TechSpot

Browser Hijacked, I need help with HijackThis log

By 2janealec
Jan 16, 2011
  1. Help
    this is annoying
    Im a lil puter literate
    but this has stumped me
    please please can anyone help?
    thank you in advance

    [HJT log removed - Broni]
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    thank you
    I will follow the directions
     
  4. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    OK............
     
  5. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    logs

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-01-16 18:40:15
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 FUJITSU_MHT2040AH rev.006C
    Running: 52l76lzg.exe; Driver: C:\DOCUME~1\Alec\LOCALS~1\Temp\kwwdafod.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 03: rootkit-like behavior; copy of MBR
    Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 05: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 06: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 07: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 09: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 11: rootkit-like behavior; copy of MBR
    Disk \Device\Harddisk0\DR0 sector 12: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 82F4739B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 82F4739B
    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

    Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskFUJITSU_MHT2040AH_______________________006C____#5&a369a1&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- EOF - GMER 1.0.15 ----

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-01-16 18:40:15
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 FUJITSU_MHT2040AH rev.006C
    Running: 52l76lzg.exe; Driver: C:\DOCUME~1\Alec\LOCALS~1\Temp\kwwdafod.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 03: rootkit-like behavior; copy of MBR
    Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 05: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 06: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 07: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 09: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 11: rootkit-like behavior; copy of MBR
    Disk \Device\Harddisk0\DR0 sector 12: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 82F4739B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 82F4739B
    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

    Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskFUJITSU_MHT2040AH_______________________006C____#5&a369a1&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- EOF - GMER 1.0.15 ----

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5534

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    1/16/2011 6:24:15 PM
    mbam-log-2011-01-16 (18-24-15).txt

    Scan type: Quick scan
    Objects scanned: 131124
    Time elapsed: 9 minute(s), 47 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 11/4/2009 2:56:05 AM
    System Uptime: 1/16/2011 5:11:28 PM (1 hours ago)

    Motherboard: IBM | | 23737FU
    Processor: Intel(R) Pentium(R) M processor 1600MHz | None | 1594/400mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 34 GiB total, 26.141 GiB free.
    D: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Video Controller (VGA Compatible)
    Device ID: PCI\VEN_1002&DEV_4C57&SUBSYS_05301014&REV_00\4&CBDCD63&0&0008
    Manufacturer:
    Name: Video Controller (VGA Compatible)
    PNP Device ID: PCI\VEN_1002&DEV_4C57&SUBSYS_05301014&REV_00\4&CBDCD63&0&0008
    Service:

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Infrared Port
    Device ID: ROOT\MS_IRDAMINIPORT\0000
    Manufacturer: Microsoft
    Name: Infrared Port
    PNP Device ID: ROOT\MS_IRDAMINIPORT\0000
    Service: Rasirda

    ==== System Restore Points ===================

    RP194: 1/16/2011 5:12:30 PM - System Checkpoint

    ==== Installed Programs ======================

    Adobe Download Manager
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 6.0
    Agere Systems AC'97 Modem
    AVG 2011
    Canon MP Navigator 2.0
    Canon MP450
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    IBM ThinkPad Power Management Driver
    IBM ThinkPad UltraNav Driver
    Intel(R) PRO Network Connections Drivers
    Java Auto Updater
    Java(TM) 6 Update 23
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Antimalware
    Microsoft Application Error Reporting
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office 97, Professional Edition
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox (3.6.13)
    MSXML 6.0 Parser (KB925673)
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player (KB979402)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2183461)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360131)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2416400)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165-v2)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981349)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982381)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    SoundMAX
    ThinkPad FullScreen Magnifier
    ThinkPad Hotkey Features Setup
    ThinkPad Wireless LAN Adapters Software (11a/b, 11b/g, 11a/b/g)
    ThinkVantage Access Connections
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB978207)
    Verizon Online
    WebFldrs XP
    Windows Backup Utility
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Live OneCare safety scanner
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Presentation Foundation
    Windows XP Service Pack 3
    XML Paper Specification Shared Components Pack 1.0

    ==== Event Viewer Messages From Past Week ========

    1/16/2011 4:44:53 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000034' while processing the file '_filelst.cfg' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    1/16/2011 10:40:14 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3631.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally
    1/15/2011 7:48:01 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3631.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally
    1/14/2011 6:28:55 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3631.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally
    1/13/2011 9:15:03 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    1/12/2011 9:57:12 AM, error: Service Control Manager [7023] - The Remote Access Connection Manager service terminated with the following error: The specified module could not be found.
    1/12/2011 9:04:47 PM, error: Rasman [20063] - Remote Access Connection Manager failed to start because the Point to Point Protocol failed to initialize. The specified module could not be found.
    1/12/2011 10:27:57 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3631.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    1/11/2011 11:35:25 PM, error: Service Control Manager [7024] - The Routing and Remote Access service terminated with service-specific error 126 (0x7E).
    1/11/2011 11:35:25 PM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The specified module could not be found.
    1/11/2011 11:35:25 PM, error: Service Control Manager [7001] - The Infrared Monitor service depends on the IrDA Protocol service which failed to start because of the following error: The system cannot find the file specified.
    1/11/2011 11:35:25 PM, error: Service Control Manager [7000] - The IrDA Protocol service failed to start due to the following error: The system cannot find the file specified.
    1/11/2011 11:35:25 PM, error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The system cannot find the file specified.
    1/11/2011 11:35:21 PM, error: RemoteAccess [20103] - Unable to load C:\WINDOWS\System32\mprddm.dll.
    1/11/2011 11:34:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    1/11/2011 10:49:43 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD ANC Avgldx86 Avgmfx86 Avgtdix Fips IBMTPCHK intelppm IPSec MpFilter MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip TPHKDRV
    1/11/2011 10:49:43 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    1/11/2011 10:49:43 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/11/2011 10:49:43 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/11/2011 10:49:43 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    1/11/2011 10:49:12 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    1/11/2011 10:05:16 PM, error: PSched [14103] - QoS [Adapter {9E3634ED-96E0-493D-8EA5-3FBA4DC72102}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
    1/11/2011 10:03:27 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3631.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally
    1/10/2011 6:38:42 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally
    1/10/2011 6:38:06 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?Lin...2.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: YOUR-929C560D3A\Alec Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072f76 Error description: The requested header was not found
    1/10/2011 6:38:06 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?Lin...2.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: YOUR-929C560D3A\Alec Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072f76 Error description: The requested header was not found
    1/10/2011 6:38:06 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?Lin...2.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: YOUR-929C560D3A\Alec Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072f76 Error description: The requested header was not found
    1/10/2011 6:38:06 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?Lin...2.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: YOUR-929C560D3A\Alec Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072f76 Error description: The requested header was not found
    1/10/2011 6:37:59 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally
    1/10/2011 6:35:29 PM, error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
    1/10/2011 6:04:49 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.95.3152.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error code: 0x80072efe Error description: The connection with the server was terminated abnormally

    ==== End Of File ===========================



    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Alec at 18:33:07.18 on Sun 01/16/2011
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_23
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.263 [GMT -5:00]

    AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

    ============== Running Processes ===============

    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    C:\WINDOWS\System32\mshta.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
    C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\System32\mshta.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Documents and Settings\Alec\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Bar = hxxp://www.google.com/ie
    uStart Page = hxxp://www.yahoo.com/
    uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    mWinlogon: Userinit=userinit.exe
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    mRun: [AGRSMMSG] AGRSMMSG.exe
    mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe
    mRun: [ACWLIcon] c:\program files\thinkpad\connectutilities\ACWLIcon.exe
    mRun: [TPHOTKEY] c:\progra~1\lenovo\pkgmgr\hotkey\TPHKMGR.exe
    mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
    mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray
    mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: vzTCPConfig - hxxp://www.verizon.net/checkmypc/includes/vzTCPConfig.CAB
    DPF: {2DAD3559-2923-4935-AD49-B673D2539944} - hxxp://www-307.ibm.com/pc/support/acpir.cab
    DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1292689346124
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
    Notify: ACNotify - ACNotify.dll
    Notify: tpfnf2 - notifyf2.dll
    Notify: tphotkey - tphklock.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Notification Packages = scecli ACGina

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\alec\applic~1\mozilla\firefox\profiles\eetd05ha.default\
    FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
    FF - prefs.js: network.proxy.type - 0
    FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg10\Firefox
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

    ============= SERVICES / DRIVERS ===============

    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 249424]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 298448]
    R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-10-11 6104656]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
    S2 avgwd;AVG WatchDog;"c:\program files\avg\avg10\avgwdsvc.exe" --> c:\program files\avg\avg10\avgwdsvc.exe [?]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2010-10-17 517448]

    =============== Created Last 30 ================

    2011-01-16 22:05:39 -------- d-----w- c:\windows\system32\wbem\Logs
    2011-01-16 21:25:17 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-01-16 21:25:17 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-16 21:25:17 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2011-01-16 21:14:49 -------- d-----w- c:\program files\temp file cleaner
    2011-01-16 18:49:03 388096 ----a-r- c:\docume~1\alec\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2011-01-13 03:15:29 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-01-13 03:15:29 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-01-12 03:06:01 -------- d-----w- c:\program files\Trend Micro
    2011-01-11 03:49:37 6273872 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{dfe2c97e-bd9d-4fb1-a00a-457f8d378a81}\mpengine.dll
    2011-01-10 23:57:28 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll
    2011-01-10 23:57:28 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    2011-01-10 23:57:26 16856 ----a-w- c:\program files\mozilla firefox\plugin-container.exe
    2011-01-10 23:57:25 719832 ----a-w- c:\program files\mozilla firefox\mozcpp19.dll
    2010-12-19 20:29:41 -------- d-----w- c:\docume~1\alec\applic~1\StreamTorrent
    2010-12-19 20:22:41 6273872 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
    2010-12-18 21:45:37 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
    2010-12-18 21:05:24 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
    2010-12-18 21:05:23 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-12-18 17:23:02 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-12-18 17:14:12 -------- d-----w- c:\program files\Microsoft Security Client
    2010-12-18 16:44:08 -------- d-----w- C:\525f43d0b6e31b03a44687

