80653000 0x00009000 "\SystemRoot\system32\drivers\WMILIB.SYS"
    .\debug.cpp(256) : 0x8065c000 0x00008000 "\SystemRoot\system32\drivers\msisadrv.sys"
    .\debug.cpp(256) : 0x80664000 0x00027000 "\SystemRoot\system32\drivers\pci.sys"
    .\debug.cpp(256) : 0x8068b000 0x0000f000 "\SystemRoot\System32\drivers\partmgr.sys"
    .\debug.cpp(256) : 0x8069a000 0x00003000 "\SystemRoot\system32\DRIVERS\compbatt.sys"
    .\debug.cpp(256) : 0x8069d000 0x0000a000 "\SystemRoot\system32\DRIVERS\BATTC.SYS"
    .\debug.cpp(256) : 0x806a7000 0x0000f000 "\SystemRoot\system32\drivers\volmgr.sys"
    .\debug.cpp(256) : 0x806b6000 0x0004a000 "\SystemRoot\System32\drivers\volmgrx.sys"
    .\debug.cpp(256) : 0x80700000 0x00007000 "\SystemRoot\system32\drivers\pciide.sys"
    .\debug.cpp(256) : 0x80707000 0x0000e000 "\SystemRoot\system32\drivers\PCIIDEX.SYS"
    .\debug.cpp(256) : 0x80715000 0x00010000 "\SystemRoot\System32\drivers\mountmgr.sys"
    .\debug.cpp(256) : 0x80725000 0x00008000 "\SystemRoot\system32\drivers\atapi.sys"
    .\debug.cpp(256) : 0x8072d000 0x0001e000 "\SystemRoot\system32\drivers\ataport.SYS"
    .\debug.cpp(256) : 0x8074b000 0x0000d000 "\SystemRoot\system32\drivers\nvstor.sys"
    .\debug.cpp(256) : 0x80758000 0x00041000 "\SystemRoot\system32\drivers\storport.sys"
    .\debug.cpp(256) : 0x80799000 0x0001d000 "\SystemRoot\system32\DRIVERS\nvstor32.sys"
    .\debug.cpp(256) : 0x807b6000 0x00032000 "\SystemRoot\system32\drivers\fltmgr.sys"
    .\debug.cpp(256) : 0x807e8000 0x00010000 "\SystemRoot\system32\drivers\fileinfo.sys"
    .\debug.cpp(256) : 0x8a605000 0x0005d000 "\SystemRoot\system32\drivers\mfehidk.sys"
    .\debug.cpp(256) : 0x8a662000 0x00071000 "\SystemRoot\System32\Drivers\ksecdd.sys"
    .\debug.cpp(256) : 0x8a6d3000 0x0010b000 "\SystemRoot\system32\drivers\ndis.sys"
    .\debug.cpp(256) : 0x805c6000 0x0002b000 "\SystemRoot\system32\drivers\msrpc.sys"
    .\debug.cpp(256) : 0x8a804000 0x0003b000 "\SystemRoot\system32\drivers\NETIO.SYS"
    .\debug.cpp(256) : 0x8a83f000 0x000ea000 "\SystemRoot\System32\drivers\tcpip.sys"
    .\debug.cpp(256) : 0x8a929000 0x0001b000 "\SystemRoot\System32\drivers\fwpkclnt.sys"
    .\debug.cpp(256) : 0x8aa05000 0x00110000 "\SystemRoot\System32\Drivers\Ntfs.sys"
    .\debug.cpp(256) : 0x8ab15000 0x00039000 "\SystemRoot\system32\drivers\volsnap.sys"
    .\debug.cpp(256) : 0x8ab4e000 0x00008000 "\SystemRoot\System32\Drivers\spldr.sys"
    .\debug.cpp(256) : 0x8ab56000 0x0000f000 "\SystemRoot\System32\Drivers\mup.sys"
    .\debug.cpp(256) : 0x8ab65000 0x00027000 "\SystemRoot\System32\drivers\ecache.sys"
    .\debug.cpp(256) : 0x8ab8c000 0x00011000 "\SystemRoot\system32\drivers\disk.sys"
    .\debug.cpp(256) : 0x8ab9d000 0x00021000 "\SystemRoot\system32\drivers\CLASSPNP.SYS"
    .\debug.cpp(256) : 0x8abbe000 0x00009000 "\SystemRoot\system32\drivers\crcdisk.sys"
    .\debug.cpp(256) : 0x8a944000 0x0000b000 "\SystemRoot\system32\DRIVERS\tunnel.sys"
    .\debug.cpp(256) : 0x8a94f000 0x00009000 "\SystemRoot\system32\DRIVERS\tunmp.sys"
    .\debug.cpp(256) : 0x8a958000 0x0000f000 "\SystemRoot\system32\DRIVERS\processr.sys"
    .\debug.cpp(256) : 0x8a967000 0x0000a000 "\SystemRoot\system32\DRIVERS\usbohci.sys"
    .\debug.cpp(256) : 0x8a971000 0x0003e000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"
    .\debug.cpp(256) : 0x8a9af000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbehci.sys"
    .\debug.cpp(256) : 0x8e80c000 0x0004c000 "\SystemRoot\system32\DRIVERS\HSXHWBS2.sys"
    .\debug.cpp(256) : 0x8e858000 0x0002a000 "\SystemRoot\system32\DRIVERS\ks.sys"
    .\debug.cpp(256) : 0x8e882000 0x00103000 "\SystemRoot\system32\DRIVERS\HSX_DPV.sys"
    .\debug.cpp(256) : 0x8ec0b000 0x000b5000 "\SystemRoot\system32\DRIVERS\HSX_CNXT.sys"
    .\debug.cpp(256) : 0x8ecc0000 0x0000d000 "\SystemRoot\system32\drivers\modem.sys"
    .\debug.cpp(256) : 0x8eccd000 0x0008d000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys"
    .\debug.cpp(256) : 0x8ee04000 0x00100000 "\SystemRoot\system32\DRIVERS\nvmfdx32.sys"
    .\debug.cpp(256) : 0x8ef04000 0x00018000 "\SystemRoot\system32\DRIVERS\cdrom.sys"
    .\debug.cpp(256) : 0x8ef1c000 0x00006000 "\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys"
    .\debug.cpp(256) : 0x8ef22000 0x0002a000 "\SystemRoot\system32\DRIVERS\atikmpag.sys"
    .\debug.cpp(256) : 0x8f203000 0x00567000 "\SystemRoot\system32\DRIVERS\atipmdag.sys"
    .\debug.cpp(256) : 0x8ef4c000 0x000a0000 "\SystemRoot\System32\drivers\dxgkrnl.sys"
    .\debug.cpp(256) : 0x8f76a000 0x0000c000 "\SystemRoot\System32\drivers\watchdog.sys"
    .\debug.cpp(256) : 0x8f776000 0x00027000 "\SystemRoot\system32\DRIVERS\xcbda.sys"
    .\debug.cpp(256) : 0x8f79d000 0x00003000 "\SystemRoot\system32\DRIVERS\BdaSup.SYS"
    .\debug.cpp(256) : 0x8f809000 0x0056e000 "\SystemRoot\system32\DRIVERS\xchal.sys"
    .\debug.cpp(256) : 0x8fd77000 0x00058000 "\SystemRoot\system32\DRIVERS\xcmem.sys"
    .\debug.cpp(256) : 0x8ed5a000 0x00073000 "\SystemRoot\system32\DRIVERS\xcfe.sys"
    .\debug.cpp(256) : 0x8fdcf000 0x0002f000 "\SystemRoot\system32\DRIVERS\msiscsi.sys"
    .\debug.cpp(256) : 0x8f7a0000 0x0000b000 "\SystemRoot\system32\DRIVERS\TDI.SYS"
    .\debug.cpp(256) : 0x8f7ab000 0x00017000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"
    .\debug.cpp(256) : 0x8f7c2000 0x0000b000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"
    .\debug.cpp(256) : 0x8f7cd000 0x00023000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"
    .\debug.cpp(256) : 0x8f7f0000 0x0000f000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"
    .\debug.cpp(256) : 0x8efec000 0x00014000 "\SystemRoot\system32\DRIVERS\raspptp.sys"
