TechSpot

Can't remove Google redirect

By jhenri23
May 16, 2011
  1. Ive tried everything on every forum, having no luck, please somebody help me. I am running windows 7 Ultimate
     
  2. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    To Elaborate whenever i click on a search result it brings me to an ad page
     
  3. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  4. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    Thanks Broni,

    Here is log from Malwarebytes it didnt find anything so i will move to next step.

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6588

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 9.0.8112.16421

    5/16/2011 9:36:46 AM
    mbam-log-2011-05-16 (09-36-46).txt

    Scan type: Quick scan
    Objects scanned: 175149
    Time elapsed: 39 minute(s), 32 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
  5. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    OK...........
     
  6. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    Here is gmer log

    GMER 1.0.15.15627 - http://www.gmer.net
    Rootkit quick scan 2011-05-16 13:59:33
    Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\00000071 WDC_WD50 rev.01.0
    Running: 1pxzplgk.exe; Driver: C:\Users\Justin\AppData\Local\Temp\pxtirfow.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----
     
  7. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Go on.......
     
  8. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    DDS Log

    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Justin at 14:35:12.64 on Mon 05/16/2011
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24
    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3070.1507 [GMT -4:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Box Sync\UpdateService.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Program Files\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\bin\msmdsrv.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
    C:\Program Files\HP\HP UT\bin\hppusg.exe
    C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe
    C:\Windows\system32\NLSSRV32.EXE
    C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe
    C:\Program Files\HP\HP Software Update\hpwuschd2.exe
    C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\BitTorrent\BitTorrent.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Box Sync\BoxSyncHelper.exe
    C:\Users\Justin\AppData\Local\Autobahn\mlb-nexdef-autobahn.exe
    C:\Program Files\Mozilla Firefox 4.0 Beta 1\firefox.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE
    C:\Windows\system32\conhost.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Mozilla Firefox 4.0 Beta 1\plugin-container.exe
    C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe
    C:\Program Files\iPod\bin\iPodService.exe
    c:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdhost.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\SearchIndexer.exe
    c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\mobsync.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Users\Justin\Downloads\dds.scr
    C:\Windows\system32\conhost.exe
    .
     
  9. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    ============== Pseudo HJT Report ===============
    .
    uDefault_Page_URL = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=5080925
    uStart Page = hxxp://www.facebook.com/
    uWindow Title = Internet Explorer provided by Dell
    mDefault_Page_URL = hxxp://www.yahoo.com
    mStart Page = hxxp://www.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll
    uURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
    mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
    mURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
    BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~3\office14\URLREDIR.DLL
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
    BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn3\YTSingleInstance.dll
    TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
    TB: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
     
  10. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
    uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [Google Update] "c:\users\justin\appdata\local\google\update\GoogleUpdate.exe" /c
    uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US
    uRun: [BitTorrent] "c:\program files\bittorrent\BitTorrent.exe"
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [eracsqaozn] rundll32 "c:\users\justin\appdata\roaming\mfdvdecr.dll",Xiqk
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exel
     
  11. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
    mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
    mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
    mRun: [HPPQVideo] "c:\program files\hp\scheduledlaunch\hp laserjet p2050 series\bin\hppschlnch.exe" -r software\hewlett-packard\scheduledlaunch\LJ_P2050_Series -f PQOptimizerVideo.xml -o RemindLater
    mRun: [HPUsageTracking] "c:\program files\hp\hp ut\bin\hppusg.exe" "c:\program files\hp\hp ut\"
     
  12. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
     
  13. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    mRun: [ToolBoxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:eek:n
     
  14. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    /alerts:eek:n /notifications:eek:n /fl:eek:n /fr:eek:n /appData:eek:n /tmcp:eek:nmRun: [Adobe ARM]"c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
    mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exemRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
    mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
    mRun: [LogMeIn Hamachi Ui] "c:\program files\logmein hamachi\hamachi-2-ui.exe" --auto-start
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    StartupFolder: c:\users\justin\appdata\roaming\micros~1\windows\startm~1\programs\startup\mlbtvn~1.lnk - c:\users\justin\appdata\local\autobahn\mlb-nexdef-autobahn.exe
    StartupFolder: c:\users\justin\appdata\roaming\micros~1\windows\startm~1\programs\startup\outbac~1.lnk - c:\outback.bat
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\boxsyn~1.lnk - c:\program files\box sync\BoxSync.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
    IE: Se&nd to OneNote - /105
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    Trusted Zone: aetna.com\www
    Trusted Zone: real.com\rhap-app-4-0
    Trusted Zone: real.com\rhapreg
    DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} - hxxp://actiftp.hosting4less.com/ACTIGENERAL/AP&Manual/Live%20Demo/nvUnifiedControl.ocx
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
    AppInit_DLLs: c:\progra~1\google\google~1\GO36F4~1.DLL
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\justin\appdata\roaming\mozilla\firefox\profiles\ngysdz70.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=15-06-2009&tb_mrud=12-05-2010
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=100000000000000002&tb_oid=15-06-2009&tb_mrud=12-05-2010&query=
    FF - component: c:\program files\dealio toolbar\ssff\components\SearchSettingsFF.dll
    FF - component: c:\users\justin\appdata\roaming\mozilla\firefox\profiles\ngysdz70.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\components\MailUtil.dll
    FF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLL
    FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL
    FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npMozCouponPrinter.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\nppdf32.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin2.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin3.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin4.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin5.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin6.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npqtplugin7.dll
    FF - plugin: c:\program files\mozilla firefox 4.0 beta 1\plugins\npwachk.dll
    FF - plugin: c:\program files\opera\program\plugins\np_gp.dll
    FF - plugin: c:\program files\opera\program\plugins\npMozCouponPrinter.dll
    FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\users\justin\appdata\local\google\update\1.3.21.53\npGoogleUpdate3.dll
    FF - plugin: c:\users\justin\appdata\roaming\mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\users\justin\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
    ============= SERVICES / DRIVERS ===============
    .
    R0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [2011-5-12 20472]
    R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 165264]
    R1 MpKsl085b4d4f;MpKsl085b4d4f;c:\programdata\microsoft\microsoft antimalware\definition updates\{12e37ea4-56a4-49b7-905b-06818ffa5731}\MpKsl085b4d4f.sys [2011-5-16 28752]
    R1 MpKsl81425120;MpKsl81425120;c:\programdata\microsoft\microsoft antimalware\definition updates\{12e37ea4-56a4-49b7-905b-06818ffa5731}\MpKsl81425120.sys [2011-5-16 28752]
    R2 #UpdateService;Box Sync Auto-updater;c:\program files\box sync\UpdateService.exe [2011-3-31 8704]
    R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2006-12-12 79432]
    R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2011-3-28 1242504]
    R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-9-30 374152]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-8-11 12856]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-2-16 47640]
    R2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\microsoft sql server\100\dts\binn\MsDtsSrvr.exe [2008-7-10 218136]
    R2 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
    R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\nitro pdf\professional\NitroPDFDriverService.exe [2011-1-12 196928]
    R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2011-1-12 68928]
    R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\microsoft sql server\msrs10.mssqlserver\reporting services\reportserver\bin\ReportingServicesService.exe [2009-3-30 1113448]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-8-11 1153368]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-6-18 43392]
    R3 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\microsoft sql server\mssql10.mssqlserver\mssql\binn\fdlauncher.exe [2008-7-10 31256]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2010-11-16 84832]
    S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-20 39272]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
    S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-3-15 30192]
    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-2-23 15872]
    S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-2-23 52224]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-1 1343400]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2009-7-13 17920]
    S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2009-7-13 20480]
    S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]
    S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
    S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
    .
    =============== Created Last 30 ================
    .
    2011-05-16 18:31:02 28752 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{12e37ea4-56a4-49b7-905b-06818ffa5731}\MpKsl81425120.sys
    2011-05-16 12:34:47 28752 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{12e37ea4-56a4-49b7-905b-06818ffa5731}\MpKsl085b4d4f.sys
    2011-05-13 17:46:48 -------- d-----w- c:\program files\CCleaner
    2011-05-13 17:31:12 -------- d-----w- C:\!KillBox
    2011-05-13 16:37:20 388096 ----a-r- c:\users\justin\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2011-05-13 16:30:39 -------- d-----w- c:\program files\HJT
    2011-05-12 18:40:24 -------- d-----w- c:\users\justin\appdata\roaming\FixTDSS
    2011-05-12 18:40:23 20472 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
    2011-05-12 18:22:23 -------- d-----w- C:\SDFix
    2011-05-12 18:09:01 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2011-05-12 14:45:01 -------- dc----w- c:\users\justin\appdata\local\MigWiz
    2011-05-12 14:36:32 7071056 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{12e37ea4-56a4-49b7-905b-06818ffa5731}\mpengine.dll
    2011-05-11 12:43:22 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-05-11 12:43:21 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-05-06 14:38:47 77312 --sha-r- c:\users\justin\appdata\roaming\mfdvdecr.dll
    2011-05-04 13:57:02 -------- d-----w- c:\program files\iPod
    2011-05-04 13:57:01 -------- d-----w- c:\program files\iTunes
    2011-05-04 13:52:54 -------- d-----w- c:\program files\Bonjour
    2011-04-27 17:50:58 31232 ----a-w- c:\windows\system32\prevhost.exe
    2011-04-27 17:50:53 1699328 ----a-w- c:\windows\system32\esent.dll
    2011-04-27 17:50:53 1211264 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-04-27 17:50:52 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
    2011-04-27 17:50:52 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-04-27 17:50:52 148864 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-04-27 17:50:52 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-04-27 17:50:51 74240 ----a-w- c:\windows\system32\fsutil.exe
    2011-04-27 17:50:51 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
    2011-04-27 17:50:51 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-04-27 17:50:35 2616320 ----a-w- c:\windows\explorer.exe
    2011-04-25 12:52:08 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
    2011-04-19 20:42:49 -------- d-----w- c:\users\justin\appdata\roaming\Box Desktop
    2011-04-19 20:42:30 -------- d-----w- c:\program files\Box Sync