    ==================== Find3M ====================

    2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-05 05:05:36 667136 ----a-w- c:\windows\system32\wininet.dll
    2010-11-05 05:05:36 667136 ----a-w- c:\windows\system32\SET27F.tmp
    2010-11-05 05:05:36 629760 ----a-w- c:\windows\system32\SET280.tmp
    2010-11-05 05:05:36 61952 ----a-w- c:\windows\system32\tdc.ocx
    2010-11-05 05:05:36 1510400 ----a-w- c:\windows\system32\SET282.tmp
    2010-11-05 05:05:35 81920 ----a-w- c:\windows\system32\ieencode.dll
    2010-11-05 05:05:35 3076096 ----a-w- c:\windows\system32\SET285.tmp
    2010-11-03 12:59:07 369664 ----a-w- c:\windows\system32\html.iec
    2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\SET2AE.tmp
    2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys

    =================== ROOTKIT ====================

    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: FUJITSU_MHT2040AH rev.006C -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

    device: opened successfully
    user: MBR read successfully

    Disk trace:
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82F47555]<<
    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x82f4d7b0]; MOV EAX, [0x82f4d82c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
    1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x82F55AB8]
    3 CLASSPNP[0xF8775FD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\000000a0[0x82F1CF18]
    5 ACPI[0xF866C620] -> nt!IofCallDriver[0x804E37D5] -> [0x82F36940]
    \Driver\atapi[0x82F5C8E0] -> IRP_MJ_CREATE -> 0x82F47555
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SI, 0x7c00; MOV DI, 0x7a00; MOV SS, AX; MOV SP, DI; MOV DS, AX; MOV ES, AX; MOV CX, 0x200; CLD ; REP MOVSB ; JMP FAR 0x0:0x7a1b; }
    detected disk devices:
    \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskFUJITSU_MHT2040AH_______________________006C____#5&a369a1&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x82F4739B
    user & kernel MBR OK
    copy of MBR has been found in sector 3 !
    copy of MBR has been found in sector 11 !
    Warning: possible TDL3 rootkit infection !

    ============= FINISH: 18:34:19.65 ===============
     
  6. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    FF status

    yahoo is now only in text
    and while downloading the various tools I would get knocked on the wireless router
    just kept re-downloading
     
  7. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  8. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    2011/01/16 20:28:06.0522 TDSS rootkit removing tool 2.4.13.0 Jan 12 2011 09:51:11
    2011/01/16 20:28:06.0522 ================================================================================
    2011/01/16 20:28:06.0522 SystemInfo:
    2011/01/16 20:28:06.0522
    2011/01/16 20:28:06.0522 OS Version: 5.1.2600 ServicePack: 3.0
    2011/01/16 20:28:06.0522 Product type: Workstation
    2011/01/16 20:28:06.0522 ComputerName: YOUR-929C560D3A
    2011/01/16 20:28:06.0522 UserName: Alec
    2011/01/16 20:28:06.0522 Windows directory: C:\WINDOWS
    2011/01/16 20:28:06.0522 System windows directory: C:\WINDOWS
    2011/01/16 20:28:06.0522 Processor architecture: Intel x86
    2011/01/16 20:28:06.0522 Number of processors: 1
    2011/01/16 20:28:06.0522 Page size: 0x1000
    2011/01/16 20:28:06.0522 Boot type: Normal boot
    2011/01/16 20:28:06.0522 ================================================================================
    2011/01/16 20:28:08.0354 Initialize success
    2011/01/16 20:28:47.0230 ================================================================================
    2011/01/16 20:28:47.0230 Scan started
    2011/01/16 20:28:47.0230 Mode: Manual;
    2011/01/16 20:28:47.0230 ================================================================================
    2011/01/16 20:28:47.0781 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
    2011/01/16 20:28:47.0921 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/01/16 20:28:48.0021 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
    2011/01/16 20:28:48.0201 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
    2011/01/16 20:28:48.0352 aeaudio (9f59ae2de835641fbb0c6afd80d8fa9b) C:\WINDOWS\system32\drivers\aeaudio.sys
    2011/01/16 20:28:48.0442 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2011/01/16 20:28:48.0572 AegisP (91f3df93f40a74d222cd166fe95db633) C:\WINDOWS\system32\DRIVERS\AegisP.sys
    2011/01/16 20:28:48.0852 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
    2011/01/16 20:28:49.0043 AgereSoftModem (aff071b6290776e1fa162837c35eac78) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
    2011/01/16 20:28:49.0273 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
    2011/01/16 20:28:49.0353 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
    2011/01/16 20:28:49.0553 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
    2011/01/16 20:28:49.0664 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
    2011/01/16 20:28:49.0784 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
    2011/01/16 20:28:49.0934 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
    2011/01/16 20:28:50.0004 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
    2011/01/16 20:28:50.0104 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
    2011/01/16 20:28:50.0214 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
    2011/01/16 20:28:50.0325 ANC (11ab185a7af224800bbfb5b836974a17) C:\WINDOWS\system32\drivers\ANC.SYS
    2011/01/16 20:28:50.0485 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
    2011/01/16 20:28:50.0575 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
    2011/01/16 20:28:50.0665 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
    2011/01/16 20:28:50.0945 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/01/16 20:28:51.0046 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/01/16 20:28:51.0276 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/01/16 20:28:51.0446 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/01/16 20:28:51.0666 AVGIDSDriver (0c61f066f4d94bd67063dc6691935143) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
    2011/01/16 20:28:51.0777 AVGIDSEH (84853f800cd69252c3c764fe50d0346f) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
    2011/01/16 20:28:51.0937 AVGIDSFilter (28d6adcd03e10f3838488b9b5d407dd4) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
    2011/01/16 20:28:52.0107 AVGIDSShim (0eb16f4dbbb946360af30d2b13a52d1d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
    2011/01/16 20:28:52.0227 Avgldx86 (1119e5bec6e749e0d292f0f84d48edba) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
    2011/01/16 20:28:52.0377 Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
    2011/01/16 20:28:52.0478 Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
    2011/01/16 20:28:52.0668 Avgtdix (2fd3e3a57fb90679a3a83eeed0360cfd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
    2011/01/16 20:28:52.0958 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/01/16 20:28:53.0149 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
    2011/01/16 20:28:53.0299 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/01/16 20:28:53.0469 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
    2011/01/16 20:28:53.0609 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/01/16 20:28:53.0739 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/01/16 20:28:53.0840 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/01/16 20:28:54.0130 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
    2011/01/16 20:28:54.0240 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
    2011/01/16 20:28:54.0360 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
    2011/01/16 20:28:54.0551 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
    2011/01/16 20:28:54.0671 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
    2011/01/16 20:28:54.0721 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
    2011/01/16 20:28:54.0831 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/01/16 20:28:54.0971 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/01/16 20:28:55.0101 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    2011/01/16 20:28:55.0202 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/01/16 20:28:55.0342 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/01/16 20:28:55.0462 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
    2011/01/16 20:28:55.0512 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/01/16 20:28:55.0632 E1000 (4de4bae4accb5a49fa85801d4f226355) C:\WINDOWS\system32\DRIVERS\e1000325.sys
    2011/01/16 20:28:55.0832 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/01/16 20:28:56.0013 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/01/16 20:28:56.0123 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    2011/01/16 20:28:56.0203 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/01/16 20:28:56.0313 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/01/16 20:28:56.0423 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/01/16 20:28:56.0533 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/01/16 20:28:56.0684 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/01/16 20:28:56.0794 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
    2011/01/16 20:28:56.0924 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/01/16 20:28:57.0084 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
    2011/01/16 20:28:57.0184 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
    2011/01/16 20:28:57.0365 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/01/16 20:28:57.0575 IBMPMDRV (293131c1da5f53cb05f75d637739d79c) C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
    2011/01/16 20:28:57.0755 IBMTPCHK (3a7dbe81ec5edb96a0a61c7d4af3198d) C:\WINDOWS\system32\Drivers\IBMBLDID.sys
    2011/01/16 20:28:57.0935 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/01/16 20:28:58.0166 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
    2011/01/16 20:28:58.0316 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
    2011/01/16 20:28:58.0396 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/01/16 20:28:58.0506 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/01/16 20:28:58.0677 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/01/16 20:28:58.0807 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/01/16 20:28:58.0907 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/01/16 20:28:59.0097 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/01/16 20:28:59.0297 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/01/16 20:28:59.0428 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/01/16 20:28:59.0548 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/01/16 20:28:59.0608 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/01/16 20:28:59.0738 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/01/16 20:29:00.0028 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/01/16 20:29:00.0129 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    2011/01/16 20:29:00.0219 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/01/16 20:29:00.0279 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/01/16 20:29:00.0409 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
    2011/01/16 20:29:00.0549 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
    2011/01/16 20:29:00.0679 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/01/16 20:29:00.0890 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/01/16 20:29:01.0100 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/01/16 20:29:01.0290 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/01/16 20:29:01.0491 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/01/16 20:29:01.0651 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/01/16 20:29:01.0781 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/01/16 20:29:01.0871 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/01/16 20:29:02.0182 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/01/16 20:29:02.0272 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/01/16 20:29:02.0402 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/01/16 20:29:02.0532 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/01/16 20:29:02.0702 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/01/16 20:29:02.0832 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/01/16 20:29:02.0953 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/01/16 20:29:03.0183 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/01/16 20:29:03.0293 NSCIRDA (2adc0ca9945c65284b3d19bc18765974) C:\WINDOWS\system32\DRIVERS\nscirda.sys
    2011/01/16 20:29:03.0483 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/01/16 20:29:03.0684 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/01/16 20:29:03.0994 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/01/16 20:29:04.0285 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/01/16 20:29:04.0415 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/01/16 20:29:04.0545 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys
    2011/01/16 20:29:04.0675 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    2011/01/16 20:29:04.0765 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/01/16 20:29:04.0915 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/01/16 20:29:05.0006 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/01/16 20:29:05.0166 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/01/16 20:29:05.0236 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
    2011/01/16 20:29:05.0606 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
    2011/01/16 20:29:05.0687 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
    2011/01/16 20:29:05.0927 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/01/16 20:29:06.0007 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/01/16 20:29:06.0107 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/01/16 20:29:06.0237 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
    2011/01/16 20:29:06.0368 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
    2011/01/16 20:29:06.0468 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
    2011/01/16 20:29:06.0598 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
    2011/01/16 20:29:06.0698 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
    2011/01/16 20:29:06.0898 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/01/16 20:29:07.0109 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/01/16 20:29:07.0289 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/01/16 20:29:07.0389 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/01/16 20:29:07.0509 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/01/16 20:29:07.0659 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/01/16 20:29:07.0780 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/01/16 20:29:07.0980 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/01/16 20:29:08.0180 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/01/16 20:29:08.0481 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/01/16 20:29:08.0641 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2011/01/16 20:29:08.0741 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    2011/01/16 20:29:08.0961 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/01/16 20:29:09.0232 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
    2011/01/16 20:29:09.0382 smwdm (1319ea66a96250d59665d133c0ff7cd0) C:\WINDOWS\system32\drivers\smwdm.sys
    2011/01/16 20:29:09.0532 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
    2011/01/16 20:29:09.0682 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/01/16 20:29:09.0883 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/01/16 20:29:10.0043 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/01/16 20:29:10.0223 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/01/16 20:29:10.0303 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/01/16 20:29:10.0433 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
    2011/01/16 20:29:10.0504 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
    2011/01/16 20:29:10.0564 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
    2011/01/16 20:29:10.0624 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
    2011/01/16 20:29:10.0734 SynTP (1cde0a5c0416187b9b89e03980c6e8de) C:\WINDOWS\system32\DRIVERS\SynTP.sys
    2011/01/16 20:29:10.0844 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/01/16 20:29:10.0994 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/01/16 20:29:11.0134 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/01/16 20:29:11.0235 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/01/16 20:29:11.0295 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/01/16 20:29:11.0495 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
    2011/01/16 20:29:11.0595 TPHKDRV (29f3601d4233a53f819010fee8c04a60) C:\WINDOWS\system32\drivers\TPHKDRV.sys
    2011/01/16 20:29:11.0855 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/01/16 20:29:11.0976 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
    2011/01/16 20:29:12.0136 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/01/16 20:29:12.0356 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/01/16 20:29:12.0506 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/01/16 20:29:12.0657 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/01/16 20:29:12.0767 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2011/01/16 20:29:12.0937 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2011/01/16 20:29:13.0057 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/01/16 20:29:13.0187 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/01/16 20:29:13.0378 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2011/01/16 20:29:13.0468 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
    2011/01/16 20:29:13.0568 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
    2011/01/16 20:29:13.0678 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/01/16 20:29:13.0948 w70n51 (8e5cf571c00c806ed7c08dbb74356646) C:\WINDOWS\system32\DRIVERS\w70n51.sys
    2011/01/16 20:29:14.0149 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/01/16 20:29:14.0359 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/01/16 20:29:14.0810 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2011/01/16 20:29:14.0960 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2011/01/16 20:29:15.0160 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
    2011/01/16 20:29:15.0180 ================================================================================
    2011/01/16 20:29:15.0180 Scan finished
    2011/01/16 20:29:15.0180 ================================================================================
    2011/01/16 20:29:15.0250 Detected object count: 1
    2011/01/16 20:29:31.0564 \HardDisk0 - will be cured after reboot
    2011/01/16 20:29:31.0564 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
    2011/01/16 20:29:37.0893 Deinitialize success
     