    .\debug.cpp(256) : 0x8edcd000 0x00015000 "\SystemRoot\system32\DRIVERS\rassstp.sys"
    .\debug.cpp(256) : 0x8ede2000 0x00010000 "\SystemRoot\system32\DRIVERS\termdd.sys"
    .\debug.cpp(256) : 0x8edf2000 0x0000b000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"
    .\debug.cpp(256) : 0x8ec00000 0x0000b000 "\SystemRoot\system32\DRIVERS\mouclass.sys"
    .\debug.cpp(256) : 0x8e985000 0x0001c000 "\SystemRoot\system32\DRIVERS\VBoxNetFlt.sys"
    .\debug.cpp(256) : 0x8fdfe000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"
    .\debug.cpp(256) : 0x8e9a1000 0x0000e000 "\SystemRoot\system32\DRIVERS\circlass.sys"
    .\debug.cpp(256) : 0x8e9af000 0x0000a000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"
    .\debug.cpp(256) : 0x8e9b9000 0x0000d000 "\SystemRoot\system32\DRIVERS\umbus.sys"
    .\debug.cpp(256) : 0x8e9c6000 0x00035000 "\SystemRoot\system32\DRIVERS\usbhub.sys"
    .\debug.cpp(256) : 0x8a9be000 0x00011000 "\SystemRoot\System32\Drivers\NDProxy.SYS"
    .\debug.cpp(256) : 0x90007000 0x001ea000 "\SystemRoot\system32\drivers\RTKVHDA.sys"
    .\debug.cpp(256) : 0x8a9cf000 0x0002d000 "\SystemRoot\system32\drivers\portcls.sys"
    .\debug.cpp(256) : 0x9020c000 0x00025000 "\SystemRoot\system32\drivers\drmk.sys"
    .\debug.cpp(256) : 0x90231000 0x0001e000 "\SystemRoot\system32\drivers\AtiHdmi.sys"
    .\debug.cpp(256) : 0x9024f000 0x00009000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"
    .\debug.cpp(256) : 0x90258000 0x00007000 "\SystemRoot\System32\Drivers\Null.SYS"
    .\debug.cpp(256) : 0x9025f000 0x00007000 "\SystemRoot\System32\Drivers\Beep.SYS"
    .\debug.cpp(256) : 0x90282000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS"
    .\debug.cpp(256) : 0x90289000 0x0000c000 "\SystemRoot\System32\drivers\vga.sys"
    .\debug.cpp(256) : 0x90295000 0x00021000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS"
    .\debug.cpp(256) : 0x902b6000 0x00008000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"
    .\debug.cpp(256) : 0x902be000 0x00008000 "\SystemRoot\system32\drivers\rdpencdd.sys"
    .\debug.cpp(256) : 0x902c6000 0x0000b000 "\SystemRoot\System32\Drivers\Msfs.SYS"
    .\debug.cpp(256) : 0x902d1000 0x0000e000 "\SystemRoot\System32\Drivers\Npfs.SYS"
    .\debug.cpp(256) : 0x902df000 0x00009000 "\SystemRoot\System32\DRIVERS\rasacd.sys"
    .\debug.cpp(256) : 0x902e8000 0x00016000 "\SystemRoot\system32\DRIVERS\tdx.sys"
    .\debug.cpp(256) : 0x902fe000 0x00027000 "\SystemRoot\system32\drivers\mfewfpk.sys"
    .\debug.cpp(256) : 0x90325000 0x00014000 "\SystemRoot\system32\DRIVERS\smb.sys"
    .\debug.cpp(256) : 0x90339000 0x00032000 "\SystemRoot\System32\DRIVERS\netbt.sys"
    .\debug.cpp(256) : 0x9036b000 0x00048000 "\SystemRoot\system32\drivers\afd.sys"
    .\debug.cpp(256) : 0x903b3000 0x00009000 "\SystemRoot\system32\drivers\ws2ifsl.sys"
    .\debug.cpp(256) : 0x903bc000 0x00016000 "\SystemRoot\system32\DRIVERS\pacer.sys"
    .\debug.cpp(256) : 0x903d2000 0x00005000 "\SystemRoot\system32\DRIVERS\jswpslwf.sys"
    .\debug.cpp(256) : 0x903d7000 0x0000f000 "\SystemRoot\system32\DRIVERS\mfenlfk.sys"
    .\debug.cpp(256) : 0x903e6000 0x0000e000 "\SystemRoot\system32\DRIVERS\netbios.sys"
    .\debug.cpp(256) : 0x90266000 0x00017000 "\SystemRoot\system32\DRIVERS\usbccgp.sys"
    .\debug.cpp(256) : 0x9027d000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"
    .\debug.cpp(256) : 0x8a7de000 0x00013000 "\SystemRoot\system32\DRIVERS\wanarp.sys"
    .\debug.cpp(256) : 0x903f4000 0x00009000 "\SystemRoot\system32\DRIVERS\VBoxUSBMon.sys"
    .\debug.cpp(256) : 0x90200000 0x00009000 "\SystemRoot\system32\DRIVERS\hidusb.sys"
    .\debug.cpp(256) : 0x9060f000 0x00010000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS"
    .\debug.cpp(256) : 0x9061f000 0x00026000 "\SystemRoot\system32\DRIVERS\VBoxDrv.sys"
    .\debug.cpp(256) : 0x90645000 0x00009000 "\SystemRoot\system32\DRIVERS\kbdhid.sys"
    .\debug.cpp(256) : 0x9064e000 0x0003c000 "\SystemRoot\system32\DRIVERS\rdbss.sys"
    .\debug.cpp(256) : 0x9068a000 0x00005000 "\??\C:\Windows\system32\drivers\VMkbd.sys"
    .\debug.cpp(256) : 0x9068f000 0x0000a000 "\SystemRoot\system32\drivers\nsiproxy.sys"
    .\debug.cpp(256) : 0x90699000 0x00017000 "\SystemRoot\System32\Drivers\dfsc.sys"
    .\debug.cpp(256) : 0x906b0000 0x00007000 "\SystemRoot\system32\DRIVERS\NuidFltr.sys"
    .\debug.cpp(256) : 0x906b7000 0x00024000 "\SystemRoot\system32\drivers\mfeavfk.sys"
    .\debug.cpp(256) : 0x906db000 0x00008000 "\SystemRoot\system32\DRIVERS\mouhid.sys"
    .\debug.cpp(256) : 0x906e3000 0x0000b000 "\SystemRoot\system32\DRIVERS\point32k.sys"
    .\debug.cpp(256) : 0x906ee000 0x0004b000 "\SystemRoot\system32\drivers\mfefirek.sys"
    .\debug.cpp(256) : 0x90739000 0x00099000 "\SystemRoot\system32\DRIVERS\WN111v2v.sys"
    .\debug.cpp(256) : 0x907d2000 0x0000f000 "\SystemRoot\system32\drivers\RTSTOR.SYS"
    .\debug.cpp(256) : 0x907e1000 0x00016000 "\SystemRoot\system32\DRIVERS\cdfs.sys"
    .\debug.cpp(256) : 0x90600000 0x0000d000 "\SystemRoot\System32\Drivers\crashdmp.sys"
    .\debug.cpp(256) : 0x901f1000 0x0000a000 "\SystemRoot\System32\Drivers\dump_diskdump.sys"
    .\debug.cpp(256) : 0x8abc7000 0x0001d000 "\SystemRoot\System32\Drivers\dump_nvstor32.sys"
    .\debug.cpp(256) : 0x8abe4000 0x00016000 "\SystemRoot\system32\DRIVERS\usbcir.sys"
    .\debug.cpp(256) : 0x8e800000 0x0000b000 "\SystemRoot\system32\DRIVERS\hidir.sys"
    .\debug.cpp(256) : 0x9aa90000 0x00204000 "\SystemRoot\System32\win32k.sys"
    .\debug.cpp(256) : 0x8a7f1000 0x0000a000 "\SystemRoot\System32\drivers\Dxapi.sys"
    .\debug.cpp(256) : 0x805f1000 0x0000f000 "\SystemRoot\system32\DRIVERS\monitor.sys"