    ..
    ==================== Find3M ====================
    .
    2011-04-06 20:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 20:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2011-03-12 11:23:45 870912 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-03-11 05:33:59 1164288 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-11 05:33:59 1137664 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-08 05:28:29 741376 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 05:38:01 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-03-03 05:36:16 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
    2011-03-03 03:42:34 2333184 ----a-w- c:\windows\system32\win32k.sys
    2011-02-24 05:38:54 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-23 22:21:16 152576 ----a-w- c:\windows\system32\msclmd.dll
    2011-02-19 06:30:54 805376 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-19 06:30:51 1076736 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-19 06:30:50 739840 ----a-w- c:\windows\system32\d2d1.dll
    2011-02-19 06:30:46 34304 ----a-w- c:\windows\system32\atmlib.dll
    2011-02-19 04:34:54 294912 ----a-w- c:\windows\system32\atmfd.dll
    2011-02-18 21:36:58 4184352 ----a-w- c:\windows\system32\usbaaplrc.dl
     
  15. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    Sorry so many posts , it kept telling me too many image files, anyways here is the attach .txt log

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows 7 Ultimate
    Boot Device: \Device\HarddiskVolume3
    Install Date: 10/27/2009 4:16:03 PM
    System Uptime: 5/16/2011 2:30:26 PM (0 hours ago)
    .
    Motherboard: Dell Inc. | | 0YP696
    Processor: AMD Athlon(tm) Processor 1640B | Socket M2 | 2700/1000mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 453 GiB total, 264.232 GiB free.
    D: is FIXED (NTFS) - 13 GiB total, 11.645 GiB free.
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl7d84b6f3
    Device ID: ROOT\LEGACY_MPKSL7D84B6F3\0000
    Manufacturer:
    Name: MpKsl7d84b6f3
    PNP Device ID: ROOT\LEGACY_MPKSL7D84B6F3\0000
    Service: MpKsl7d84b6f3
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl36861016
    Device ID: ROOT\LEGACY_MPKSL36861016\0000
    Manufacturer:
    Name: MpKsl36861016
    PNP Device ID: ROOT\LEGACY_MPKSL36861016\0000
    Service: MpKsl36861016
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl9462b72e
    Device ID: ROOT\LEGACY_MPKSL9462B72E\0000
    Manufacturer:
    Name: MpKsl9462b72e
    PNP Device ID: ROOT\LEGACY_MPKSL9462B72E\0000
    Service: MpKsl9462b72e
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl390e6972
    Device ID: ROOT\LEGACY_MPKSL390E6972\0000
    Manufacturer:
    Name: MpKsl390e6972
    PNP Device ID: ROOT\LEGACY_MPKSL390E6972\0000
    Service: MpKsl390e6972
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl9ea04dce
    Device ID: ROOT\LEGACY_MPKSL9EA04DCE\0000
    Manufacturer:
    Name: MpKsl9ea04dce
    PNP Device ID: ROOT\LEGACY_MPKSL9EA04DCE\0000
    Service: MpKsl9ea04dce
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl3e6df976
    Device ID: ROOT\LEGACY_MPKSL3E6DF976\0000
    Manufacturer:
    Name: MpKsl3e6df976
    PNP Device ID: ROOT\LEGACY_MPKSL3E6DF976\0000
    Service: MpKsl3e6df976
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl4416ed94
    Device ID: ROOT\LEGACY_MPKSL4416ED94\0000
    Manufacturer:
    Name: MpKsl4416ed94
    PNP Device ID: ROOT\LEGACY_MPKSL4416ED94\0000
    Service: MpKsl4416ed94
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsla8a6fbe6
    Device ID: ROOT\LEGACY_MPKSLA8A6FBE6\0000
    Manufacturer:
    Name: MpKsla8a6fbe6
    PNP Device ID: ROOT\LEGACY_MPKSLA8A6FBE6\0000
    Service: MpKsla8a6fbe6
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl62421179
    Device ID: ROOT\LEGACY_MPKSL62421179\0000
    Manufacturer:
    Name: MpKsl62421179
    PNP Device ID: ROOT\LEGACY_MPKSL62421179\0000
    Service: MpKsl62421179
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl12e4e7f1
    Device ID: ROOT\LEGACY_MPKSL12E4E7F1\0000
    Manufacturer:
    Name: MpKsl12e4e7f1
    PNP Device ID: ROOT\LEGACY_MPKSL12E4E7F1\0000
    Service: MpKsl12e4e7f1
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsld5d4b01a
    Device ID: ROOT\LEGACY_MPKSLD5D4B01A\0000
    Manufacturer:
    Name: MpKsld5d4b01a
    PNP Device ID: ROOT\LEGACY_MPKSLD5D4B01A\0000
    Service: MpKsld5d4b01a
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsle2e8bd86
    Device ID: ROOT\LEGACY_MPKSLE2E8BD86\0000
    Manufacturer:
    Name: MpKsle2e8bd86
    PNP Device ID: ROOT\LEGACY_MPKSLE2E8BD86\0000
    Service: MpKsle2e8bd86
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl743ae810
    Device ID: ROOT\LEGACY_MPKSL743AE810\0000
    Manufacturer:
    Name: MpKsl743ae810
    PNP Device ID: ROOT\LEGACY_MPKSL743AE810\0000
    Service: MpKsl743ae810
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl18a3d230
    Device ID: ROOT\LEGACY_MPKSL18A3D230\0000
    Manufacturer:
    Name: MpKsl18a3d230
    PNP Device ID: ROOT\LEGACY_MPKSL18A3D230\0000
    Service: MpKsl18a3d230
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    AAC Decoder
    Adobe Acrobat 9 Standard - English, Français, Deutsch
    Adobe Acrobat 9.4.4 - CPSID_83708
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Shockwave Player 11.5
    AIM 7
    Aim Plugin for QQ Games
    AIM Toolbar
    Aimersoft DVD Ripper(Build 2.5.0.0)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Control Center
    Audacity 1.3.12 (Unicode)
    AutoUpdate
    BitTorrent
    BitTorrentBar Toolbar
    BlackBerry Desktop Software 6.0.1
    BlackBerry Device Software Updater
    BlackBerry® Media Sync
    Bonjour
    Box Sync
    Broadcom ASF Management Applications
    Broadcom Management Programs
    Browser Address Error Redirector
    CA Yahoo! Anti-Spy (remove only)
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Localization Chinese Standard
    Catalyst Control Center Localization Chinese Traditional
    Catalyst Control Center Localization French
    Catalyst Control Center Localization German
    Catalyst Control Center Localization Italian
    Catalyst Control Center Localization Japanese
    Catalyst Control Center Localization Korean
    Catalyst Control Center Localization Polish
    Catalyst Control Center Localization Portuguese
    Catalyst Control Center Localization Spanish
    Catalyst Control Center Localization Thai
    ccc-core-static
    ccc-utility
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help English
    CCC Help French
    CCC Help German
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Spanish
    CCC Help Thai
    CCleaner
    Conduit Engine
    ConvertXtoDVD 4.1.2.336
    Coupon Printer for Windows
    Crystal Reports Basic Runtime for Visual Studio 2008
    CustomerResearchQFolder
    D3DX10
    Dealio Toolbar v4.0.2
    Definition update for Microsoft Office 2010 (KB982726)
    Dell ETS Factory Installation
    Dell Getting Started Guide
    DesignPro 5.4 Limited Edition
    DivX Codec
    DivX Converter
    DivX Player
    DivX Plus DirectShow Filters
    DivX Version Checker
    DivX Web Player
    Download Updater (AOL LLC)
    Feedback Tool
    FileASSASSIN
    FileZilla Client 3.3.1
    Free Fire Screensaver
    Free Window Registry Repair
    Freeware PDF Unlocker
    GIMP 2.6.11
    Google Chrome
    Google Desktop
    Google Talk (remove only)
    Google Talk Plugin
    Google Toolbar for Internet Explorer
    GoToMeeting 4.5.0.457
    H.264 Decoder
    HiJackThis
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
    HP Color LaserJet 3600 (02/27/2007 61.063.461.41)
    HP Customer Participation Program 10.0
    HP LaserJet P2050 Series 1.0
    HP Update
    hppFonts
    hppManualsP2050
    hppPQVideoP2050
    hppQFolderP2050
    hppTLBXFXP2050
    hppusgP2030
    hppusgP2050
    HPSSupply
    hpzTLBXFX
    ImgBurn
    inFlow Inventory
    InstallMgr
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 24
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Junk Mail filter update
    LivePerson
    LogMeIn
    LogMeIn Hamachi