  9. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Good :)

    How is redirection?

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    =======================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  10. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 169):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EE000 \WINDOWS\system32\hal.dll
    0xF8BB5000 \WINDOWS\system32\KDCOM.DLL
    0xF8AC5000 \WINDOWS\system32\BOOTVID.dll
    0xF8666000 ACPI.sys
    0xF8BB7000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF8655000 pci.sys
    0xF86B5000 isapnp.sys
    0xF8AC9000 ACPIEC.sys
    0xF8C7D000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF8ACD000 compbatt.sys
    0xF8AD1000 \WINDOWS\System32\DRIVERS\BATTC.SYS
    0xF8C7E000 pciide.sys
    0xF8935000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF8BB9000 aliide.sys
    0xF8BBB000 intelide.sys
    0xF8BBD000 toside.sys
    0xF8BBF000 viaide.sys
    0xF8BC1000 cmdide.sys
    0xF8637000 pcmcia.sys
    0xF86C5000 MountMgr.sys
    0xF8618000 ftdisk.sys
    0xF893D000 PartMgr.sys
    0xF86D5000 VolSnap.sys
    0xF8AD5000 cpqarray.sys
    0xF8600000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
    0xF85E8000 atapi.sys
    0xF8AD9000 aha154x.sys
    0xF8945000 sparrow.sys
    0xF8ADD000 symc810.sys
    0xF86E5000 aic78xx.sys
    0xF8AE1000 dac960nt.sys
    0xF86F5000 ql10wnt.sys
    0xF8AE5000 amsint.sys
    0xF894D000 asc.sys
    0xF8AE9000 asc3550.sys
    0xF8955000 mraid35x.sys
    0xF895D000 i2omp.sys
    0xF8AED000 ini910u.sys
    0xF8705000 ql1240.sys
    0xF8715000 aic78u2.sys
    0xF8965000 symc8xx.sys
    0xF896D000 sym_hi.sys
    0xF8975000 sym_u3.sys
    0xF897D000 ABP480N5.SYS
    0xF8985000 asc3350p.sys
    0xF8BC3000 cd20xrnt.sys
    0xF8725000 ultra.sys
    0xF85CF000 adpu160m.sys
    0xF898D000 dpti2o.sys
    0xF8735000 ql1080.sys
    0xF8745000 ql1280.sys
    0xF8755000 ql12160.sys
    0xF8995000 perc2.sys
    0xF8BC5000 perc2hib.sys
    0xF899D000 hpn.sys
    0xF8AF1000 cbidf2k.sys
    0xF85A3000 dac2w2k.sys
    0xF8765000 disk.sys
    0xF8775000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF8583000 fltmgr.sys
    0xF8571000 sr.sys
    0xF855A000 KSecDD.sys
    0xF84CD000 Ntfs.sys
    0xF84A0000 NDIS.sys
    0xF8785000 sisagp.sys
    0xF8795000 viaagp.sys
    0xF8486000 Mup.sys
    0xF89A5000 avgrkx86.sys
    0xF87A5000 AVGIDSEH.Sys
    0xF87B5000 agp440.sys
    0xF87C5000 alim1541.sys
    0xF87D5000 amdagp.sys
    0xF87E5000 agpCPQ.sys
    0xF88F5000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xF8A7D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xF7DF3000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF8A85000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF7DCB000 \SystemRoot\system32\DRIVERS\e1000325.sys
    0xF7D26000 \SystemRoot\system32\DRIVERS\w70n51.sys
    0xF8905000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF8A8D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF7CE5000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF8BE3000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF8A95000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF8A9D000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xF8915000 \SystemRoot\system32\DRIVERS\serial.sys
    0xF8B85000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xF7CD1000 \SystemRoot\system32\DRIVERS\parport.sys
    0xF8AA5000 \SystemRoot\system32\DRIVERS\nscirda.sys
    0xF8B89000 \SystemRoot\system32\DRIVERS\irenum.sys
    0xF8B91000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF8AAD000 \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
    0xF7C9B000 \SystemRoot\system32\drivers\smwdm.sys
    0xF7C77000 \SystemRoot\system32\drivers\portcls.sys
    0xF8925000 \SystemRoot\system32\drivers\drmk.sys
    0xF7C54000 \SystemRoot\system32\drivers\ks.sys
    0xF7C34000 \SystemRoot\system32\drivers\aeaudio.sys
    0xF7B0F000 \SystemRoot\system32\DRIVERS\AGRSM.sys
    0xF8AB5000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF8DED000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF842E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF8B9D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF7AB8000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF841E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF840E000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF8ABD000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF7AA7000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF83FE000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF89C5000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF89CD000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF83EE000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF8BE5000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF79A9000 \SystemRoot\system32\DRIVERS\update.sys
    0xF8BAD000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF83CE000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF83BE000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7E37000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF8825000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
    0xF7912000 \SystemRoot\system32\DRIVERS\MpFilter.sys
    0xF8BF9000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF8CB0000 \SystemRoot\System32\Drivers\Null.SYS
    0xF8BFB000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF89ED000 \SystemRoot\System32\drivers\vga.sys
    0xF78FE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
    0xF8BFD000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF8BFF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF89F5000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF89FD000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF7E1B000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xF787B000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xF7822000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xF77DA000 \SystemRoot\system32\DRIVERS\avgtdix.sys
    0xF77B4000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF8835000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF778C000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xF776A000 \SystemRoot\System32\drivers\afd.sys
    0xF8845000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xF8A05000 \SystemRoot\System32\Drivers\TPHKDRV.SYS
    0xF771F000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xF76AF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF8C01000 \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
    0xF8885000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF7673000 \SystemRoot\system32\DRIVERS\avgldx86.sys
    0xF8A0D000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xF8B7D000 \SystemRoot\system32\DRIVERS\usbscan.sys
    0xF8A15000 \SystemRoot\system32\DRIVERS\usbprint.sys
    0xF8A1D000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xF79A1000 \SystemRoot\System32\drivers\ANC.SYS
    0xF756B000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF8C0D000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF7951000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF8A25000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF8D17000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBFF50000 \SystemRoot\System32\framebuf.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xF8A4D000 \SystemRoot\system32\DRIVERS\AegisP.sys
    0xF702F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xF6E1E000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF6F33000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
    0xF6CAE000 \SystemRoot\system32\DRIVERS\srv.sys
    0xF70C3000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
    0xF6BBE000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
    0xF6721000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF6AEE000 \SystemRoot\system32\drivers\sysaudio.sys
    0xF64FA000 \SystemRoot\System32\Drivers\HTTP.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 40):
    0 System Idle Process
    4 System
    720 C:\WINDOWS\system32\smss.exe
    832 csrss.exe
    860 C:\WINDOWS\system32\winlogon.exe
    904 C:\WINDOWS\system32\services.exe
    916 C:\WINDOWS\system32\lsass.exe
    1064 C:\WINDOWS\system32\ibmpmsvc.exe
    1116 C:\WINDOWS\system32\svchost.exe
    1200 svchost.exe
    1240 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    1276 C:\WINDOWS\system32\svchost.exe
    1476 svchost.exe
    1500 svchost.exe
    1828 C:\WINDOWS\system32\spoolsv.exe
    1904 svchost.exe
    1932 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    1988 C:\Program Files\Java\jre6\bin\jqs.exe
    160 C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    188 C:\WINDOWS\system32\svchost.exe
    240 C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
    304 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    1456 alg.exe
    680 C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    2808 C:\WINDOWS\explorer.exe
    2960 C:\WINDOWS\AGRSMMSG.exe
    2976 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
    3028 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    3268 C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
    3280 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    3292 C:\Program Files\Mozilla Firefox\firefox.exe
    3324 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    3332 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    3336 C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    3348 C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    3412 C:\Program Files\Microsoft Security Client\msseces.exe
    3452 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2260 C:\Program Files\Mozilla Firefox\plugin-container.exe
    3276 C:\WINDOWS\system32\wuauclt.exe
    2416 C:\Documents and Settings\Alec\My Documents\Downloads\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: FUJITSUMHT2040AH, Rev: 006C

    Size Device Name MBR Status
    --------------------------------------------
    33 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: 70C87134E2B9A75548AD05DF4F0797AF949A04C1


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Done!
     