    .\debug.cpp(256) : 0x9acb0000 0x00009000 "\SystemRoot\System32\TSDDD.dll"
    .\debug.cpp(256) : 0x9acd0000 0x0004d000 "\SystemRoot\System32\ATMFD.DLL"
    .\debug.cpp(256) : 0x9e00e000 0x0001b000 "\SystemRoot\system32\drivers\luafv.sys"
    .\debug.cpp(256) : 0x9ad20000 0x0000e000 "\SystemRoot\System32\cdd.dll"
    .\debug.cpp(256) : 0x9e031000 0x000b0000 "\SystemRoot\system32\drivers\spsys.sys"
    .\debug.cpp(256) : 0x9e0e1000 0x0000e000 "\SystemRoot\system32\DRIVERS\vmnetbridge.sys"
    .\debug.cpp(256) : 0x9e0ef000 0x00003000 "\SystemRoot\system32\DRIVERS\VMNET.SYS"
    .\debug.cpp(256) : 0x9e0f2000 0x00010000 "\SystemRoot\system32\DRIVERS\lltdio.sys"
    .\debug.cpp(256) : 0x9e102000 0x0002a000 "\SystemRoot\system32\DRIVERS\nwifi.sys"
    .\debug.cpp(256) : 0x9e12c000 0x0000a000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"
    .\debug.cpp(256) : 0x9e136000 0x00013000 "\SystemRoot\system32\DRIVERS\rspndr.sys"
    .\debug.cpp(256) : 0x9e149000 0x0006d000 "\SystemRoot\system32\drivers\HTTP.sys"
    .\debug.cpp(256) : 0x9e1b6000 0x0001d000 "\SystemRoot\System32\DRIVERS\srvnet.sys"
    .\debug.cpp(256) : 0x9e1d3000 0x00019000 "\SystemRoot\system32\DRIVERS\bowser.sys"
    .\debug.cpp(256) : 0xa040e000 0x00015000 "\SystemRoot\System32\drivers\mpsdrv.sys"
    .\debug.cpp(256) : 0xa0423000 0x00021000 "\SystemRoot\system32\drivers\mrxdav.sys"
    .\debug.cpp(256) : 0xa0444000 0x0001f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"
    .\debug.cpp(256) : 0xa0463000 0x00039000 "\SystemRoot\system32\DRIVERS\mrxsmb10.sys"
    .\debug.cpp(256) : 0xa049c000 0x00018000 "\SystemRoot\system32\DRIVERS\mrxsmb20.sys"
    .\debug.cpp(256) : 0xa04b4000 0x00028000 "\SystemRoot\System32\DRIVERS\srv2.sys"
    .\debug.cpp(256) : 0xa04dc000 0x0004f000 "\SystemRoot\System32\DRIVERS\srv.sys"
    .\debug.cpp(256) : 0xa052b000 0x0000a000 "\??\C:\Windows\system32\drivers\hcmon.sys"
    .\debug.cpp(256) : 0xa0535000 0x00010000 "\??\C:\Windows\system32\Drivers\vmci.sys"
    .\debug.cpp(256) : 0xa1007000 0x000cf000 "\??\C:\Windows\system32\Drivers\vmx86.sys"
    .\debug.cpp(256) : 0xa10d6000 0x00043000 "\SystemRoot\system32\DRIVERS\atksgt.sys"
    .\debug.cpp(256) : 0xa1119000 0x00005000 "\SystemRoot\system32\DRIVERS\lirsgt.sys"
    .\debug.cpp(256) : 0xa111e000 0x00004000 "\SystemRoot\system32\DRIVERS\mdmxsdk.sys"
    .\debug.cpp(256) : 0xa1122000 0x000de000 "\SystemRoot\system32\drivers\peauth.sys"
    .\debug.cpp(256) : 0xa0545000 0x0000a000 "\SystemRoot\System32\Drivers\secdrv.SYS"
    .\debug.cpp(256) : 0xa054f000 0x0000c000 "\SystemRoot\System32\drivers\tcpipreg.sys"
    .\debug.cpp(256) : 0xa1000000 0x00005000 "\??\C:\Windows\system32\drivers\vmnetuserif.sys"
    .\debug.cpp(256) : 0xa055b000 0x00004000 "\??\C:\Program Files\VMware\VMware Player\vstor2-ws60.sys"
    .\debug.cpp(256) : 0xa055f000 0x00015000 "\SystemRoot\system32\DRIVERS\WUDFRd.sys"
    .\debug.cpp(256) : 0xa0574000 0x00012000 "\SystemRoot\system32\DRIVERS\WUDFPf.sys"
    .\debug.cpp(256) : 0xa0586000 0x00008000 "\SystemRoot\system32\DRIVERS\xaudio.sys"
    .\debug.cpp(256) : 0xa05b2000 0x0000c000 "\SystemRoot\system32\drivers\cfwids.sys"
    .\debug.cpp(256) : 0xa05be000 0x00016000 "\SystemRoot\system32\drivers\mfeapfk.sys"
    .\debug.cpp(256) : 0xa1005000 0x00002000 "\SystemRoot\system32\drivers\MSPQM.sys"
    .\debug.cpp(256) : 0xa05d4000 0x0000a000 "\SystemRoot\System32\Drivers\DNISp50.sys"
    .\debug.cpp(256) : 0xb0204000 0x0003b000 "\SystemRoot\system32\DRIVERS\udfs.sys"
    .\debug.cpp(256) : 0xb0257000 0x00015000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS"
    .\debug.cpp(256) : 0xb026c000 0x00003000 "\SystemRoot\system32\DRIVERS\wdcsam.sys"
    .\debug.cpp(256) : 0xb026f000 0x00002000 "\??\C:\Windows\system32\Drivers\PROCEXP113.SYS"
    .\debug.cpp(256) : 0xb0271000 0x00008000 "\??\C:\Users\owner\AppData\Local\Temp\catchme.sys"
    .\debug.cpp(256) : 0x77ab0000 0x00128000 "\WINDOWS\System32\ntdll.dll"
    .\debug.cpp(263) : **********************************************
    .\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
    .\debug.cpp(308) : **********************************************
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&3da39f2&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"
    .\debug.cpp(400) : Destination "\Device\Ndis"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#GWY078B#5&7f237b6&0&UID256#{866519b5-3f07-4c97-b7df-24c5d8a8ccb8}"
    .\debug.cpp(400) : Destination "\Device\00000099"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0846&PID_9001#12345#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3:"
    .\debug.cpp(400) : Destination "\Device\RaidPort1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"
    .\debug.cpp(400) : Destination "\Device\Video0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\0000004d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000003"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1002&DEV_94C1&SUBSYS_11101462&REV_00#4&3b4d693&0&0048#{1ca05180-a699-450a-9a0c-de4fbe3ddd89}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_IOI-SMC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000089"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{B9826018-BDF4-4ED6-BABF-9BE8650A5C28}"
    .\debug.cpp(400) : Destination "\Device\NDMP4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col03#7&25dd1412&0&0002#{1e0886f0-4876-47fe-b3fd-c9851b2bcff2}"
    .\debug.cpp(400) : Destination "\Device\00000085"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0001#{7951772d-cd50-49b7-b103-2baac494fc57}"
