TechSpot

Malwarebytes and Defender no longer working or visable.

By Hank1972
Apr 17, 2013
  1. I have a XP Pro desktop I use for my office, any way on Monday nite, I noticed tha it started to act strange. I then notice that Malware Bytes and Defender no longer work. Malware Bytes refuses to open even though I can see the Icon. I get mbam.exe Unable To Locate Component error message. My sounddriver ctfmon.exe, and Quickbooks all also say they are not there as well. When I try to run Defender I get Shortcut has been removed or changed message. I took out the hard drive and ran a Anti Virus scan from my laptop as the hard drive as an external HD. I for 4 viruses that I removed. When I went back to the desktop, I still had the same issue. I tried to do a system restore and got a "System Restore can not protect your computer at this time" I ran an anti virus scan in safe mode and still nothing. I then tried to install Hijackthis and it did not let me do the install. I read about a Malware bytes fix that I installed and still nothing. I did manage to get a log from DDS note pad which I will add that the end. Can some one please help me fix this?:

    DDS LOG:
    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 8.0.6001.18702
    Run by User at 16:43:49 on 2013-04-17
    .
    ============== Running Processes ================
    .
    \??\C:\Program Files\AVG\AVG2012\avgrsx.exe
    \??\C:\Program Files\AVG\AVG2012\avgcsrvx.exe
    C:\windows\system32\spoolsv.exe
    C:\windows\Explorer.EXE
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\Program Files\IDT\WDM\sttray.exe
    C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
    C:\Program Files\AVG SafeGuard toolbar\vprot.exe
    C:\program files\real\realplayer\update\realsched.exe
    C:\Program Files\AVG\AVG2012\avgwdsvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
    C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
    C:\Program Files\AVG\AVG2012\avgnsx.exe
    C:\Program Files\TeamViewer\Version7\TeamViewer.exe
    C:\Program Files\TeamViewer\Version7\tv_w32.exe
    C:\windows\System32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k WudfServiceGroup
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\system32\svchost.exe -k imgsvc
    C:\windows\system32\svchost.exe -k LocalService
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxps://www.google.com/
    uDefault_Page_URL = hxxp://www.msn.com
    BHO: AutorunsDisabled - <orphaned>
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
    BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: {3049C3E9-B461-4BC5-8870-4C09146192CA} - <orphaned>
    BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg2012\avgssie.dll
    BHO: AVG SafeGuard toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\avg safeguard toolbar\14.2.0.1\AVG SafeGuard toolbar_toolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - <orphaned>
    TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>
    TB: AVG SafeGuard toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\avg safeguard toolbar\14.2.0.1\AVG SafeGuard toolbar_toolbar.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [IntelAudioStudio] "c:\program files\intel audio studio\IntelAudioStudio.exe" TRAY
    mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
    mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
    mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
    mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\11\config\ereg\Ereg.ini
    mRun: [SysTrayApp] c:\program files\idt\wdm\sttray.exe
    mRun: [SigmatelSysTrayApp] sttray.exe
    mRun: [XeroxScannerDaemon] c:\program files\xerox\nwwia\XrxFTPLt.exe
    mRun: [vProt] "c:\program files\avg safeguard toolbar\vprot.exe"
    mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
    uPolicies-Explorer: NoDriveTypeAutoRun = dword:0
    mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
    mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    .
    INFO: HKCU has more than 50 listed domains.
    If you wish to scan all of them, select the 'Force scan all domains' option.
    .
    DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1366138758140
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1201810424968
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://systemrequirementslab.com.s3.amazonaws.com/iduu/bin/srldetect_intel.cab
    DPF: {D25A9538-F962-4501-9E68-D7C3DDECB148} - hxxp://75.144.211.249:8080/template/xWebView2.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com//activex/ractrl.cab?lmi=972
    TCP: Interfaces\{30456D21-770C-43E6-8D40-FDFE622586DD} : DHCPNameServer = 192.168.0.1 72.45.32.147 72.45.32.148