  11. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    how do I disable microsoft security essentials?
    things are lookin more stable
     
  12. Broni

    Broni Malware Annihilator Posts: 52,892   +344

  13. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 169):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EE000 \WINDOWS\system32\hal.dll
    0xF8BB5000 \WINDOWS\system32\KDCOM.DLL
    0xF8AC5000 \WINDOWS\system32\BOOTVID.dll
    0xF8666000 ACPI.sys
    0xF8BB7000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF8655000 pci.sys
    0xF86B5000 isapnp.sys
    0xF8AC9000 ACPIEC.sys
    0xF8C7D000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF8ACD000 compbatt.sys
    0xF8AD1000 \WINDOWS\System32\DRIVERS\BATTC.SYS
    0xF8C7E000 pciide.sys
    0xF8935000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF8BB9000 aliide.sys
    0xF8BBB000 intelide.sys
    0xF8BBD000 toside.sys
    0xF8BBF000 viaide.sys
    0xF8BC1000 cmdide.sys
    0xF8637000 pcmcia.sys
    0xF86C5000 MountMgr.sys
    0xF8618000 ftdisk.sys
    0xF893D000 PartMgr.sys
    0xF86D5000 VolSnap.sys
    0xF8AD5000 cpqarray.sys
    0xF8600000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
    0xF85E8000 atapi.sys
    0xF8AD9000 aha154x.sys
    0xF8945000 sparrow.sys
    0xF8ADD000 symc810.sys
    0xF86E5000 aic78xx.sys
    0xF8AE1000 dac960nt.sys
    0xF86F5000 ql10wnt.sys
    0xF8AE5000 amsint.sys
    0xF894D000 asc.sys
    0xF8AE9000 asc3550.sys
    0xF8955000 mraid35x.sys
    0xF895D000 i2omp.sys
    0xF8AED000 ini910u.sys
    0xF8705000 ql1240.sys
    0xF8715000 aic78u2.sys
    0xF8965000 symc8xx.sys
    0xF896D000 sym_hi.sys
    0xF8975000 sym_u3.sys
    0xF897D000 ABP480N5.SYS
    0xF8985000 asc3350p.sys
    0xF8BC3000 cd20xrnt.sys
    0xF8725000 ultra.sys
    0xF85CF000 adpu160m.sys
    0xF898D000 dpti2o.sys
    0xF8735000 ql1080.sys
    0xF8745000 ql1280.sys
    0xF8755000 ql12160.sys
    0xF8995000 perc2.sys
    0xF8BC5000 perc2hib.sys
    0xF899D000 hpn.sys
    0xF8AF1000 cbidf2k.sys
    0xF85A3000 dac2w2k.sys
    0xF8765000 disk.sys
    0xF8775000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF8583000 fltmgr.sys
    0xF8571000 sr.sys
    0xF855A000 KSecDD.sys
    0xF84CD000 Ntfs.sys
    0xF84A0000 NDIS.sys
    0xF8785000 sisagp.sys
    0xF8795000 viaagp.sys
    0xF8486000 Mup.sys
    0xF89A5000 avgrkx86.sys
    0xF87A5000 AVGIDSEH.Sys
    0xF87B5000 agp440.sys
    0xF87C5000 alim1541.sys
    0xF87D5000 amdagp.sys
    0xF87E5000 agpCPQ.sys
    0xF88F5000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xF8A7D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xF7DF3000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF8A85000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF7DCB000 \SystemRoot\system32\DRIVERS\e1000325.sys
    0xF7D26000 \SystemRoot\system32\DRIVERS\w70n51.sys
    0xF8905000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF8A8D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF7CE5000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF8BE3000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF8A95000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF8A9D000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xF8915000 \SystemRoot\system32\DRIVERS\serial.sys
    0xF8B85000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xF7CD1000 \SystemRoot\system32\DRIVERS\parport.sys
    0xF8AA5000 \SystemRoot\system32\DRIVERS\nscirda.sys
    0xF8B89000 \SystemRoot\system32\DRIVERS\irenum.sys
    0xF8B91000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF8AAD000 \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
    0xF7C9B000 \SystemRoot\system32\drivers\smwdm.sys
    0xF7C77000 \SystemRoot\system32\drivers\portcls.sys
    0xF8925000 \SystemRoot\system32\drivers\drmk.sys
    0xF7C54000 \SystemRoot\system32\drivers\ks.sys
    0xF7C34000 \SystemRoot\system32\drivers\aeaudio.sys
    0xF7B0F000 \SystemRoot\system32\DRIVERS\AGRSM.sys
    0xF8AB5000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF8DED000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF842E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF8B9D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF7AB8000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF841E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF840E000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF8ABD000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF7AA7000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF83FE000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF89C5000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF89CD000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF83EE000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF8BE5000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF79A9000 \SystemRoot\system32\DRIVERS\update.sys
    0xF8BAD000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF83CE000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF83BE000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7E37000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF8825000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
    0xF7912000 \SystemRoot\system32\DRIVERS\MpFilter.sys
    0xF8BF9000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF8CB0000 \SystemRoot\System32\Drivers\Null.SYS
    0xF8BFB000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF89ED000 \SystemRoot\System32\drivers\vga.sys
    0xF78FE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
    0xF8BFD000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF8BFF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF89F5000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF89FD000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF7E1B000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xF787B000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xF7822000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xF77DA000 \SystemRoot\system32\DRIVERS\avgtdix.sys
    0xF77B4000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF8835000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF778C000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xF776A000 \SystemRoot\System32\drivers\afd.sys
    0xF8845000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xF8A05000 \SystemRoot\System32\Drivers\TPHKDRV.SYS
    0xF771F000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xF76AF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF8C01000 \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
    0xF8885000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF7673000 \SystemRoot\system32\DRIVERS\avgldx86.sys
    0xF8A0D000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xF8B7D000 \SystemRoot\system32\DRIVERS\usbscan.sys
    0xF8A15000 \SystemRoot\system32\DRIVERS\usbprint.sys
    0xF8A1D000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xF79A1000 \SystemRoot\System32\drivers\ANC.SYS
    0xF756B000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF8C0D000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF7951000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF8A25000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF8D17000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBFF50000 \SystemRoot\System32\framebuf.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xF8A4D000 \SystemRoot\system32\DRIVERS\AegisP.sys
    0xF702F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xF6E1E000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF6F33000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
    0xF6CAE000 \SystemRoot\system32\DRIVERS\srv.sys
    0xF70C3000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
    0xF6BBE000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
    0xF6721000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF6AEE000 \SystemRoot\system32\drivers\sysaudio.sys
    0xF64FA000 \SystemRoot\System32\Drivers\HTTP.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 40):
    0 System Idle Process
    4 System
    720 C:\WINDOWS\system32\smss.exe
    832 csrss.exe
    860 C:\WINDOWS\system32\winlogon.exe
    904 C:\WINDOWS\system32\services.exe
    916 C:\WINDOWS\system32\lsass.exe
    1064 C:\WINDOWS\system32\ibmpmsvc.exe
    1116 C:\WINDOWS\system32\svchost.exe
    1200 svchost.exe
    1240 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    1276 C:\WINDOWS\system32\svchost.exe
    1476 svchost.exe
    1500 svchost.exe
    1828 C:\WINDOWS\system32\spoolsv.exe
    1904 svchost.exe
    1932 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    1988 C:\Program Files\Java\jre6\bin\jqs.exe
    160 C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    188 C:\WINDOWS\system32\svchost.exe
    240 C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
    304 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    1456 alg.exe
    680 C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    2808 C:\WINDOWS\explorer.exe
    2960 C:\WINDOWS\AGRSMMSG.exe
    2976 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
    3028 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    3268 C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
    3280 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    3292 C:\Program Files\Mozilla Firefox\firefox.exe
    3324 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    3332 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    3336 C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    3348 C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    3412 C:\Program Files\Microsoft Security Client\msseces.exe
    3452 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2260 C:\Program Files\Mozilla Firefox\plugin-container.exe
    3276 C:\WINDOWS\system32\wuauclt.exe
    2416 C:\Documents and Settings\Alec\My Documents\Downloads\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: FUJITSUMHT2040AH, Rev: 006C

    Size Device Name MBR Status
    --------------------------------------------
    33 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: 70C87134E2B9A75548AD05DF4F0797AF949A04C1


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Done!

    ComboFix 11-01-16.02 - Alec 01/16/2011 23:21:31.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.265 [GMT -5:00]
    Running from: c:\documents and settings\Alec\My Documents\Downloads\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Alec\Application Data\completescan_pal
    c:\documents and settings\Alec\Application Data\install_pal
    c:\documents and settings\Alec\Application Data\uid_pal
    c:\windows\system32\_000006_.tmp.dll
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job

    .
    ((((((((((((((((((((((((( Files Created from 2010-12-17 to 2011-01-17 )))))))))))))))))))))))))))))))
    .