    .\debug.cpp(400) : Destination "\Device\00000058"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SUN_VBOXNETFLTMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000055"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"
    .\debug.cpp(400) : Destination "\Device\Video1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000004e"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000004b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*6TO4MP#0004#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000001"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03EF&SUBSYS_26061019&REV_A2#3&2411e6fe&0&38#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0009"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_HL-DT-ST&Prod_BDDVDRW_GGC-H20N#4&17cc524f&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000075"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-SMC&PROD_&REV_#20021111153705700##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
    .\debug.cpp(400) : Destination "\Device\0000009f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col01#7&25dd1412&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000083"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"
    .\debug.cpp(400) : Destination "\Device\Video2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3a7f9ce5&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}"
    .\debug.cpp(400) : Destination "\Device\0000007d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0071#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000006"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&3c82c0d&0&0#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\Ide\PciIde0Channel0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:"
    .\debug.cpp(400) : Destination "\Device\CdRom0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E3FE0F52-6729-43AC-8488-5AC1FB2AE7A9}"
    .\debug.cpp(400) : Destination "\Device\NDMP13"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"
    .\debug.cpp(400) : Destination "\Device\Video3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000004c"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIAdminDevice"
    .\debug.cpp(400) : Destination "\Device\WMIAdminDevice"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WGUARDNT"
    .\debug.cpp(400) : Destination "\Device\mfehidk"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tun0"
    .\debug.cpp(400) : Destination "\Device\Tun0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6EA11ADB-6FEB-425D-A3CB-3CB73F334E62}"
    .\debug.cpp(400) : Destination "\Device\NDMP9"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY5"
    .\debug.cpp(400) : Destination "\Device\Video4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi4:"
    .\debug.cpp(400) : Destination "\Device\RaidPort2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0003#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000004"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VolMgrControl"
    .\debug.cpp(400) : Destination "\Device\VolMgrControl"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_IOI-MMC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume6"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_IOI-CFC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000088"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3a7f9ce5&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\0000007d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{353B4E3E-48DB-42D7-B50F-6273D669227A}"
    .\debug.cpp(400) : Destination "\Device\NDMP6"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_1058&PID_070A#575842304139394E36343335#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-6"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SUN_VBOXNETFLTMP#0003#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000056"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0071#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000006"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CompositeBattery"
    .\debug.cpp(400) : Destination "\Device\CompositeBattery"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\F:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{f4870f62-30df-11df-b623-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume10"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"
    .\debug.cpp(400) : Destination "\Device\WMIDataDevice"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-MMC&PROD_&REV_#20021111153705700##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
    .\debug.cpp(400) : Destination "\Device\0000009d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{fd0a5af4-b41d-11d2-9c95-00c04f7971e0}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SpDevice"
    .\debug.cpp(400) : Destination "\Device\SpDevice"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_147A&PID_E018&MI_00#6&1ba3ffdc&0&0000#{064f8c82-77b2-445e-b85d-c4e20f942fe1}"
    .\debug.cpp(400) : Destination "\Device\0000008d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{860bb310-5d01-11d0-bd3b-00a0c911ce86}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TUNMP#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000007"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\XAudio"
    .\debug.cpp(400) : Destination "\Device\XAudio"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PEAuth"
    .\debug.cpp(400) : Destination "\Device\PEAuth"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"
    .\debug.cpp(400) : Destination "\Device\NamedPipe"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10192107&REV_1001#4&11e9ef39&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}"
    .\debug.cpp(400) : Destination "\Device\0000007b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Point32Filter"