    Handler: AutorunsDisabled - <Clsid value has no data>
    Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
    Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\14.2.0\ViProtocol.dll
    Notify: AutorunsDisabled - <no file>
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - <orphaned>
    LSA: Authentication Packages = msv1_0 nwprovau
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
    .
    ============= SERVICES / DRIVERS ===============
    .
    R? AVGIDSAgent;AVGIDSAgent
    R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
    R? ControlSe;ControlSe
    R? Dri;Dri
    R? QBVSS;QBIDPService
    R? RoxLiveShare10;LiveShare P2P Server 10
    R? SessionLauncher;SessionLauncher
    R? ssmirrdr;ssmirrdr
    R? WinDefend;Windows Defender
    R? WinRM;Windows Remote Management (WS-Management)
    R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
    S? AVGIDSDriver;AVGIDSDriver
    S? AVGIDSFilter;AVGIDSFilter
    S? AVGIDSHX;AVGIDSHX
    S? AVGIDSShim;AVGIDSShim
    S? Avgldx86;AVG AVI Loader Driver
    S? Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield
    S? Avgrkx86;AVG Anti-Rootkit Driver
    S? Avgtdix;AVG TDI Driver
    S? avgtp;avgtp
    S? avgwd;AVG WatchDog
    S? PfFilter;PfFilter
    S? RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service
    S? TeamViewer7;TeamViewer 7
    S? vToolbarUpdater14.2.0;vToolbarUpdater14.2.0
    .
    =============== Created Last 30 ================
    .
    2013-04-17 17:08:53 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
    2013-04-17 17:08:53 21504 ----a-w- c:\windows\system32\hidserv.dll
    2013-04-17 17:08:50 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
    2013-04-17 17:08:50 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
    2013-04-17 17:08:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
    2013-04-17 17:08:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
    2013-04-17 03:00:54 -------- d-sh--w- C:\$RECYCLE.BIN
    2013-04-16 19:05:24 -------- d-----w- c:\documents and settings\user\application data\AVG8
    2013-04-16 19:00:07 577048 -c--a-w- c:\windows\system32\dllcache\wuapi.dll
    2013-04-16 13:38:42 90112 -c--a-w- c:\windows\system32\dllcache\mycomput.dll
    2013-04-16 13:38:42 90112 ----a-w- c:\windows\system32\mycomput.dll
    2013-04-15 22:31:08 -------- d-----w- c:\documents and settings\all users\application data\MSScanAppDataDir
    2013-03-29 13:17:09 -------- d-----w- C:\$NtUninstallXPSEP$
    2013-03-29 13:16:58 14048 ------w- c:\windows\system32\spmsg2.dll
    2013-03-28 14:23:23 -------- d-----w- c:\documents and settings\user\application data\RealNetworks
    2013-03-28 14:14:35 -------- d-----w- c:\program files\RealNetworks
    2013-03-28 14:14:31 -------- d-----w- c:\documents and settings\all users\application data\RealNetworks
    2013-03-28 14:14:15 -------- d-----w- c:\program files\common files\xing shared
    2013-03-23 14:42:00 -------- d-----w- C:\QuickBooksAutoDataRecovery
    2013-03-23 14:36:50 -------- d-----w- C:\Restored_Le Cartier Maintenance_Files
    2013-03-21 18:42:41 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys
    2013-03-21 18:42:40 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
    .
    ==================== Find3M ====================
    .
    2013-03-28 14:13:44 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2013-03-13 16:16:22 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-03-13 16:16:22 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-03-08 08:36:22 293376 ----a-w- c:\windows\system32\winsrv.dll
    2013-03-07 01:32:25 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
    2013-03-07 00:50:30 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2013-03-02 02:06:31 916480 ----a-w- c:\windows\system32\wininet.dll
    2013-03-02 02:06:30 43520 ------w- c:\windows\system32\licmgr10.dll
    2013-03-02 02:06:30 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2013-03-02 01:25:02 1867264 ------w- c:\windows\system32\win32k.sys
    2013-03-02 01:08:47 385024 ------w- c:\windows\system32\html.iec
    2013-02-27 07:56:51 2067456 ------w- c:\windows\system32\mstscax.dll
    2013-02-19 14:39:25 33112 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2013-02-12 00:32:23 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
    2013-02-12 00:32:23 12928 ------w- c:\windows\system32\drivers\usb8023.sys
    2013-01-26 03:55:44 552448 ------w- c:\windows\system32\oleaut32.dll
    .
    ============= FINISH: 16:45:19.34 ===============
     
  2. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =================================

    [​IMG] I still need Attach.txt part of DDS.
     