    Malwarebytes' Anti-Malware
    MarketResearch
    Matrix Code Emulator 1.6
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 4 Client Profile
    Microsoft Antimalware
    Microsoft Application Error Reporting
    Microsoft Default Manager
    Microsoft InfoPath 2010
    Microsoft Office 2003 Web Components
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Home and Business 2010
    Microsoft Office InfoPath 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office Live Add-in 1.4
    Microsoft Office Live Meeting 2007
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook Connector
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Single Image 2010
    Microsoft Office Visio 2010
    Microsoft Office Visio MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
    Microsoft Search Enhancement Pack
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft SQL Server 2005 Express Edition (INFLOWSQL)
    Microsoft SQL Server 2008
    Microsoft SQL Server 2008 Analysis Services
    Microsoft SQL Server 2008 BI Development Studio
    Microsoft SQL Server 2008 Books Online (August 2008)
    Microsoft SQL Server 2008 Browser
    Microsoft SQL Server 2008 Client Tools
    Microsoft SQL Server 2008 Common Files
    Microsoft SQL Server 2008 Database Engine Services
    Microsoft SQL Server 2008 Database Engine Shared
    Microsoft SQL Server 2008 Full text search
    Microsoft SQL Server 2008 Integration Services
    Microsoft SQL Server 2008 Management Studio
    Microsoft SQL Server 2008 Native Client
    Microsoft SQL Server 2008 Policies
    Microsoft SQL Server 2008 Reporting Services
    Microsoft SQL Server 2008 RsFx Driver
    Microsoft SQL Server 2008 Setup Support Files
    Microsoft SQL Server Compact 3.5 SP1 English
    Microsoft SQL Server Compact 3.5 SP1 Query Tools English
    Microsoft SQL Server Management Objects Collection
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Sync Framework Runtime v1.0 (x86)
    Microsoft Sync Services for ADO.NET v2.0 (x86)
    Microsoft VC9 runtime libraries
    Microsoft Visio Professional 2010
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual Studio 2008 Shell (integrated mode) - ENU
    Microsoft Visual Studio Tools for Applications 2.0 - ENU
    MKV Splitter
    MLB.TV NexDef Plug-in
    Move Networks Media Player for Internet Explorer
    Mozilla Firefox (3.6.12)
    Mozilla Firefox 4.0.1 (x86 en-US)
    MrvlUsgTracking
    MSN Toolbar
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 and SOAP Toolkit 3.0
    Nitro PDF Professional
    Notepad++
    Octoshape add-in for Adobe Flash Player
    OGA Notifier 2.0.0048.0
    Paint.NET v3.5.4
    Pando Media Booster
    PDF CanOpener
    PeerBlock 1.1 (r518)
    PrtScr 1.5
    QuickTime
    RegInOut System Utilities
    Roxio Media Manager
    Safari
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft Excel 2010 (KB2466146)
    Security Update for Microsoft Office 2010 (KB2289078)
    Security Update for Microsoft Office 2010 (KB2289161)
    Security Update for Microsoft PowerPoint 2010 (KB2519975)
    Security Update for Microsoft Publisher 2010 (KB2409055)
    Security Update for Microsoft Word 2010 (KB2345000)
    Service Pack 1 for SQL Server 2008 (KB968369)
    Shop for HP Supplies
    Skins
    Skype™ 4.2
    Sonic CinePlayer Decoder Pack
    Spybot - Search & Destroy
    Sql Server Customer Experience Improvement Program
    SQL Server System CLR Types
    StreamTorrent 1.0
    Synergy
    Touchstar Agent
    TouchStar Supervisor 6.0 (Build 50)
    Update for Microsoft Office 2010 (KB2202188)
    Update for Microsoft Office 2010 (KB2413186)
    Update for Microsoft Office 2010 (KB2494150)
    Update for Microsoft OneNote 2010 (KB2493983)
    Update for Microsoft Outlook Social Connector (KB2441641)
    USb Missile Launcher
    V CAST Music with Rhapsody
    VC80CRTRedist - 8.0.50727.762
    Viewpoint Media Player
    Vista Codec Package
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WebReg
    Winamp
    Winamp Detector Plug-in
    WinDirStat 1.1.2
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live OneCare safety scanner
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows XP Mode
    WinRAR archiver
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    5/9/2011 5:44:03 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x00041790, 0xc0802076, 0x0000ffff, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 050911-22323-01.
    5/9/2011 3:56:34 PM, Error: Microsoft-Windows-DistributedCOM [10009] - DCOM was unable to communicate with the computer 268663-DB1 using any of the configured protocols.
    5/16/2011 2:33:52 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Browser service.
    5/16/2011 2:33:07 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: klmdb
    5/16/2011 2:32:32 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 9 service to connect.
    5/16/2011 2:32:11 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    5/16/2011 2:31:03 PM, Error: Service Control Manager [7000] - The adfs service failed to start due to the following error: The system cannot find the file specified.
    5/16/2011 11:34:34 AM, Error: Service Control Manager [7000] - The Computer Browser service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/16/2011 10:38:18 AM, Error: Microsoft-Windows-WMPNSS-Service [14365] - Proximity detection failed due to unknown error '0x80004004'. The best proximity time detected was -1 milliseconds.
    5/16/2011 1:57:52 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1557.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x80240022 Error description: The program can't check for definition updates.
    5/16/2011 1:57:52 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1557.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x80240022 Error description: The program can't check for definition updates.
    5/13/2011 9:52:27 AM, Error: Service Control Manager [7022] - The Windows Search service hung on starting.
    5/13/2011 8:48:10 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800705b4: Update for Windows 7 (KB2534366).
    5/13/2011 8:48:10 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800705b4: Update for Windows 7 (KB2529073).
    5/13/2011 3:06:39 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    5/12/2011 2:56:51 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xc0000005, 0x9bd1cf70, 0x00000000, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051211-21652-01.
    5/12/2011 2:32:11 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    5/12/2011 2:31:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    5/12/2011 2:31:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    5/12/2011 2:30:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    5/12/2011 2:30:44 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    5/12/2011 2:30:39 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    5/12/2011 2:30:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
    5/12/2011 2:30:11 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter spldr Wanarpv6
    5/12/2011 2:01:09 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    5/12/2011 12:45:28 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0xe9ce02f8, 0x00000002, 0x00000000, 0x82cc86ce). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051211-21153-01.
    5/12/2011 1:58:21 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1557.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
    5/12/2011 1:55:45 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1557.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
    5/12/2011 1:55:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    5/12/2011 1:03:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.
    5/12/2011 1:03:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.
    5/12/2011 1:02:21 PM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.
    5/11/2011 9:58:14 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1373.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
    .
    ==== End Of File ===========================
     