    .\debug.cpp(400) : Destination "\Device\Point32Filter"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{7a5de1d3-01a1-452c-b481-4fa2b96271e8}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col06#2&20751cd0&0&0005#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000096"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM3"
    .\debug.cpp(400) : Destination "\Device\Winachsf0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\G:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{00a05414-1bd3-11df-845f-806e6f6e6963}"
    .\debug.cpp(400) : Destination "\Device\CdRom0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&11950e81&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_IOI-MSC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume7"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature66A4278AOffset100000Length7470900000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"
    .\debug.cpp(400) : Destination "\Device\Mup"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_IOI-MMC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\0000008a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{2DA7FED0-D403-469A-A5CB-88934D2C148B}"
    .\debug.cpp(400) : Destination "\Device\NDMP19"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-CFC&PROD_&REV_#20021111153705700##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
    .\debug.cpp(400) : Destination "\Device\0000009c"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{a799a801-a46d-11d0-a18c-00a02401dcd4}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{a799a800-a46d-11d0-a18c-00a02401dcd4}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-e1d1f261-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(400) : Destination "\Device\UMDFCtrlDev-e1d1f261-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VBoxNetFlt"
    .\debug.cpp(400) : Destination "\Device\VBoxNetFlt"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Psched"
    .\debug.cpp(400) : Destination "\Device\Psched"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F2&SUBSYS_26061019&REV_A3#3&2411e6fe&0&11#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0005"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice"
    .\debug.cpp(400) : Destination "\Device\GEARAspiWDMDevice"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
    .\debug.cpp(400) : Destination "\Device\00000063"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"
    .\debug.cpp(400) : Destination "\Device\USBFDO-0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{76EF6F61-386F-46FB-A73D-62508014E0A9}"
    .\debug.cpp(400) : Destination "\Device\NDMP7"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VMnetUserif"
    .\debug.cpp(400) : Destination "\Device\VMnetUserif"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{EBA2EAEF-642F-4387-BE3A-6519E85C92D0}"
    .\debug.cpp(400) : Destination "\Device\NDMP1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0A48&PID_5014#20021111153705700#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"
    .\debug.cpp(400) : Destination "\Device\Tcp"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000004"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI Soft Data Fax Modem with SmartCP"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"
    .\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F6&SUBSYS_26061019&REV_A2#3&2411e6fe&0&41#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0011"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
    .\debug.cpp(400) : Destination "\Device\00000068"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"
    .\debug.cpp(400) : Destination "\Device\USBFDO-1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3a7f9ce5&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\0000007d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"
    .\debug.cpp(400) : Destination "\Device\Harddisk0\DR0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0846&PID_9001#12345#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#Disk&Ven_WDC_WD50&Prod_00AADS-00S9B#4&2a8602f4&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000073"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ROOT#*6TO4MP#0005#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\000000a5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ConexantDiagnosticsServer"
    .\debug.cpp(400) : Destination "\Device\ConexantDiagnosticsServer"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"
    .\debug.cpp(400) : Destination "\DosDevices\LPT1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TUNMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000007"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\RKSAMPLE0"
    .\debug.cpp(400) : Destination "\Device\RKSAMPLE0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\H:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume6"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{f4870f65-30df-11df-b623-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\CdRom3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\mfehidk"
    .\debug.cpp(400) : Destination "\Device\mfehidk"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1"
    .\debug.cpp(400) : Destination "\Device\Harddisk1\DR1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#CdRom&Ven_WD&Prod_Virtual_CD_070A&Rev_1030#575842304139394E36343335&1#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\000000ac"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"
    .\debug.cpp(400) : Destination "\Device\CdRom0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#UMBUS#0000#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"