    2011-01-17 02:17 . 2010-11-16 17:01 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E7C6F44F-3B57-4263-8EEC-C029F75942FC}\mpengine.dll
    2011-01-17 01:34 . 2011-01-17 01:34 -------- d--h--w- c:\windows\$hf_mig$
    2011-01-16 22:05 . 2011-01-17 04:08 -------- d-----w- c:\windows\system32\wbem\Logs
    2011-01-16 21:25 . 2011-01-16 21:25 -------- d-----w- c:\program files\Common Files\Java
    2011-01-16 21:25 . 2011-01-16 21:24 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-01-16 21:25 . 2011-01-16 21:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-01-16 21:25 . 2011-01-16 21:24 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-16 21:24 . 2011-01-16 21:24 -------- d-----w- c:\program files\Java
    2011-01-16 21:14 . 2011-01-16 22:10 -------- d-----w- c:\program files\temp file cleaner
    2011-01-16 18:49 . 2011-01-16 18:49 388096 ----a-r- c:\documents and settings\Alec\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-01-15 03:19 . 2011-01-15 03:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2011-01-13 23:13 . 2011-01-13 23:13 -------- d-s---w- c:\documents and settings\NetworkService\UserData
    2011-01-13 03:15 . 2011-01-13 03:15 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-01-12 03:48 . 2011-01-13 03:15 -------- d-s---w- c:\documents and settings\Administrator
    2011-01-12 03:06 . 2011-01-12 03:06 -------- d-----w- c:\program files\Trend Micro
    2011-01-10 23:57 . 2010-12-03 19:35 25048 ----a-w- c:\program files\Mozilla Firefox\components\browserdirprovider.dll
    2011-01-10 23:57 . 2010-12-03 19:35 140248 ----a-w- c:\program files\Mozilla Firefox\components\brwsrcmp.dll
    2011-01-10 23:57 . 2010-12-03 19:35 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
    2011-01-10 23:57 . 2010-12-03 19:35 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
    2010-12-23 13:11 . 2010-12-23 13:11 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
    2010-12-19 20:29 . 2010-12-19 20:29 -------- d-----w- c:\documents and settings\Alec\Application Data\StreamTorrent
    2010-12-19 20:22 . 2010-11-16 17:01 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2010-12-18 21:45 . 2010-12-18 21:45 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
    2010-12-18 21:05 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-12-18 17:23 . 2010-10-19 15:41 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-12-18 17:14 . 2010-12-18 17:14 -------- d-----w- c:\program files\Microsoft Security Client
    2010-12-18 16:44 . 2010-12-18 17:05 -------- d-----w- C:\525f43d0b6e31b03a44687

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-20 23:09 . 2010-07-27 02:40 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-20 23:08 . 2010-07-27 02:40 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-18 18:12 . 2009-11-04 06:33 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-05 05:05 . 2010-11-05 05:05 667136 ----a-w- c:\windows\system32\SET27F.tmp
    2010-11-05 05:05 . 2010-11-05 05:05 629760 ----a-w- c:\windows\system32\SET280.tmp
    2010-11-05 05:05 . 2010-11-05 05:05 1510400 ----a-w- c:\windows\system32\SET282.tmp
    2010-11-05 05:05 . 2009-11-04 06:37 667136 ----a-w- c:\windows\system32\wininet.dll
    2010-11-05 05:05 . 2009-11-04 06:37 61952 ----a-w- c:\windows\system32\tdc.ocx
    2010-11-05 05:05 . 2010-11-05 05:05 3076096 ----a-w- c:\windows\system32\SET285.tmp
    2010-11-05 05:05 . 2009-11-04 06:33 81920 ----a-w- c:\windows\system32\ieencode.dll
    2010-11-03 12:59 . 2009-11-04 06:33 369664 ----a-w- c:\windows\system32\html.iec
    2010-11-02 15:17 . 2006-02-28 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
    2010-10-28 13:13 . 2010-10-28 13:13 290048 ----a-w- c:\windows\system32\SET2AE.tmp
    2010-10-28 13:13 . 2009-11-04 06:31 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-10-26 13:25 . 2009-11-04 06:37 1853312 ----a-w- c:\windows\system32\win32k.sys
    2010-10-25 02:25 . 2010-10-25 02:25 165264 ----a-w- c:\windows\system32\drivers\MpFilter.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 88363]
    "ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-07-29 425984]
    "ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2009-07-29 172032]
    "TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]
    "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
    2005-07-06 04:45 28672 ----a-w- c:\windows\system32\notifyf2.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
    2005-12-01 01:16 24576 ----a-w- c:\windows\system32\tphklock.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1723:TCP"= 1723:TCP:mad:xpsp2res.dll,-22015
    "1701:UDP"= 1701:UDP:mad:xpsp2res.dll,-22016
    "500:UDP"= 500:UDP:mad:xpsp2res.dll,-22017


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    getPlusHelper REG_MULTI_SZ getPlusHelper
    .
    Contents of the 'Scheduled Tasks' folder

    2011-01-17 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 17:26]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: vzTCPConfig - hxxp://www.verizon.net/checkmypc/includes/vzTCPConfig.CAB
    FF - ProfilePath - c:\documents and settings\Alec\Application Data\Mozilla\Firefox\Profiles\eetd05ha.default\
    FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
    FF - prefs.js: network.proxy.type - 0
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .
    - - - - ORPHANS REMOVED - - - -

    Notify-ACNotify - ACNotify.dll



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-01-16 23:31
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(804)
    c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
    c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
    c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
    c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
    c:\windows\system32\tphklock.dll

    - - - - - - - > 'explorer.exe'(3736)
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ibmpmsvc.exe
    c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
    c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Analog Devices\SoundMAX\SMAgent.exe
    c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
    c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\AGRSMMSG.exe
    c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    .
    **************************************************************************
    .
    Completion time: 2011-01-16 23:33:38 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-01-17 04:33

    Pre-Run: 28,263,907,328 bytes free
    Post-Run: 28,296,056,832 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - 69A4AA6AED24EAA01C8D4F9168595161
     
  14. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    still being disconnected
     
  15. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Disconnected from what?

    We need to double check your MBR...

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
     
  16. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    wireless router disconnected
     
  17. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    ComboFix 11-01-16.02 - Alec 01/16/2011 23:21:31.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.265 [GMT -5:00]
    Running from: c:\documents and settings\Alec\My Documents\Downloads\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Alec\Application Data\completescan_pal
    c:\documents and settings\Alec\Application Data\install_pal
    c:\documents and settings\Alec\Application Data\uid_pal
    c:\windows\system32\_000006_.tmp.dll
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job

    .
    ((((((((((((((((((((((((( Files Created from 2010-12-17 to 2011-01-17 )))))))))))))))))))))))))))))))
    .

    2011-01-17 02:17 . 2010-11-16 17:01 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E7C6F44F-3B57-4263-8EEC-C029F75942FC}\mpengine.dll
    2011-01-17 01:34 . 2011-01-17 01:34 -------- d--h--w- c:\windows\$hf_mig$
    2011-01-16 22:05 . 2011-01-17 04:08 -------- d-----w- c:\windows\system32\wbem\Logs
    2011-01-16 21:25 . 2011-01-16 21:25 -------- d-----w- c:\program files\Common Files\Java
    2011-01-16 21:25 . 2011-01-16 21:24 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-01-16 21:25 . 2011-01-16 21:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-01-16 21:25 . 2011-01-16 21:24 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-01-16 21:24 . 2011-01-16 21:24 -------- d-----w- c:\program files\Java
    2011-01-16 21:14 . 2011-01-16 22:10 -------- d-----w- c:\program files\temp file cleaner
    2011-01-16 18:49 . 2011-01-16 18:49 388096 ----a-r- c:\documents and settings\Alec\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-01-15 03:19 . 2011-01-15 03:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2011-01-13 23:13 . 2011-01-13 23:13 -------- d-s---w- c:\documents and settings\NetworkService\UserData
    2011-01-13 03:15 . 2011-01-13 03:15 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-01-12 03:48 . 2011-01-13 03:15 -------- d-s---w- c:\documents and settings\Administrator
    2011-01-12 03:06 . 2011-01-12 03:06 -------- d-----w- c:\program files\Trend Micro
    2011-01-10 23:57 . 2010-12-03 19:35 25048 ----a-w- c:\program files\Mozilla Firefox\components\browserdirprovider.dll
    2011-01-10 23:57 . 2010-12-03 19:35 140248 ----a-w- c:\program files\Mozilla Firefox\components\brwsrcmp.dll
    2011-01-10 23:57 . 2010-12-03 19:35 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
    2011-01-10 23:57 . 2010-12-03 19:35 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
    2010-12-23 13:11 . 2010-12-23 13:11 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
    2010-12-19 20:29 . 2010-12-19 20:29 -------- d-----w- c:\documents and settings\Alec\Application Data\StreamTorrent
    2010-12-19 20:22 . 2010-11-16 17:01 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2010-12-18 21:45 . 2010-12-18 21:45 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
    2010-12-18 21:05 . 2009-08-07 00:23 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-12-18 17:23 . 2010-10-19 15:41 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-12-18 17:14 . 2010-12-18 17:14 -------- d-----w- c:\program files\Microsoft Security Client
    2010-12-18 16:44 . 2010-12-18 17:05 -------- d-----w- C:\525f43d0b6e31b03a44687

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-20 23:09 . 2010-07-27 02:40 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-20 23:08 . 2010-07-27 02:40 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-18 18:12 . 2009-11-04 06:33 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-05 05:05 . 2010-11-05 05:05 667136 ----a-w- c:\windows\system32\SET27F.tmp
    2010-11-05 05:05 . 2010-11-05 05:05 629760 ----a-w- c:\windows\system32\SET280.tmp
    2010-11-05 05:05 . 2010-11-05 05:05 1510400 ----a-w- c:\windows\system32\SET282.tmp
    2010-11-05 05:05 . 2009-11-04 06:37 667136 ----a-w- c:\windows\system32\wininet.dll
    2010-11-05 05:05 . 2009-11-04 06:37 61952 ----a-w- c:\windows\system32\tdc.ocx
    2010-11-05 05:05 . 2010-11-05 05:05 3076096 ----a-w- c:\windows\system32\SET285.tmp
    2010-11-05 05:05 . 2009-11-04 06:33 81920 ----a-w- c:\windows\system32\ieencode.dll
    2010-11-03 12:59 . 2009-11-04 06:33 369664 ----a-w- c:\windows\system32\html.iec
    2010-11-02 15:17 . 2006-02-28 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
    2010-10-28 13:13 . 2010-10-28 13:13 290048 ----a-w- c:\windows\system32\SET2AE.tmp
    2010-10-28 13:13 . 2009-11-04 06:31 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-10-26 13:25 . 2009-11-04 06:37 1853312 ----a-w- c:\windows\system32\win32k.sys
    2010-10-25 02:25 . 2010-10-25 02:25 165264 ----a-w- c:\windows\system32\drivers\MpFilter.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 88363]
    "ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-07-29 425984]
    "ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2009-07-29 172032]
    "TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]
    "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
    2005-07-06 04:45 28672 ----a-w- c:\windows\system32\notifyf2.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
    2005-12-01 01:16 24576 ----a-w- c:\windows\system32\tphklock.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1723:TCP"= 1723:TCP:mad:xpsp2res.dll,-22015
    "1701:UDP"= 1701:UDP:mad:xpsp2res.dll,-22016
    "500:UDP"= 500:UDP:mad:xpsp2res.dll,-22017