  16. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.

    =====================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  17. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    ComboFix 11-05-16.01 - Justin 05/16/2011 16:03:36.1.1 - x86
    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3070.804 [GMT -4:00]
    Running from: c:\users\Justin\Downloads\ComboFix.exe
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\install.exe
    c:\users\Justin\AppData\Roaming\mfdvdecr.dll
    c:\users\Justin\EULA.txt
    c:\users\Justin\g2mdlhlpx.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-16 to 2011-05-16 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-16 20:16 . 2011-05-16 20:16 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-05-13 17:46 . 2011-05-13 17:46 -------- d-----w- c:\program files\CCleaner
    2011-05-13 17:31 . 2011-05-13 17:31 -------- d-----w- C:\!KillBox
    2011-05-13 16:37 . 2011-05-13 16:37 388096 ----a-r- c:\users\Justin\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-05-13 16:30 . 2011-05-13 16:31 -------- d-----w- c:\program files\HJT
    2011-05-12 18:40 . 2011-05-12 18:40 -------- d-----w- c:\users\Justin\AppData\Roaming\FixTDSS
    2011-05-12 18:40 . 2011-05-12 18:42 20472 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
    2011-05-12 18:22 . 2008-11-06 06:03 -------- d-----w- C:\SDFix
    2011-05-12 18:09 . 2011-05-12 18:09 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2011-05-12 14:45 . 2011-05-12 14:46 -------- dc----w- c:\users\Justin\AppData\Local\MigWiz
    2011-05-11 12:43 . 2011-04-09 06:02 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-05-11 12:43 . 2011-04-09 06:02 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-05-04 13:57 . 2011-05-04 13:57 -------- d-----w- c:\program files\iPod
    2011-05-04 13:57 . 2011-05-04 13:58 -------- d-----w- c:\program files\iTunes
    2011-05-04 13:52 . 2011-05-04 13:52 -------- d-----w- c:\program files\Bonjour
    2011-04-27 17:50 . 2011-02-18 05:39 31232 ----a-w- c:\windows\system32\prevhost.exe
    2011-04-27 17:50 . 2011-03-11 05:39 1211264 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-04-27 17:50 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\system32\esent.dll
    2011-04-27 17:50 . 2011-03-11 05:39 148864 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-04-27 17:50 . 2011-03-11 05:39 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-04-27 17:50 . 2011-03-11 05:38 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-04-27 17:50 . 2011-03-11 05:38 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
    2011-04-27 17:50 . 2011-03-11 05:39 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-04-27 17:50 . 2011-03-11 05:38 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
    2011-04-27 17:50 . 2011-03-11 05:31 74240 ----a-w- c:\windows\system32\fsutil.exe
    2011-04-27 17:50 . 2011-02-25 05:30 2616320 ----a-w- c:\windows\explorer.exe
    2011-04-25 12:52 . 2009-08-20 03:50 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
    2011-04-19 20:42 . 2011-05-03 12:39 -------- d-----w- c:\users\Justin\AppData\Roaming\Box Desktop
    2011-04-19 20:42 . 2011-04-19 20:42 -------- d-----w- c:\program files\Box Sync
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-06 20:20 . 2011-04-06 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 20:20 . 2011-04-06 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2011-04-01 12:34 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-03-15 16:15 . 2011-03-15 16:15 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
    2011-03-15 16:15 . 2011-03-15 16:15 161792 ----a-w- c:\windows\system32\msls31.dll
    2011-03-15 16:15 . 2011-03-15 16:15 1126912 ----a-w- c:\windows\system32\wininet.dll
    2011-03-15 16:15 . 2011-03-15 16:15 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
    2011-03-15 16:15 . 2011-03-15 16:15 86528 ----a-w- c:\windows\system32\iesysprep.dll
    2011-03-15 16:15 . 2011-03-15 16:15 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
    2011-03-15 16:15 . 2011-03-15 16:15 63488 ----a-w- c:\windows\system32\tdc.ocx
    2011-03-15 16:15 . 2011-03-15 16:15 48640 ----a-w- c:\windows\system32\mshtmler.dll
    2011-03-15 16:15 . 2011-03-15 16:15 367104 ----a-w- c:\windows\system32\html.iec
    2011-03-15 16:15 . 2011-03-15 16:15 74752 ----a-w- c:\windows\system32\iesetup.dll
    2011-03-15 16:15 . 2011-03-15 16:15 420864 ----a-w- c:\windows\system32\vbscript.dll
    2011-03-15 16:15 . 2011-03-15 16:15 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2011-03-15 16:15 . 2011-03-15 16:15 23552 ----a-w- c:\windows\system32\licmgr10.dll
    2011-03-15 16:15 . 2011-03-15 16:15 152064 ----a-w- c:\windows\system32\wextract.exe
    2011-03-15 16:15 . 2011-03-15 16:15 150528 ----a-w- c:\windows\system32\iexpress.exe
    2011-03-15 16:15 . 2011-03-15 16:15 142848 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-03-15 16:15 . 2011-03-15 16:15 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-03-15 16:15 . 2011-03-15 16:15 11776 ----a-w- c:\windows\system32\mshta.exe
    2011-03-15 16:15 . 2011-03-15 16:15 35840 ----a-w- c:\windows\system32\imgutil.dll
    2011-03-15 16:15 . 2011-03-15 16:15 1797632 ----a-w- c:\windows\system32\jscript9.dll
    2011-03-15 16:15 . 2011-03-15 16:15 101888 ----a-w- c:\windows\system32\admparse.dll
    2011-03-12 11:23 . 2011-04-15 01:42 870912 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-03-11 05:33 . 2011-04-15 01:42 1137664 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-11 05:33 . 2011-04-15 01:42 1164288 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-08 05:28 . 2011-04-15 01:42 741376 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 05:38 . 2011-04-15 01:43 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-03-03 05:36 . 2011-04-15 01:43 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
    2011-03-03 03:42 . 2011-04-15 01:42 2333184 ----a-w- c:\windows\system32\win32k.sys
    2011-02-24 05:38 . 2011-04-15 01:42 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-23 22:21 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
    2011-02-23 04:48 . 2011-04-15 01:43 311808 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-02-23 04:48 . 2011-04-15 01:43 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-02-23 04:47 . 2011-04-15 01:43 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-02-23 04:47 . 2011-04-15 01:42 223232 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-02-23 04:47 . 2011-04-15 01:42 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-02-23 04:47 . 2011-04-15 01:42 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-23 04:47 . 2011-04-15 01:42 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
    2011-02-19 06:30 . 2011-03-09 18:48 805376 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-19 06:30 . 2011-03-09 18:48 1076736 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-19 06:30 . 2011-03-09 18:48 739840 ----a-w- c:\windows\system32\d2d1.dll
    2011-02-19 06:30 . 2011-04-15 01:42 34304 ----a-w- c:\windows\system32\atmlib.dll
    2011-02-19 04:34 . 2011-04-15 01:42 294912 ----a-w- c:\windows\system32\atmfd.dll
    2011-02-18 21:36 . 2011-02-18 21:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2011-02-18 21:36 . 2011-02-18 21:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    2011-03-15 13:46 . 2011-03-15 13:46 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\BitTorrentBar\tbBitT.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-12-09 3911776]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopFileLocked]
    @="{C253B817-3A00-475f-A5A3-6F2DD704B48D}"
    [HKEY_CLASSES_ROOT\CLSID\{C253B817-3A00-475f-A5A3-6F2DD704B48D}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopNotSynced]
    @="{19ACC806-F7AA-46AA-A80A-726A07CA6637}"
    [HKEY_CLASSES_ROOT\CLSID\{19ACC806-F7AA-46AA-A80A-726A07CA6637}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopNotSyncedCollabs]
    @="{337D9DE0-3F8B-4430-AF0F-FFC24A95AE8F}"