    .\debug.cpp(400) : Destination "\Device\0000005a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-e1d1f263-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(400) : Destination "\Device\UMDFCtrlDev-e1d1f263-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0846&PID_9001#12345#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"
    .\debug.cpp(400) : Destination "\Device\FsWrap"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive2"
    .\debug.cpp(400) : Destination "\Device\Harddisk2\DR2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{77DE852F-99D2-4590-9092-A39F2F1654C8}"
    .\debug.cpp(400) : Destination "\Device\NDMP8"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&WpdBusEnumRoot#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"
    .\debug.cpp(400) : Destination "\Device\0000009b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SUN_VBOXNETFLTMP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000056"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\0000004f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#volmgr#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\0000005d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{00a05410-1bd3-11df-845f-806e6f6e6963}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive3"
    .\debug.cpp(400) : Destination "\Device\Harddisk3\DR3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-MSC&PROD_&REV_#20021111153705700##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
    .\debug.cpp(400) : Destination "\Device\0000009e"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"
    .\debug.cpp(400) : Destination "\GLOBAL??"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VBoxUSBMon"
    .\debug.cpp(400) : Destination "\Device\VBoxUSBMon"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\JSWPSLWF"
    .\debug.cpp(400) : Destination "\Device\JSWPSLWF"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_16_Model_2#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
    .\debug.cpp(400) : Destination "\Device\00000060"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\0000004b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ISCSIPRT#0000#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\0000000a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\I:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume7"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature81E6FOffset7E00Length3A0ECF8000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume10"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive4"
    .\debug.cpp(400) : Destination "\Device\Harddisk4\DR4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LOG:"
    .\debug.cpp(400) : Destination "\clfs"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-SMC&PROD_&REV_#20021111153705700##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
    .\debug.cpp(400) : Destination "\Device\0000009f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_147A&PID_E018&MI_01#7&261b54c5&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\0000008f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom3"
    .\debug.cpp(400) : Destination "\Device\CdRom3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ROOT#*6TO4MP#0005#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\000000a5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{71985f48-1ca1-11d3-9cc8-00c04f7971e0}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\vmci"
    .\debug.cpp(400) : Destination "\Device\vmci"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_147A&PID_E018#000034E0#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000050"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0070#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000005"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{b3d8d2bc-1bdf-11df-95df-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume6"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{b3d8d2ae-1bdf-11df-95df-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive5"
    .\debug.cpp(400) : Destination "\Device\Harddisk5\DR5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-e1d1f267-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(400) : Destination "\Device\UMDFCtrlDev-e1d1f267-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Secdrv"
    .\debug.cpp(400) : Destination "\Device\Secdrv"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#GWY078B#5&7f237b6&0&UID256#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}"
    .\debug.cpp(400) : Destination "\Device\00000099"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000003"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THRM#{4afa3d51-74a7-11d0-be5e-00a0c9062857}"
    .\debug.cpp(400) : Destination "\Device\00000067"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{b3d8d2c2-1bdf-11df-95df-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume7"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive6"
    .\debug.cpp(400) : Destination "\Device\Harddisk6\DR8"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col03#2&20751cd0&0&0002#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000093"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\hcmon"
    .\debug.cpp(400) : Destination "\Device\hcmon"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HSF_MDMDevice0"
    .\debug.cpp(400) : Destination "\Device\HSF_MDMDevice0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F6&SUBSYS_26061019&REV_A2#3&2411e6fe&0&40#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0010"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??