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    getPlusHelper REG_MULTI_SZ getPlusHelper
    .
    Contents of the 'Scheduled Tasks' folder

    2011-01-17 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 17:26]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: vzTCPConfig - hxxp://www.verizon.net/checkmypc/includes/vzTCPConfig.CAB
    FF - ProfilePath - c:\documents and settings\Alec\Application Data\Mozilla\Firefox\Profiles\eetd05ha.default\
    FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
    FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
    FF - prefs.js: network.proxy.type - 0
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .
    - - - - ORPHANS REMOVED - - - -

    Notify-ACNotify - ACNotify.dll



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-01-16 23:31
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(804)
    c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
    c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
    c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
    c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
    c:\windows\system32\tphklock.dll

    - - - - - - - > 'explorer.exe'(3736)
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ibmpmsvc.exe
    c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
    c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Analog Devices\SoundMAX\SMAgent.exe
    c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
    c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\AGRSMMSG.exe
    c:\program files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    c:\program files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    .
    **************************************************************************
    .
    Completion time: 2011-01-16 23:33:38 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-01-17 04:33

    Pre-Run: 28,263,907,328 bytes free
    Post-Run: 28,296,056,832 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - 69A4AA6AED24EAA01C8D4F9168595161
     
  18. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    sorry
    cut n paste error

    Bootkit Remover
    (c) 2009 eSage Lab
    www.esagelab.com

    Program version: 1.2.0.0
    OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    Boot sector MD5 is: 4821da35de426da1dc579f2e1bd37915

    Size Device Name MBR Status
    --------------------------------------------
    33 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Done;
    Press any key to quit...
     
  19. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    well I went ahead and fixed master boot sector
    and it appears to be resolved
    I can now download microsoft security programs and I an not getting redirected
    and microsoft auto updates were loaded
    thank you for all your help
     
  20. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Good news, but we still need to finish cleaning process.
    I'd like to see fresh MBRCheck log.
     
  21. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    ok just a min
    I think the wireless dropping is my isp
     
  22. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 162):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EE000 \WINDOWS\system32\hal.dll
    0xF8BB5000 \WINDOWS\system32\KDCOM.DLL
    0xF8AC5000 \WINDOWS\system32\BOOTVID.dll
    0xF8666000 ACPI.sys
    0xF8BB7000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF8655000 pci.sys
    0xF86B5000 isapnp.sys
    0xF8AC9000 ACPIEC.sys
    0xF8C7D000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF8ACD000 compbatt.sys
    0xF8AD1000 \WINDOWS\System32\DRIVERS\BATTC.SYS
    0xF8C7E000 pciide.sys
    0xF8935000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF8BB9000 aliide.sys
    0xF8BBB000 intelide.sys
    0xF8BBD000 toside.sys
    0xF8BBF000 viaide.sys
    0xF8BC1000 cmdide.sys
    0xF8637000 pcmcia.sys
    0xF86C5000 MountMgr.sys
    0xF8618000 ftdisk.sys
    0xF893D000 PartMgr.sys
    0xF86D5000 VolSnap.sys
    0xF8AD5000 cpqarray.sys
    0xF8600000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
    0xF85E8000 atapi.sys
    0xF8AD9000 aha154x.sys
    0xF8945000 sparrow.sys
    0xF8ADD000 symc810.sys
    0xF86E5000 aic78xx.sys
    0xF8AE1000 dac960nt.sys
    0xF86F5000 ql10wnt.sys
    0xF8AE5000 amsint.sys
    0xF894D000 asc.sys
    0xF8AE9000 asc3550.sys
    0xF8955000 mraid35x.sys
    0xF895D000 i2omp.sys
    0xF8AED000 ini910u.sys
    0xF8705000 ql1240.sys
    0xF8715000 aic78u2.sys
    0xF8965000 symc8xx.sys
    0xF896D000 sym_hi.sys
    0xF8975000 sym_u3.sys
    0xF897D000 ABP480N5.SYS
    0xF8985000 asc3350p.sys
    0xF8BC3000 cd20xrnt.sys
    0xF8725000 ultra.sys
    0xF85CF000 adpu160m.sys
    0xF898D000 dpti2o.sys
    0xF8735000 ql1080.sys
    0xF8745000 ql1280.sys
    0xF8755000 ql12160.sys
    0xF8995000 perc2.sys
    0xF8BC5000 perc2hib.sys
    0xF899D000 hpn.sys
    0xF8AF1000 cbidf2k.sys
    0xF85A3000 dac2w2k.sys
    0xF8765000 disk.sys
    0xF8775000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF8583000 fltmgr.sys
    0xF8571000 sr.sys
    0xF855A000 KSecDD.sys
    0xF84CD000 Ntfs.sys
    0xF84A0000 NDIS.sys
    0xF8785000 sisagp.sys
    0xF8795000 viaagp.sys
    0xF8486000 Mup.sys
    0xF87A5000 agp440.sys
    0xF87B5000 alim1541.sys
    0xF87C5000 amdagp.sys
    0xF87D5000 agpCPQ.sys
    0xF8905000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xF8A6D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xF7D34000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF8A75000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF7D0C000 \SystemRoot\system32\DRIVERS\e1000325.sys
    0xF8915000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF8A7D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF7C26000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF8BE5000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF8A85000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF8A8D000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xF8925000 \SystemRoot\system32\DRIVERS\serial.sys
    0xF8B91000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xF7C12000 \SystemRoot\system32\DRIVERS\parport.sys
    0xF8A95000 \SystemRoot\system32\DRIVERS\nscirda.sys
    0xF8B95000 \SystemRoot\system32\DRIVERS\irenum.sys
    0xF8B9D000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF8A9D000 \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
    0xF7BDC000 \SystemRoot\system32\drivers\smwdm.sys
    0xF7BB8000 \SystemRoot\system32\drivers\portcls.sys
    0xF841D000 \SystemRoot\system32\drivers\drmk.sys
    0xF7B95000 \SystemRoot\system32\drivers\ks.sys
    0xF7B75000 \SystemRoot\system32\drivers\aeaudio.sys
    0xF7A50000 \SystemRoot\system32\DRIVERS\AGRSM.sys
    0xF8AAD000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF8C92000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF840D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF8BB1000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF79F9000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF83FD000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF83ED000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF8AB5000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF79E8000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF83DD000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF89B5000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF89BD000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF83CD000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF8BE9000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF6CA2000 \SystemRoot\system32\DRIVERS\update.sys
    0xF8452000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF83AD000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF839D000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7D60000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF6817000 \SystemRoot\system32\DRIVERS\MpFilter.sys
    0xF89D5000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xF8C0B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF8CF5000 \SystemRoot\System32\Drivers\Null.SYS
    0xF8C0D000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF89E5000 \SystemRoot\System32\drivers\vga.sys
    0xF6803000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
    0xF8C0F000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF8C11000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF89ED000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF89F5000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF79E0000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xF6780000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xF6727000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xF66FF000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xF66DD000 \SystemRoot\System32\drivers\afd.sys
    0xF8825000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xF89FD000 \SystemRoot\System32\Drivers\TPHKDRV.SYS
    0xF6692000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xF6622000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF8865000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF65FC000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF8875000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF79C8000 \SystemRoot\system32\DRIVERS\usbscan.sys
    0xF8A05000 \SystemRoot\system32\DRIVERS\usbprint.sys
    0xF8A0D000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xF79C0000 \SystemRoot\System32\drivers\ANC.SYS
    0xF65BC000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF8C1B000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF684A000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF8A1D000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF8D8C000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBFF50000 \SystemRoot\System32\framebuf.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xF8A45000 \SystemRoot\system32\DRIVERS\AegisP.sys
    0xF5FC8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xF5DA7000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF5C5F000 \SystemRoot\system32\DRIVERS\srv.sys
    0xF8BF1000 \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
    0xF597A000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF5EAC000 \SystemRoot\system32\drivers\sysaudio.sys
    0xF568B000 \SystemRoot\System32\Drivers\HTTP.sys
    0xF5183000 \SystemRoot\system32\DRIVERS\w70n51.sys
    0xF5158000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 39):
    0 System Idle Process
    4 System
    720 C:\WINDOWS\system32\smss.exe
    792 csrss.exe
    816 C:\WINDOWS\system32\winlogon.exe
    860 C:\WINDOWS\system32\services.exe
    872 C:\WINDOWS\system32\lsass.exe
    1016 C:\WINDOWS\system32\ibmpmsvc.exe
    1072 C:\WINDOWS\system32\svchost.exe
    1156 svchost.exe
    1196 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    1232 C:\WINDOWS\system32\svchost.exe
    1424 svchost.exe
    1468 svchost.exe
    1776 C:\WINDOWS\system32\spoolsv.exe
    1860 svchost.exe
    1888 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    1948 C:\Program Files\Java\jre6\bin\jqs.exe
    2024 C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    128 C:\WINDOWS\system32\svchost.exe
    148 C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
    632 alg.exe
    1720 C:\WINDOWS\explorer.exe
    224 C:\WINDOWS\AGRSMMSG.exe
    904 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
    772 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    1112 C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
    1096 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    1284 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    788 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    1368 C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    1376 C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    1396 C:\Program Files\Microsoft Security Client\msseces.exe
    1640 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2572 C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    2996 C:\Program Files\Mozilla Firefox\firefox.exe
    944 C:\Program Files\Mozilla Firefox\plugin-container.exe
    2176 C:\WINDOWS\system32\rundll32.exe
    4040 C:\Documents and Settings\Alec\My Documents\Downloads\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: FUJITSUMHT2040AH, Rev: 006C

    Size Device Name MBR Status
    --------------------------------------------
    33 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: 31D100779DE502702C374F7C15687B56FCFD5528


    Done!
     