    [HKEY_CLASSES_ROOT\CLSID\{337D9DE0-3F8B-4430-AF0F-FFC24A95AE8F}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopSynced]
    @="{B7AC9C6D-F15B-4B1A-A88D-F518D13861D9}"
    [HKEY_CLASSES_ROOT\CLSID\{B7AC9C6D-F15B-4B1A-A88D-F518D13861D9}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopSyncedCollab]
    @="{9E48C232-F601-4E41-BB3E-16CBAF317AA4}"
    [HKEY_CLASSES_ROOT\CLSID\{9E48C232-F601-4E41-BB3E-16CBAF317AA4}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
    "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-11-05 6174008]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-24 68856]
    "Aim"="c:\program files\AIM\aim.exe" [2011-01-05 4321112]
    "BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-03-28 400760]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-04-08 405504]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-22 640440]
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-01-31 38840]
    "HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2008-05-07 36864]
    "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
    "ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2008-04-02 53248]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
    "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-03-15 30192]
    "LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-03-28 1910152]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160]
    .
    c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    MLB.TV NexDef Plug-in.lnk - c:\users\Justin\AppData\Local\Autobahn\mlb-nexdef-autobahn.exe [2009-4-1 801032]
    outback - Shortcut.lnk - C:\outback.bat [2010-2-9 1158]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Box Sync.lnk - c:\program files\Box Sync\BoxSync.exe [2011-3-31 6901760]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoxSyncHelper]
    2011-03-31 20:56 385024 ----a-w- c:\program files\Box Sync\BoxSyncHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
    2007-01-01 21:22 3739648 ----a-w- c:\users\Justin\AppData\Roaming\Google\Google Talk\googletalk.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
    2008-08-11 17:41 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    .
    R0 klmdb;klmdb;c:\windows\system32\drivers\klmdb.sys [x]
    R1 MpKsl12e4e7f1;MpKsl12e4e7f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74DE7361-ABE0-412F-8766-E3404F917A59}\MpKsl12e4e7f1.sys [x]
    R1 MpKsl18a3d230;MpKsl18a3d230;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{72855BA7-617A-40E2-84EB-B011A721FE11}\MpKsl18a3d230.sys [x]
    R1 MpKsl36861016;MpKsl36861016;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18E3F757-C571-44C0-A2A4-CE0EC5B45844}\MpKsl36861016.sys [x]
    R1 MpKsl390e6972;MpKsl390e6972;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B2F94111-9AF1-4305-A760-28C1F19D1409}\MpKsl390e6972.sys [x]
    R1 MpKsl3e6df976;MpKsl3e6df976;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B135CC70-F605-4632-96A7-9DC96DDBA803}\MpKsl3e6df976.sys [x]
    R1 MpKsl4416ed94;MpKsl4416ed94;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7CD70504-E706-4C6F-9183-4B129BE44401}\MpKsl4416ed94.sys [x]
    R1 MpKsl62421179;MpKsl62421179;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{46D552D8-063F-48C4-AB0F-081B482E53BD}\MpKsl62421179.sys [x]
    R1 MpKsl743ae810;MpKsl743ae810;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{906A96FB-A29B-48BA-815A-C48F0363AFE7}\MpKsl743ae810.sys [x]
    R1 MpKsl7d84b6f3;MpKsl7d84b6f3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D4F32C13-1D84-4906-B9F4-F6A46FACCEF0}\MpKsl7d84b6f3.sys [x]
    R1 MpKsl9462b72e;MpKsl9462b72e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FF0D12DB-9776-4285-BB16-D8074FE8E196}\MpKsl9462b72e.sys [x]
    R1 MpKsl9ea04dce;MpKsl9ea04dce;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12E37EA4-56A4-49B7-905B-06818FFA5731}\MpKsl9ea04dce.sys [x]
    R1 MpKsla8a6fbe6;MpKsla8a6fbe6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{767F5F5E-FB9D-4016-B57D-F2C269D084FC}\MpKsla8a6fbe6.sys [x]
    R1 MpKsld5d4b01a;MpKsld5d4b01a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F6522326-ECE0-481B-AE17-9D47F131B867}\MpKsld5d4b01a.sys [x]
    R1 MpKsle2e8bd86;MpKsle2e8bd86;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12E37EA4-56A4-49B7-905B-06818FFA5731}\MpKsle2e8bd86.sys [x]
    R1 rbqqhnar;rbqqhnar;c:\windows\system32\drivers\rbqqhnar.sys [x]
    R1 urswjtkg;urswjtkg;c:\windows\system32\drivers\urswjtkg.sys [x]
    R1 vocgymoq;vocgymoq;c:\windows\system32\drivers\vocgymoq.sys [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
    R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2011-03-15 30192]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
    R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-01 1343400]
    R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
    R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
    R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
    S0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [2011-05-12 20472]
    S1 MpKsl085b4d4f;MpKsl085b4d4f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12E37EA4-56A4-49B7-905B-06818FFA5731}\MpKsl085b4d4f.sys [x]
    S2 8704pdateService;Box Sync Auto-updater;c:\program files\Box Sync\UpdateService.exe [2011-03-31 8704]
    S2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-12 79432]
    S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 1242504]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2010-12-08 374152]
    S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]
    S2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [2008-07-10 218136]
    S2 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
    S2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [2011-01-12 196928]
    S2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2011-01-12 68928]
    S2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2009-03-30 1113448]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S3 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [2008-07-10 31256]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - AvgTdiX
    *Deregistered* - MpNWMon
    *Deregistered* - NisDrv
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-744172185-87971296-2539405451-1002Core.job
    - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-28 14:21]
    .
    2011-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-744172185-87971296-2539405451-1002UA.job
    - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-28 14:21]
    .
    2011-03-07 c:\windows\Tasks\RegInOut Scheduled Scan - Justin.job
    - c:\program files\RegInOut\RegInOut.exe [2011-02-07 21:24]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.facebook.com/
    mStart Page = hxxp://www.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
    IE: Se&nd to OneNote - /105
    Trusted Zone: aetna.com\www
    Trusted Zone: real.com\rhap-app-4-0
    Trusted Zone: real.com\rhapreg
    DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} - hxxp://actiftp.hosting4less.com/ACTIGENERAL/AP&Manual/Live%20Demo/nvUnifiedControl.ocx
    FF - ProfilePath - c:\users\Justin\AppData\Roaming\Mozilla\Firefox\Profiles\ngysdz70.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=15-06-2009&tb_mrud=12-05-2010
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=100000000000000002&tb_oid=15-06-2009&tb_mrud=12-05-2010&query=
    FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKCU-Run-eracsqaozn - c:\users\Justin\AppData\Roaming\mfdvdecr.dll
    HKLM-Run-HPPQVideo - c:\program files\HP\ScheduledLaunch\HP LaserJet P2050 Series\bin\hppschlnch.exe -r SOFTWARE\Hewlett-Packard\ScheduledLaunch\LJ_P2050_Series -f PQOptimizerVideo.xml
    SafeBoot-klmdb.sys
    AddRemove-Aim Plugin for QQ Games - c:\program files\Tencent\QQ Games\Plugin\Uninstall.EXE
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-05-16 16:19:34
    ComboFix-quarantined-files.txt 2011-05-16 20:19
    .
    Pre-Run: 284,139,212,800 bytes free
    Post-Run: 284,064,415,744 bytes free
    .
    - - End Of File - - 4E0C2DCDBAD55ED7846484DB8178E39C
     