     
  15. sonoftheflame

    sonoftheflame TS Rookie Topic Starter

    \USBSTOR#CdRom&Ven_WD&Prod_Virtual_CD_070A&Rev_1030#575842304139394E36343335&1#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\000000ac"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{A26DFC6B-3AF3-4E96-8F6A-C7AA25A10799}"
    .\debug.cpp(400) : Destination "\Device\NDMP15"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{a799a802-a46d-11d0-a18c-00a02401dcd4}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F1&SUBSYS_26061019&REV_A3#3&2411e6fe&0&10#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0004"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\J:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\catchme"
    .\debug.cpp(400) : Destination "\Device\catchme"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-MMC&PROD_&REV_#20021111153705700##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
    .\debug.cpp(400) : Destination "\Device\0000009d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Other&Ven_WD&Prod_SES_Device&Rev_1030#575842304139394E36343335&2#{57edcd85-0281-4893-a224-6719f892b1a4}"
    .\debug.cpp(400) : Destination "\Device\000000ad"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\nativewifip"
    .\debug.cpp(400) : Destination "\Device\nativewifip"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10192107&REV_1001#4&11e9ef39&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\0000007b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\0000004e"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_14F1&DEV_2F40&SUBSYS_200014F1&REV_00#4&2cf26b65&0&3020#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy20"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy20"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-CFC&PROD_&REV_#20021111153705700##{6bdd1fc6-810f-11d0-bec7-08002be2092f}"
    .\debug.cpp(400) : Destination "\Device\0000009c"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{25A0D7FC-7689-40E7-8B0E-6ED66911F23C}"
    .\debug.cpp(400) : Destination "\Device\NDMP20"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-MSC&PROD_&REV_#20021111153705700##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
    .\debug.cpp(400) : Destination "\Device\0000009e"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col03#7&25dd1412&0&0002#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000085"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col06#2&20751cd0&0&0005#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000096"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy21"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy21"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col08#2&20751cd0&0&0007#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000098"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000050"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*6TO4MP#0004#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000001"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&3c82c0d&0&1#{2accfe60-c130-11d2-b082-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\Ide\PciIde0Channel1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"
    .\debug.cpp(400) : Destination "\Device\MountPointManager"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&SignatureAB562A8AOffset2BCA00000Length71B4000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-MMC&PROD_&REV_#20021111153705700##{6bdd1fc6-810f-11d0-bec7-08002be2092f}"
    .\debug.cpp(400) : Destination "\Device\0000009d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy22"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy22"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\0000004c"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000004a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy15"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy15"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\K:"
    .\debug.cpp(400) : Destination "\Device\CdRom3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Nsi"
    .\debug.cpp(400) : Destination "\Device\Nsi"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_WD&Prod_My_Passport_070A&Rev_1030#575842304139394E36343335&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\000000ab"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy23"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy23"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col07#2&20751cd0&0&0006#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000097"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col01#7&25dd1412&0&0000#{1e0886f0-4876-47fe-b3fd-c9851b2bcff2}"
    .\debug.cpp(400) : Destination "\Device\00000083"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"
    .\debug.cpp(400) : Destination "\Device\WANARP"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03EF&SUBSYS_26061019&REV_A2#3&2411e6fe&0&38#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0009"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy16"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy16"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PartmgrControl"
    .\debug.cpp(400) : Destination "\Device\PartmgrControl"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy24"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy24"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{54950694-33A2-408C-9E06-ABBEB791E26F}"
    .\debug.cpp(400) : Destination "\Device\NDMP14"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NXTIPSECDevice"
    .\debug.cpp(400) : Destination "\Device\NXTIPSEC"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1002&DEV_94C1&SUBSYS_11101462&REV_00#4&3b4d693&0&0048#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_045E&PID_00F9#5&289d75ce&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"
    .\debug.cpp(400) : Destination "\Device\USBPDO-2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\0000004a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{33d9a762-90c8-11d0-bd43-00a0c911ce86}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy17"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy17"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col04#2&20751cd0&0&0003#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000094"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{AC107A68-B74F-4FE2-9D56-1ABF2CFB000E}"
    .\debug.cpp(400) : Destination "\Device\NDMP17"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"
    .\debug.cpp(400) : Destination "\Device\NDMP11"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WFPDev"
    .\debug.cpp(400) : Destination "\Device\WFP"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy18"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy18"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col01#2&20751cd0&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000091"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{B42550C4-9D26-42A1-81EF-85FFE13259CD}"
    .\debug.cpp(400) : Destination "\Device\NDMP3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArpV6"
    .\debug.cpp(400) : Destination "\Device\WANARPV6"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_00#7&205d650&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000082"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"
    .\debug.cpp(400) : Destination "\Device\Ide\IdePort0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy19"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolumeShadowCopy19"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{00a05411-1bd3-11df-845f-806e6f6e6963}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10192107&REV_1001#4&11e9ef39&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\0000007b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-CFC&PROD_&REV_#20021111153705700##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
    .\debug.cpp(400) : Destination "\Device\0000009c"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col02#2&20751cd0&0&0001#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000092"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&PrinterBusEnumerator#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"
    .\debug.cpp(400) : Destination "\Device\000000a0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\lirsgt"
    .\debug.cpp(400) : Destination "\Device\lirsgt"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3a7f9ce5&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}"
    .\debug.cpp(400) : Destination "\Device\0000007d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3a7f9ce5&0&0001#{dba43692-ad00-48aa-b1a7-ffa99a04ee17}"
    .\debug.cpp(400) : Destination "\Device\0000007d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10192107&REV_1001#4&11e9ef39&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\0000007b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0070#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000005"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_HL-DT-ST&Prod_BDDVDRW_GGC-H20N#4&17cc524f&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000075"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_IOI-MSC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\0000008b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col08#2&20751cd0&0&0007#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000098"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_16_Model_2#_2#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
    .\debug.cpp(400) : Destination "\Device\00000061"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"