  23. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Good :)

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  24. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    OTL logfile created on: 1/17/2011 1:12:16 PM - Run 1
    OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\Alec\My Documents\Downloads
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    511.00 Mb Total Physical Memory | 287.00 Mb Available Physical Memory | 56.00% Memory free
    1.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 33.91 Gb Total Space | 26.41 Gb Free Space | 77.90% Space Free | Partition Type: NTFS

    Computer Name: YOUR-929C560D3A | User Name: Alec | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/01/17 13:09:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Alec\My Documents\Downloads\OTL.exe
    PRC - [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
    PRC - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    PRC - [2009/07/29 10:43:34 | 000,163,840 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
    PRC - [2009/07/29 10:42:32 | 000,221,184 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
    PRC - [2009/07/29 10:42:28 | 000,098,304 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    PRC - [2009/07/29 10:40:40 | 000,425,984 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
    PRC - [2009/07/29 10:35:18 | 000,172,032 | ---- | M] (Lenovo ) -- C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2006/10/02 10:19:48 | 000,094,208 | ---- | M] () -- C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
    PRC - [2006/05/30 15:05:42 | 000,086,016 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
    PRC - [2005/07/05 14:57:12 | 000,077,824 | ---- | M] () -- C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
    PRC - [2004/10/14 09:11:10 | 001,388,544 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    PRC - [2003/07/03 01:25:00 | 000,057,344 | ---- | M] () -- C:\WINDOWS\system32\ibmpmsvc.exe
    PRC - [2003/06/24 14:34:38 | 000,126,976 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    PRC - [2002/09/20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/01/17 13:09:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Alec\My Documents\Downloads\OTL.exe
    MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
    MOD - [2003/06/24 14:33:54 | 000,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- -- (Irmon)
    SRV - File not found [Disabled | Stopped] -- -- (HidServ)
    SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
    SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
    SRV - [2009/12/17 16:36:24 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
    SRV - [2009/07/29 10:42:32 | 000,221,184 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe -- (AcSvc)
    SRV - [2009/07/29 10:42:28 | 000,098,304 | ---- | M] (Lenovo ) [Auto | Running] -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
    SRV - [2005/11/22 16:20:28 | 000,036,864 | ---- | M] () [On_Demand | Stopped] -- C:\WINDOWS\system32\acs.exe -- (ACS)
    SRV - [2003/07/03 01:25:00 | 000,057,344 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\ibmpmsvc.exe -- (IBMPMSVC)
    SRV - [2002/09/20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))


    ========== Driver Services (SafeList) ==========

    DRV - [2009/07/21 21:45:30 | 000,011,520 | ---- | M] (IBM Corp.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ANC.sys -- (ANC)
    DRV - [2009/07/21 21:45:30 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\IBMBLDID.sys -- (IBMTPCHK)
    DRV - [2008/04/13 13:54:36 | 000,028,672 | ---- | M] (National Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nscirda.sys -- (NSCIRDA)
    DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
    DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
    DRV - [2006/07/13 12:33:08 | 000,674,560 | ---- | M] (IntelĀ® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R)
    DRV - [2006/02/28 07:00:00 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
    DRV - [2006/02/28 07:00:00 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
    DRV - [2006/02/28 07:00:00 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
    DRV - [2006/02/28 07:00:00 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
    DRV - [2006/02/28 07:00:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
    DRV - [2006/02/28 07:00:00 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
    DRV - [2006/02/28 07:00:00 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
    DRV - [2006/02/28 07:00:00 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
    DRV - [2006/02/28 07:00:00 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
    DRV - [2005/07/05 14:57:06 | 000,017,699 | ---- | M] (IBM Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\TPHKDRV.sys -- (TPHKDRV)
    DRV - [2004/08/04 14:00:00 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
    DRV - [2004/08/04 14:00:00 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
    DRV - [2004/08/04 14:00:00 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
    DRV - [2004/08/04 14:00:00 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
    DRV - [2004/08/04 14:00:00 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
    DRV - [2004/08/04 14:00:00 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
    DRV - [2004/08/03 17:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2003/07/03 01:25:00 | 000,011,344 | ---- | M] (IBM Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys -- (IBMPMDRV)
    DRV - [2003/06/27 08:53:44 | 001,196,352 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
    DRV - [2003/06/24 14:16:30 | 000,265,744 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


    IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    IE - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
    FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com"
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p="
    FF - prefs.js..network.proxy.type: 0

    FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/01/16 20:01:53 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/16 16:25:17 | 000,000,000 | ---D | M]

    [2009/12/21 14:04:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alec\Application Data\Mozilla\Extensions
    [2011/01/10 22:37:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alec\Application Data\Mozilla\Firefox\Profiles\eetd05ha.default\extensions
    [2011/01/10 22:37:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alec\Application Data\Mozilla\Firefox\Profiles\eetd05ha.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}-trash
    [2010/01/11 19:13:25 | 000,001,720 | ---- | M] () -- C:\Documents and Settings\Alec\Application Data\Mozilla\Firefox\Profiles\eetd05ha.default\searchplugins\youtube-video-search.xml
    [2011/01/17 11:20:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2011/01/16 16:25:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    [2011/01/16 16:24:50 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2011/01/16 16:24:48 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

    O1 HOSTS File: ([2011/01/16 23:30:52 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
    O3 - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\..\Toolbar\ShellBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
    O4 - HKLM..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo )
    O4 - HKLM..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo )
    O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
    O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
    O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-1807688380-2972523714-2664652375-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} http://www-307.ibm.com/pc/support/acpir.cab (IASRunner Class)
    O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab (Windows Live Safety Center Base Module)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1292689346124 (MUWebControl Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
    O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
    O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
    O16 - DPF: vzTCPConfig http://www.verizon.net/checkmypc/includes/vzTCPConfig.CAB (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
    O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\tpfnf2: DllName - notifyf2.dll - C:\WINDOWS\System32\notifyf2.dll ()
    O20 - Winlogon\Notify\tphotkey: DllName - tphklock.dll - C:\WINDOWS\System32\tphklock.dll ()
    O24 - Desktop WallPaper: C:\Documents and Settings\Alec\Local Settings\Application Data\Microsoft\Wallpaper2.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Alec\Local Settings\Application Data\Microsoft\Wallpaper2.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/08/26 13:04:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: AppMgmt - File not found
    NetSvcs: HidServ - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (54901231209938944)

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/01/17 11:30:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
    [2011/01/17 08:31:16 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Documents and Settings\Alec\remover.exe
    [2011/01/17 08:22:04 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2011/01/17 07:37:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
    [2011/01/17 07:37:52 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
    [2011/01/16 23:20:34 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2011/01/16 23:19:03 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011/01/16 23:19:03 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011/01/16 23:19:03 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011/01/16 23:19:03 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011/01/16 23:18:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2011/01/16 21:07:24 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/01/16 20:34:51 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$
    [2011/01/16 18:04:22 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Alec\Recent
    [2011/01/16 16:25:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
    [2011/01/16 16:25:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
    [2011/01/16 16:24:30 | 000,000,000 | ---D | C] -- C:\Program Files\Java
    [2011/01/16 16:22:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alec\Application Data\Sun
    [2011/01/16 16:14:49 | 000,000,000 | ---D | C] -- C:\Program Files\temp file cleaner
    [2011/01/16 13:49:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alec\Start Menu\Programs\HiJackThis
    [2011/01/14 22:19:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
    [2011/01/11 22:06:01 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
    [2011/01/10 18:33:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Identities
    [2011/01/10 18:33:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
    [2011/01/09 22:03:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
    [2011/01/06 23:32:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe(2)
    [2011/01/06 21:21:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
    [2011/01/06 18:56:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
    [2010/12/23 08:11:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
    [2010/12/19 15:29:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alec\Application Data\StreamTorrent
    [2010/12/18 16:45:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    [6 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
    [22 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/01/17 11:34:13 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2011/01/17 08:39:19 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2011/01/17 08:33:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/01/17 08:33:34 | 535,810,048 | -HS- | M] () -- C:\hiberfil.sys
    [2011/01/16 23:30:52 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2011/01/16 23:20:43 | 000,000,316 | RHS- | M] () -- C:\boot.ini
    [2011/01/16 20:33:09 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/01/16 18:13:08 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/01/16 14:31:33 | 000,002,445 | ---- | M] () -- C:\Documents and Settings\Alec\Desktop\HiJackThis.lnk
    [2011/01/15 08:07:24 | 000,001,486 | ---- | M] () -- C:\Documents and Settings\Alec\Desktop\Calculator.lnk
    [2011/01/10 18:57:32 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\Alec\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/01/10 18:57:32 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2011/01/06 23:24:03 | 000,011,261 | ---- | M] () -- C:\WINDOWS\System32\saad.js
    [2010/12/25 16:36:22 | 000,043,008 | ---- | M] () -- C:\Documents and Settings\Alec\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [6 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
    [22 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/01/17 08:31:55 | 000,037,237 | ---- | C] () -- C:\Documents and Settings\Alec\bootkit_remover_debug_log.txt
    [2011/01/16 23:20:43 | 000,000,201 | ---- | C] () -- C:\Boot.bak
    [2011/01/16 23:20:39 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2011/01/16 23:19:03 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011/01/16 23:19:03 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2011/01/16 23:19:03 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011/01/16 23:19:03 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2011/01/16 23:19:03 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2011/01/16 13:49:02 | 000,002,445 | ---- | C] () -- C:\Documents and Settings\Alec\Desktop\HiJackThis.lnk
    [2011/01/06 18:24:05 | 000,011,261 | ---- | C] () -- C:\WINDOWS\System32\saad.js
    [2010/08/18 17:13:48 | 000,043,008 | ---- | C] () -- C:\Documents and Settings\Alec\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2009/12/07 21:37:41 | 000,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys
    [2009/11/05 19:03:42 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
    [2009/11/05 19:03:41 | 000,000,611 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2009/11/05 14:56:35 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
    [2009/11/05 14:56:35 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
    [2005/11/30 20:16:02 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\tphklock.dll
    [2005/07/05 23:45:08 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\notifyf2.dll
    [2004/08/27 05:50:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2004/08/26 11:12:43 | 000,000,465 | ---- | C] () -- C:\WINDOWS\System32\emver.ini
    [2004/08/26 11:12:43 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2004/08/26 05:54:56 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2003/07/03 01:25:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\tpinspm.dll
    [2003/06/24 14:43:48 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
    [1997/07/11 00:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\XLREC.DLL
    [1997/07/11 00:00:00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\RECNCL.DLL
    [1997/07/11 00:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
    [1997/07/11 00:00:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
    [1997/07/11 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