  18. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    You posted Attach.txt part of DDS again, instead of Bootkit Remover log.
     
  19. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    My mistake:

    I ran it again and it says

    System volume is \\.\C:
    main<>: CreateFile<> ERROR 5
    ERROR: Can't open volume device \\.\C:

    Done;
    Press and key to quit...
     
  20. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box
    • Click OK
    Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\system32\drivers\klmdb.sys
    c:\windows\system32\drivers\rbqqhnar.sys
    c:\windows\system32\drivers\urswjtkg.sys
    c:\windows\system32\drivers\vocgymoq.sys
    
    
    Driver::
    klmdb
    rbqqhnar
    urswjtkg
    vocgymoq
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  21. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    ComboFix 11-05-17.02 - Justin 05/18/2011 9:49.2.1 - x86
    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3070.1018 [GMT -4:00]
    Running from: c:\users\Justin\Downloads\ComboFix.exe
    Command switches used :: c:\users\Justin\Desktop\CFScript.txt
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    FILE ::
    "c:\windows\system32\drivers\klmdb.sys"
    "c:\windows\system32\drivers\rbqqhnar.sys"
    "c:\windows\system32\drivers\urswjtkg.sys"
    "c:\windows\system32\drivers\vocgymoq.sys"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
    c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
    c:\users\Justin\AppData\Local\Microsoft\Windows\Temporary Internet Files\HPPDEVX.DLL.log
    .
    ----- BITS: Possible infected sites -----
    .
    hxxp://updates.swarmcast.net
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_klmdb
    -------\Service_rbqqhnar
    -------\Service_urswjtkg
    -------\Service_vocgymoq
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-18 to 2011-05-18 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-18 14:09 . 2011-05-18 14:09 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-05-18 13:43 . 2011-05-18 13:43 -------- d-----w- C:\32788R22FWJFW
    2011-05-17 12:46 . 2011-04-18 13:15 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9314D409-C0EA-4B1F-AFF6-C578E881CD99}\mpengine.dll
    2011-05-16 18:49 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
    2011-05-13 17:46 . 2011-05-13 17:46 -------- d-----w- c:\program files\CCleaner
    2011-05-13 17:31 . 2011-05-13 17:31 -------- d-----w- C:\!KillBox
    2011-05-13 16:37 . 2011-05-13 16:37 388096 ----a-r- c:\users\Justin\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-05-13 16:30 . 2011-05-13 16:31 -------- d-----w- c:\program files\HJT
    2011-05-12 18:40 . 2011-05-12 18:40 -------- d-----w- c:\users\Justin\AppData\Roaming\FixTDSS
    2011-05-12 18:40 . 2011-05-12 18:42 20472 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
    2011-05-12 18:22 . 2008-11-06 06:03 -------- d-----w- C:\SDFix
    2011-05-12 18:09 . 2011-05-12 18:09 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2011-05-12 14:45 . 2011-05-18 12:39 -------- dc----w- c:\users\Justin\AppData\Local\MigWiz
    2011-05-11 12:43 . 2011-04-09 06:02 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-05-11 12:43 . 2011-04-09 06:02 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-05-04 13:57 . 2011-05-04 13:57 -------- d-----w- c:\program files\iPod
    2011-05-04 13:57 . 2011-05-04 13:58 -------- d-----w- c:\program files\iTunes
    2011-05-04 13:52 . 2011-05-04 13:52 -------- d-----w- c:\program files\Bonjour
    2011-04-27 17:50 . 2011-02-18 05:39 31232 ----a-w- c:\windows\system32\prevhost.exe
    2011-04-27 17:50 . 2011-03-11 05:39 1211264 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-04-27 17:50 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\system32\esent.dll
    2011-04-27 17:50 . 2011-03-11 05:39 148864 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-04-27 17:50 . 2011-03-11 05:39 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-04-27 17:50 . 2011-03-11 05:38 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-04-27 17:50 . 2011-03-11 05:38 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
    2011-04-27 17:50 . 2011-03-11 05:39 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-04-27 17:50 . 2011-03-11 05:38 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
    2011-04-27 17:50 . 2011-03-11 05:31 74240 ----a-w- c:\windows\system32\fsutil.exe
    2011-04-27 17:50 . 2011-02-25 05:30 2616320 ----a-w- c:\windows\explorer.exe
    2011-04-25 12:52 . 2009-08-20 03:50 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
    2011-04-19 20:42 . 2011-05-03 12:39 -------- d-----w- c:\users\Justin\AppData\Roaming\Box Desktop
    2011-04-19 20:42 . 2011-04-19 20:42 -------- d-----w- c:\program files\Box Sync
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-06 20:20 . 2011-04-06 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 20:20 . 2011-04-06 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2011-04-01 12:34 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-03-15 16:15 . 2011-03-15 16:15 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
    2011-03-15 16:15 . 2011-03-15 16:15 161792 ----a-w- c:\windows\system32\msls31.dll
    2011-03-15 16:15 . 2011-03-15 16:15 1126912 ----a-w- c:\windows\system32\wininet.dll
    2011-03-15 16:15 . 2011-03-15 16:15 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
    2011-03-15 16:15 . 2011-03-15 16:15 86528 ----a-w- c:\windows\system32\iesysprep.dll
    2011-03-15 16:15 . 2011-03-15 16:15 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
    2011-03-15 16:15 . 2011-03-15 16:15 63488 ----a-w- c:\windows\system32\tdc.ocx
    2011-03-15 16:15 . 2011-03-15 16:15 48640 ----a-w- c:\windows\system32\mshtmler.dll
    2011-03-15 16:15 . 2011-03-15 16:15 367104 ----a-w- c:\windows\system32\html.iec
    2011-03-15 16:15 . 2011-03-15 16:15 74752 ----a-w- c:\windows\system32\iesetup.dll
    2011-03-15 16:15 . 2011-03-15 16:15 420864 ----a-w- c:\windows\system32\vbscript.dll
    2011-03-15 16:15 . 2011-03-15 16:15 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2011-03-15 16:15 . 2011-03-15 16:15 23552 ----a-w- c:\windows\system32\licmgr10.dll
    2011-03-15 16:15 . 2011-03-15 16:15 152064 ----a-w- c:\windows\system32\wextract.exe
    2011-03-15 16:15 . 2011-03-15 16:15 150528 ----a-w- c:\windows\system32\iexpress.exe
    2011-03-15 16:15 . 2011-03-15 16:15 142848 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-03-15 16:15 . 2011-03-15 16:15 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-03-15 16:15 . 2011-03-15 16:15 11776 ----a-w- c:\windows\system32\mshta.exe
    2011-03-15 16:15 . 2011-03-15 16:15 35840 ----a-w- c:\windows\system32\imgutil.dll
    2011-03-15 16:15 . 2011-03-15 16:15 1797632 ----a-w- c:\windows\system32\jscript9.dll
    2011-03-15 16:15 . 2011-03-15 16:15 101888 ----a-w- c:\windows\system32\admparse.dll
    2011-03-12 11:23 . 2011-04-15 01:42 870912 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-03-11 05:33 . 2011-04-15 01:42 1137664 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-11 05:33 . 2011-04-15 01:42 1164288 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-08 05:28 . 2011-04-15 01:42 741376 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 05:38 . 2011-04-15 01:43 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-03-03 05:36 . 2011-04-15 01:43 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
    2011-03-03 03:42 . 2011-04-15 01:42 2333184 ----a-w- c:\windows\system32\win32k.sys
    2011-02-24 05:38 . 2011-04-15 01:42 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-23 22:21 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
    2011-02-23 04:48 . 2011-04-15 01:43 311808 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-02-23 04:48 . 2011-04-15 01:43 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-02-23 04:47 . 2011-04-15 01:43 114176 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-02-23 04:47 . 2011-04-15 01:42 223232 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-02-23 04:47 . 2011-04-15 01:42 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-02-23 04:47 . 2011-04-15 01:42 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-23 04:47 . 2011-04-15 01:42 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
    2011-02-19 06:30 . 2011-03-09 18:48 805376 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-19 06:30 . 2011-03-09 18:48 1076736 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-19 06:30 . 2011-03-09 18:48 739840 ----a-w- c:\windows\system32\d2d1.dll
    2011-02-19 06:30 . 2011-04-15 01:42 34304 ----a-w- c:\windows\system32\atmlib.dll
    2011-02-19 04:34 . 2011-04-15 01:42 294912 ----a-w- c:\windows\system32\atmfd.dll