    .\debug.cpp(400) : Destination "\Device\00000057"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000004f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANBH"
    .\debug.cpp(400) : Destination "\Device\NDMP10"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"
    .\debug.cpp(400) : Destination "\Device\NdisWan"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AscKmd"
    .\debug.cpp(400) : Destination "\Device\AscKmd"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#Default_Monitor#5&7f237b6&0&UID259#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}"
    .\debug.cpp(400) : Destination "\Device\0000009a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:"
    .\debug.cpp(400) : Destination "\Device\Ide\IdePort1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_16_Model_2#_3#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
    .\debug.cpp(400) : Destination "\Device\00000062"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_14F1&DEV_2F40&SUBSYS_200014F1&REV_00#4&2cf26b65&0&3020#{adb44c00-1b8d-11d4-8d5e-00a0c90d1c42}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\M:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume10"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{2cb1dd8c-312c-11df-bfae-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume3"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_IOI-SMC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-MSC&PROD_&REV_#20021111153705700##{6bdd1fc6-810f-11d0-bec7-08002be2092f}"
    .\debug.cpp(400) : Destination "\Device\0000009e"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MpsDevice"
    .\debug.cpp(400) : Destination "\Device\MPS"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VMwareKbdFilter"
    .\debug.cpp(400) : Destination "\Device\VMwareKbdFilter"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10192107&REV_1001#4&11e9ef39&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}"
    .\debug.cpp(400) : Destination "\Device\0000007b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_16_Model_2#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
    .\debug.cpp(400) : Destination "\Device\0000005f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_IOI-CFC&Prod_&Rev_#20021111153705700#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume4"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#Disk&Ven_Hitachi&Prod_HDP725050GLA#4&2a8602f4&0&010100#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\00000074"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col05#2&20751cd0&0&0004#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000095"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\vmx86"
    .\debug.cpp(400) : Destination "\Device\vmx86"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\vstor2-ws60"
    .\debug.cpp(400) : Destination "\Device\vstor2-ws60"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SUN_VBOXNETFLTMP#0001#{cac88484-7515-4c03-82e6-71a87abac361}"
    .\debug.cpp(400) : Destination "\Device\00000055"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10192107&REV_1001#4&11e9ef39&0&0001#{86841137-ed8e-4d97-9975-f2ed56b4430e}"
    .\debug.cpp(400) : Destination "\Device\0000007b"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"
    .\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"
    .\debug.cpp(400) : Destination "\Device\VolMgrControl"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{b3d8d2b2-1bdf-11df-95df-001e9065ca45}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"
    .\debug.cpp(400) : Destination "\Device\MailSlot"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col04#7&25dd1412&0&0003#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000086"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DNISP50"
    .\debug.cpp(400) : Destination "\Device\DNISP50"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIPV6"
    .\debug.cpp(400) : Destination "\Device\NDMP12"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col02#7&25dd1412&0&0001#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000084"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"
    .\debug.cpp(400) : Destination "\DosDevices\COM1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&SignatureAB562A8AOffset7E00Length2BC962C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"
    .\debug.cpp(400) : Destination ""
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_01&Col02#7&25dd1412&0&0001#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000084"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{690D19CD-C098-4362-9642-1E674F894573}"
    .\debug.cpp(400) : Destination "\Device\NDMP5"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"
    .\debug.cpp(400) : Destination "\Device\Null"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-e1d1f26f-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(400) : Destination "\Device\UMDFCtrlDev-e1d1f26f-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SstpDrv"
    .\debug.cpp(400) : Destination "\Device\SstpDrv"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\atksgt"
    .\debug.cpp(400) : Destination "\Device\atksgt"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000053"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"
    .\debug.cpp(400) : Destination "\Device\Ndisuio"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#Default_Monitor#5&7f237b6&0&UID259#{866519b5-3f07-4c97-b7df-24c5d8a8ccb8}"
    .\debug.cpp(400) : Destination "\Device\0000009a"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2:"
    .\debug.cpp(400) : Destination "\Device\RaidPort0"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VBoxDrv"
    .\debug.cpp(400) : Destination "\Device\VBoxDrv"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000#5&3a7f9ce5&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
    .\debug.cpp(400) : Destination "\Device\0000007d"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{AB07494E-3FDA-4D7D-BAC5-DB1349A6F475}"
    .\debug.cpp(400) : Destination "\Device\NDMP18"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-e1d1f26b-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(400) : Destination "\Device\UMDFCtrlDev-e1d1f26b-7f26-11e0-849f-001e9065ca45"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col07#2&20751cd0&0&0006#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000097"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000052"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WfpAle"
    .\debug.cpp(400) : Destination "\Device\WfpAle"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1745&DEV_2100&SUBSYS_48B81043&REV_00#4&30cc26d1&0&0060#{19689bf6-c384-48fd-ad51-90e58c79f70b}"
    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0018"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&1&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_IOI-SMC&PROD_&REV_#20021111153705700##{6bdd1fc6-810f-11d0-bec7-08002be2092f}"
    .\debug.cpp(400) : Destination "\Device\0000009f"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PROCEXP113"
    .\debug.cpp(400) : Destination "\Device\PROCEXP113"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00F9&MI_00#7&205d650&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"
    .\debug.cpp(400) : Destination "\Device\00000082"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#IrDevice&Col05#2&20751cd0&0&0004#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
    .\debug.cpp(400) : Destination "\Device\00000095"
    .\debug.cpp(409) : --
    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
    .\debug.cpp(400) : Destination "\Device\0000004d"
    .\debug.cpp(409) : --
    .\debug.cpp(453) : **********************************************
    .\boot_cleaner.cpp(565) : System volume is \\.\C:
    .\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000002`bca00000
    .\diskio.cpp(204) : ATA_Read(): DeviceIoControl() ERROR 1
    .\boot_cleaner.cpp(276) : Boot sector MD5 is: 0ec6b2481fc707d1e901dc2a875f2826
    .\boot_cleaner.cpp(1060) :
    .\boot_cleaner.cpp(1061) : Size Device Name MBR Status
    .\boot_cleaner.cpp(1062) : --------------------------------------------
    .\boot_cleaner.cpp(1106) : 465 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
    .\boot_cleaner.cpp(1112) :
    .\boot_cleaner.cpp(1151) : Done;
     
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Okay then- I will stop worrying about that! I note you have 2 of the same entries in the HJT log:
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe


    There is no number distinguishing one from the other. You should be able to just remove one of these
    =================================
    If none of the original problem remain, you can remove the cleaning tools. The system is clean:
    Removing all of the tools we used and the files and folders they created
    • Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    • Download OTCleanIt by OldTimer and save it to your Desktop.
    • Double click OTCleanIt.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

    • You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
    • Go to Start > All Programs > Accessories > System Tools
    • Click "System Restore".
    • Choose "Create a Restore Point" on the first screen then click "Next".
    • Give the Restore Point a name> click "Create".
    • Go back and follow the path to > System Tools.
      [*]Choose Disc Cleanup
      [*]Click "OK" to select the partition or drive you want.
      [*]Click the "More Options" Tab.
      [*]Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.


    Empty the Recycle Bin

    Let me know if you have any questions.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...