    ========== LOP Check ==========

    [2009/12/07 22:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alec\Application Data\Avaya
    [2010/10/17 17:14:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alec\Application Data\AVG10
    [2010/11/25 08:57:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alec\Application Data\Canon
    [2010/12/19 15:29:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alec\Application Data\StreamTorrent
    [2010/09/06 12:57:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alec\Application Data\Systweak
    [2010/01/21 21:40:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alec\Application Data\Uniblue
    [2011/01/16 23:06:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
    [2010/10/17 17:03:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
    [2010/08/22 09:28:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
    [2010/10/17 17:12:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
    [2011/01/16 22:36:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
    [2011/01/17 08:39:19 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/10/29 23:12:02 | 004,842,152 | ---- | M] (Lenovo Group Limited ) -- C:\77wc39ww.exe
    [2004/08/26 13:04:39 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2009/11/04 01:44:21 | 000,000,201 | ---- | M] () -- C:\Boot.bak
    [2011/01/16 23:20:43 | 000,000,316 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2011/01/16 23:33:38 | 000,011,627 | ---- | M] () -- C:\ComboFix.txt
    [2004/08/26 13:04:39 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2011/01/17 08:33:34 | 535,810,048 | -HS- | M] () -- C:\hiberfil.sys
    [2004/08/26 13:04:39 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2004/08/26 13:04:39 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2004/08/04 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2010/01/22 21:49:40 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2011/01/17 08:33:32 | 805,306,368 | -HS- | M] () -- C:\PAGEFILE.SYS
    [2009/11/04 01:49:58 | 000,000,002 | ---- | M] () -- C:\REQUEST_OEMRESET_ENDUSER
    [2011/01/16 20:29:37 | 000,045,726 | ---- | M] () -- C:\TDSSKiller.2.4.13.0_16.01.2011_20.28.06_log.txt

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/08/04 14:00:00 | 000,000,067 | ---- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2006/09/13 04:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD7I.DLL
    [2006/09/13 04:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP7I.DLL
    [2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >
    [2009/12/31 14:32:52 | 000,001,618 | -H-- | M] () -- C:\Documents and Settings\Alec\Application Data\Microsoft\LastFlashConfig.WFC

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/08/26 05:53:19 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2004/08/26 05:53:18 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2004/08/26 05:53:18 | 000,864,256 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2010/01/22 22:05:48 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2010/01/22 22:18:24 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Alec\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2004/08/26 13:09:49 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Alec\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2009/04/21 23:02:24 | 001,079,296 | ---- | M] (ADDPCs) -- C:\Documents and Settings\Alec\Desktop\tempCleaner.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >
    [2010/09/01 15:33:49 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Documents and Settings\Alec\remover.exe

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2010/01/22 22:18:25 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Alec\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2011/01/17 11:10:31 | 000,131,072 | ---- | M] () -- C:\Documents and Settings\Alec\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 10:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 10:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 10:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 10:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 10:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 10:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 10:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
  25. 2janealec

    2janealec TS Rookie Topic Starter Posts: 21

    OTL Extras logfile created on: 1/17/2011 1:12:16 PM - Run 1
    OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\Alec\My Documents\Downloads
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    511.00 Mb Total Physical Memory | 287.00 Mb Available Physical Memory | 56.00% Memory free
    1.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 33.91 Gb Total Space | 26.41 Gb Free Space | 77.90% Space Free | Partition Type: NTFS

    Computer Name: YOUR-929C560D3A | User Name: Alec | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_USERS\S-1-5-21-1807688380-2972523714-2664652375-1006\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "1723:TCP" = 1723:TCP:*:Enabled:mad:xpsp2res.dll,-22015
    "1701:UDP" = 1701:UDP:*:Enabled:mad:xpsp2res.dll,-22016
    "500:UDP" = 500:UDP:*:Enabled:mad:xpsp2res.dll,-22017

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22002
    "1723:TCP" = 1723:TCP:*:Enabled:mad:xpsp2res.dll,-22015
    "1701:UDP" = 1701:UDP:*:Enabled:mad:xpsp2res.dll,-22016
    "500:UDP" = 500:UDP:*:Enabled:mad:xpsp2res.dll,-22017

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0323CB96-221A-4042-84A3-93EDE47099FC}" = AVG 2011
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{25EF00BE-F17B-11D6-88EA-000476CD2443}" = Verizon Online
    "{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 23
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
    "{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
    "{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
    "{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9FAC9E5C-0D20-4DBF-AFE5-2E09C52A95A2}" = ThinkPad Wireless LAN Adapters Software (11a/b, 11b/g, 11a/b/g)
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
    "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{CF23AFD7-3078-4134-8823-EBF6D1FE6FAD}" = Canon MP450
    "{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
    "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
    "{F4C68898-EBA5-46A9-82B3-2D30426086BF}" = AVG 2011
    "7-Zip" = 7-Zip 9.20
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Agere Systems Soft Modem" = Agere Systems AC'97 Modem
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft Security Client" = Microsoft Security Essentials
    "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
    "MP Navigator 2.0" = Canon MP Navigator 2.0
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "Office8.0" = Microsoft Office 97, Professional Edition
    "Power Management Driver" = IBM ThinkPad Power Management Driver
    "PROSet" = Intel(R) PRO Network Connections Drivers
    "SynTPDeinstKey" = IBM ThinkPad UltraNav Driver
    "ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
    "WIC" = Windows Imaging Component
    "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 1/7/2011 9:30:25 PM | Computer Name = YOUR-929C560D3A | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: This network connection does not exist.

    Error - 1/7/2011 10:27:05 PM | Computer Name = YOUR-929C560D3A | Source = Application Error | ID = 1000
    Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
    module ntdll.dll, version 5.1.2600.5755, fault address 0x00023845.

    Error - 1/7/2011 11:31:02 PM | Computer Name = YOUR-929C560D3A | Source = crypt32 | ID = 131083
    Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
    with error: A required certificate is not within its validity period when verifying
    against the current system clock or the timestamp in the signed file.

    Error - 1/7/2011 11:31:02 PM | Computer Name = YOUR-929C560D3A | Source = crypt32 | ID = 131083
    Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
    with error: A required certificate is not within its validity period when verifying
    against the current system clock or the timestamp in the signed file.

    Error - 1/7/2011 11:31:07 PM | Computer Name = YOUR-929C560D3A | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: The connection with the server was terminated abnormally

    Error - 1/7/2011 11:31:07 PM | Computer Name = YOUR-929C560D3A | Source = crypt32 | ID = 131083
    Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
    with error: A required certificate is not within its validity period when verifying
    against the current system clock or the timestamp in the signed file.

    Error - 1/7/2011 11:31:07 PM | Computer Name = YOUR-929C560D3A | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: This network connection does not exist.

    Error - 1/8/2011 4:21:51 PM | Computer Name = YOUR-929C560D3A | Source = MPSampleSubmission | ID = 5000
    Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8107.0,
    P5 mpsigdwn.dll, P6 3.0.8107.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
    P8 NIL, P9 NIL, P10 NIL.

    Error - 1/8/2011 10:25:45 PM | Computer Name = YOUR-929C560D3A | Source = Application Error | ID = 1000
    Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
    module wzcsvc.dll, version 5.1.2600.5512, fault address 0x0002d3ae.

    Error - 1/9/2011 8:51:18 AM | Computer Name = MAIN | Source = Application Error | ID = 1000
    Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
    module wzcsvc.dll, version 5.1.2600.5512, fault address 0x0002d3ae.

    [ System Events ]
    Error - 1/17/2011 10:24:49 AM | Computer Name = YOUR-929C560D3A | Source = Service Control Manager | ID = 7023
    Description = The Remote Access Connection Manager service terminated with the following
    error: %%126

    Error - 1/17/2011 10:24:50 AM | Computer Name = YOUR-929C560D3A | Source = Rasman | ID = 20063
    Description = Remote Access Connection Manager failed to start because the Point
    to Point Protocol failed to initialize. The specified module could not be found.


    Error - 1/17/2011 10:24:50 AM | Computer Name = YOUR-929C560D3A | Source = Service Control Manager | ID = 7023
    Description = The Remote Access Connection Manager service terminated with the following
    error: %%126

    Error - 1/17/2011 10:24:58 AM | Computer Name = YOUR-929C560D3A | Source = Rasman | ID = 20063
    Description = Remote Access Connection Manager failed to start because the Point
    to Point Protocol failed to initialize. The specified module could not be found.


    Error - 1/17/2011 10:24:59 AM | Computer Name = YOUR-929C560D3A | Source = Service Control Manager | ID = 7023
    Description = The Remote Access Connection Manager service terminated with the following
    error: %%126

    Error - 1/17/2011 11:08:53 AM | Computer Name = YOUR-929C560D3A | Source = PSched | ID = 14103
    Description = QoS [Adapter {9E3634ED-96E0-493D-8EA5-3FBA4DC72102}]: The netcard driver
    failed the query for OID_GEN_LINK_SPEED.

    Error - 1/17/2011 12:31:05 PM | Computer Name = YOUR-929C560D3A | Source = PSched | ID = 14103
    Description = QoS [Adapter {9E3634ED-96E0-493D-8EA5-3FBA4DC72102}]: The netcard driver
    failed the query for OID_GEN_LINK_SPEED.

    Error - 1/17/2011 12:31:09 PM | Computer Name = YOUR-929C560D3A | Source = PSched | ID = 14103
    Description = QoS [Adapter {9E3634ED-96E0-493D-8EA5-3FBA4DC72102}]: The netcard driver
    failed the query for OID_GEN_LINK_SPEED.

    Error - 1/17/2011 1:37:01 PM | Computer Name = YOUR-929C560D3A | Source = Rasman | ID = 20063
    Description = Remote Access Connection Manager failed to start because the Point
    to Point Protocol failed to initialize. The specified module could not be found.


    Error - 1/17/2011 1:37:02 PM | Computer Name = YOUR-929C560D3A | Source = Service Control Manager | ID = 7023
    Description = The Remote Access Connection Manager service terminated with the following
    error: %%126


    < End of report >
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...