    2011-02-18 21:36 . 2011-02-18 21:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2011-02-18 21:36 . 2011-02-18 21:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    2011-03-15 13:46 . 2011-03-15 13:46 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    2010-12-09 17:51 3911776 ----a-w- c:\program files\BitTorrentBar\tbBitT.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\tbBitT.dll" [2010-12-09 3911776]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
    .
    [HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopFileLocked]
    @="{C253B817-3A00-475f-A5A3-6F2DD704B48D}"
    [HKEY_CLASSES_ROOT\CLSID\{C253B817-3A00-475f-A5A3-6F2DD704B48D}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopNotSynced]
    @="{19ACC806-F7AA-46AA-A80A-726A07CA6637}"
    [HKEY_CLASSES_ROOT\CLSID\{19ACC806-F7AA-46AA-A80A-726A07CA6637}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopNotSyncedCollabs]
    @="{337D9DE0-3F8B-4430-AF0F-FFC24A95AE8F}"
    [HKEY_CLASSES_ROOT\CLSID\{337D9DE0-3F8B-4430-AF0F-FFC24A95AE8F}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopSynced]
    @="{B7AC9C6D-F15B-4B1A-A88D-F518D13861D9}"
    [HKEY_CLASSES_ROOT\CLSID\{B7AC9C6D-F15B-4B1A-A88D-F518D13861D9}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BoxDesktopSyncedCollab]
    @="{9E48C232-F601-4E41-BB3E-16CBAF317AA4}"
    [HKEY_CLASSES_ROOT\CLSID\{9E48C232-F601-4E41-BB3E-16CBAF317AA4}]
    2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
    "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-11-05 6174008]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-24 68856]
    "Aim"="c:\program files\AIM\aim.exe" [2011-01-05 4321112]
    "BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-03-28 400760]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-04-08 405504]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-22 640440]
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-01-31 38840]
    "HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2008-05-07 36864]
    "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
    "ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2008-04-02 53248]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
    "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-03-15 30192]
    "LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-03-28 1910152]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160]
    .
    c:\users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    MLB.TV NexDef Plug-in.lnk - c:\users\Justin\AppData\Local\Autobahn\mlb-nexdef-autobahn.exe [2009-4-1 801032]
    outback - Shortcut.lnk - C:\outback.bat [2010-2-9 1158]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Box Sync.lnk - c:\program files\Box Sync\BoxSync.exe [2011-3-31 6901760]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BoxSyncHelper]
    2011-03-31 20:56 385024 ----a-w- c:\program files\Box Sync\BoxSyncHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
    2007-01-01 21:22 3739648 ----a-w- c:\users\Justin\AppData\Roaming\Google\Google Talk\googletalk.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
    2008-08-11 17:41 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    .
    R1 MpKsl12e4e7f1;MpKsl12e4e7f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74DE7361-ABE0-412F-8766-E3404F917A59}\MpKsl12e4e7f1.sys [x]
    R1 MpKsl18a3d230;MpKsl18a3d230;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{72855BA7-617A-40E2-84EB-B011A721FE11}\MpKsl18a3d230.sys [x]
    R1 MpKsl36861016;MpKsl36861016;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18E3F757-C571-44C0-A2A4-CE0EC5B45844}\MpKsl36861016.sys [x]
    R1 MpKsl390e6972;MpKsl390e6972;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B2F94111-9AF1-4305-A760-28C1F19D1409}\MpKsl390e6972.sys [x]
    R1 MpKsl3e6df976;MpKsl3e6df976;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B135CC70-F605-4632-96A7-9DC96DDBA803}\MpKsl3e6df976.sys [x]
    R1 MpKsl4416ed94;MpKsl4416ed94;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7CD70504-E706-4C6F-9183-4B129BE44401}\MpKsl4416ed94.sys [x]
    R1 MpKsl62421179;MpKsl62421179;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{46D552D8-063F-48C4-AB0F-081B482E53BD}\MpKsl62421179.sys [x]
    R1 MpKsl743ae810;MpKsl743ae810;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{906A96FB-A29B-48BA-815A-C48F0363AFE7}\MpKsl743ae810.sys [x]
    R1 MpKsl7d84b6f3;MpKsl7d84b6f3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D4F32C13-1D84-4906-B9F4-F6A46FACCEF0}\MpKsl7d84b6f3.sys [x]
    R1 MpKsl9462b72e;MpKsl9462b72e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FF0D12DB-9776-4285-BB16-D8074FE8E196}\MpKsl9462b72e.sys [x]
    R1 MpKsl9ea04dce;MpKsl9ea04dce;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12E37EA4-56A4-49B7-905B-06818FFA5731}\MpKsl9ea04dce.sys [x]
    R1 MpKsla8a6fbe6;MpKsla8a6fbe6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{767F5F5E-FB9D-4016-B57D-F2C269D084FC}\MpKsla8a6fbe6.sys [x]
    R1 MpKsld5d4b01a;MpKsld5d4b01a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F6522326-ECE0-481B-AE17-9D47F131B867}\MpKsld5d4b01a.sys [x]
    R1 MpKsle2e8bd86;MpKsle2e8bd86;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12E37EA4-56A4-49B7-905B-06818FFA5731}\MpKsle2e8bd86.sys [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
    R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2011-03-15 30192]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
    R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-01 1343400]
    R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
    R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
    R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
    S0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [2011-05-12 20472]
    S2 8704pdateService;Box Sync Auto-updater;c:\program files\Box Sync\UpdateService.exe [2011-03-31 8704]
    S2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-12 79432]
    S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 1242504]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2010-12-08 374152]
    S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]
    S2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [2008-07-10 218136]
    S2 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
    S2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [2011-01-12 196928]
    S2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2011-01-12 68928]
    S2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2009-03-30 1113448]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S3 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [2008-07-10 31256]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - AvgTdiX
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-744172185-87971296-2539405451-1002Core.job
    - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-28 14:21]
    .
    2011-05-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-744172185-87971296-2539405451-1002UA.job
    - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-28 14:21]
    .
    2011-03-07 c:\windows\Tasks\RegInOut Scheduled Scan - Justin.job
    - c:\program files\RegInOut\RegInOut.exe [2011-02-07 21:24]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.facebook.com/
    mStart Page = hxxp://www.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
    IE: Se&nd to OneNote - /105
    Trusted Zone: aetna.com\www
    Trusted Zone: real.com\rhap-app-4-0
    Trusted Zone: real.com\rhapreg
    DPF: {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} - hxxp://actiftp.hosting4less.com/ACTIGENERAL/AP&Manual/Live%20Demo/nvUnifiedControl.ocx
    FF - ProfilePath - c:\users\Justin\AppData\Roaming\Mozilla\Firefox\Profiles\ngysdz70.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=15-06-2009&tb_mrud=12-05-2010
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=100000000000000002&tb_oid=15-06-2009&tb_mrud=12-05-2010&query=
    FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'Explorer.exe'(1456)
    c:\windows\System32\pnidui.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\LogMeIn\x86\RaMaint.exe
    c:\program files\LogMeIn\x86\LogMeIn.exe
    c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
    c:\windows\system32\taskhost.exe
    c:\program files\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\bin\msmdsrv.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE
    c:\windows\system32\conhost.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdhost.exe
    c:\windows\system32\conhost.exe
    c:\windows\system32\conhost.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    .
    **************************************************************************
    .
    Completion time: 2011-05-18 10:26:55 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-05-18 14:26
    ComboFix2.txt 2011-05-16 20:19
    .
    Pre-Run: 283,779,559,424 bytes free
    Post-Run: 283,481,886,720 bytes free
    .
    - - End Of File - - 87756CCB8B06FF843C26409787F51124
     
  22. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Looks good :)

    How is redirection?

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]
     
  23. jhenri23

    jhenri23 TS Rookie Topic Starter Posts: 20

    aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
    Run date: 2011-05-19 09:12:36
    -----------------------------
    09:12:36.180 OS Version: Windows 6.1.7601 Service Pack 1
    09:12:36.181 Number of processors: 1 586 0x7F02
    09:12:36.183 ComputerName: JUSTINS-PC UserName: Justin
    09:12:38.199 Initialize success
    09:12:39.939 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000074
    09:12:39.942 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
    09:12:41.958 Disk 0 MBR read successfully
    09:12:41.961 Disk 0 MBR scan
    09:12:41.964 Disk 0 Windows 7 default MBR code
    09:12:43.968 Disk 0 scanning sectors +976768065
    09:12:43.998 Disk 0 scanning C:\Windows\system32\drivers
    09:12:51.178 Service scanning
    09:12:53.069 Disk 0 trace - called modules:
    09:12:53.085 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor.sys
    09:12:53.090 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8638d030]
    09:12:53.097 3 CLASSPNP.SYS[8b39259e] -> nt!IofCallDriver -> [0x861ab3e8]
    09:12:53.102 5 ACPI.sys[8ae3b3d4] -> nt!IofCallDriver -> \Device\00000074[0x861ab030]
    09:12:53.107 Scan finished successfully
    09:13:00.192 Disk 0 MBR has been saved successfully to "C:\Users\Justin\Desktop\MBR.dat"
    09:13:00.198 The log file has been saved successfully to "C:\Users\Justin\Desktop\aswMBR.txt"
     
  24. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    You didn't say:
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...