  3. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    Here is the Attch.txt from DDS: ==== Installed Programs ======================
    .
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader 8.1.2
    Adobe Reader 8.1.2 Security Update 1 (KB403742)
    APC PowerChute Personal Edition
    AVG 2012
    Belkin Wireless USB Adapter Setup
    Brother 1470N
    Brownie
    CCleaner
    Color LaserJet 2600n
    Compatibility Pack for the 2007 Office system
    Dassault Systemes Software Prerequisites x86
    DirectXInstallService
    Dropbox
    EMC 10 Content
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2756822)
    Hotfix for Windows XP (KB2779562)
    Hotfix for Windows XP (KB971276-v3)
    Intel Audio Studio 2.0
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Management Engine Interface
    Intel(R) PRO Network Connections 11.2.0.69
    InterVideo WinDVD
    Java(TM) 6 Update 20
    Kofax VirtualReScan 4.10
    Kofax VRS Update for Visioneer OneTouch OEM
    LightScribe 1.6.45.1
    Malwarebytes Anti-Malware version 1.70.0.1100
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2698023)
    Microsoft .NET Framework 1.1 Security Update (KB2742597)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Default Manager
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2003 Primary Interop Assemblies
    Microsoft Office File Validation Add-In
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual Studio 2005 Tools for Office Runtime
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    Nero 7 Essentials
    neroxml
    OGA Notifier 2.0.0048.0
    OneTouch 4.0
    OneTouch 4.0 ScanSoft OmniPage OCR Module
    OneTouch 4.6
    PowerDVD
    Protected Folder
    QuickBooks
    QuickBooks Pro 2012
    Quicken 2005
    RealDownloader
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealNetworks - Microsoft Visual C++ 2010 Runtime
    RealPlayer
    REALTEK GbE & FE Ethernet PCI-E NIC Driver
    RealUpgrade 1.1
    Roxio Activation Module
    ScanSoft PaperPort 11
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2530548)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2559049)
    Security Update for Windows Internet Explorer 8 (KB2586448)
    Security Update for Windows Internet Explorer 8 (KB2618444)
    Security Update for Windows Internet Explorer 8 (KB2647516)
    Security Update for Windows Internet Explorer 8 (KB2675157)
    Security Update for Windows Internet Explorer 8 (KB2699988)
    Security Update for Windows Internet Explorer 8 (KB2722913)
    Security Update for Windows Internet Explorer 8 (KB2744842)
    Security Update for Windows Internet Explorer 8 (KB2761465)
    Security Update for Windows Internet Explorer 8 (KB2792100)
    Security Update for Windows Internet Explorer 8 (KB2797052)
    Security Update for Windows Internet Explorer 8 (KB2799329)
    Security Update for Windows Internet Explorer 8 (KB2809289)
    Security Update for Windows Internet Explorer 8 (KB2817183)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2655992)
    Security Update for Windows XP (KB2659262)
    Security Update for Windows XP (KB2676562)
    Security Update for Windows XP (KB2685939)
    Security Update for Windows XP (KB2686509)
    Security Update for Windows XP (KB2691442)
    Security Update for Windows XP (KB2695962)
    Security Update for Windows XP (KB2698365)
    Security Update for Windows XP (KB2705219-v2)
    Security Update for Windows XP (KB2705219)
    Security Update for Windows XP (KB2707511)
    Security Update for Windows XP (KB2709162)
    Security Update for Windows XP (KB2712808)
    Security Update for Windows XP (KB2718523)
    Security Update for Windows XP (KB2719985)
    Security Update for Windows XP (KB2723135)
    Security Update for Windows XP (KB2724197)
    Security Update for Windows XP (KB2727528)
    Security Update for Windows XP (KB2731847)
    Security Update for Windows XP (KB2753842-v2)
    Security Update for Windows XP (KB2753842)
    Security Update for Windows XP (KB2757638)
    Security Update for Windows XP (KB2758857)
    Security Update for Windows XP (KB2761226)
    Security Update for Windows XP (KB2770660)
    Security Update for Windows XP (KB2778344)
    Security Update for Windows XP (KB2779030)
    Security Update for Windows XP (KB2780091)
    Security Update for Windows XP (KB2799494)
     
  4. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    You cut off the lower part.
     
  5. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    Sorry:
    .
    ==== Installed Programs ======================
    .
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader 8.1.2
    Adobe Reader 8.1.2 Security Update 1 (KB403742)
    APC PowerChute Personal Edition
    AVG 2012
    Belkin Wireless USB Adapter Setup
    Brother 1470N
    Brownie
    CCleaner
    Color LaserJet 2600n
    Compatibility Pack for the 2007 Office system
    Dassault Systemes Software Prerequisites x86
    DirectXInstallService
    Dropbox
    EMC 10 Content
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2756822)
    Hotfix for Windows XP (KB2779562)
    Hotfix for Windows XP (KB971276-v3)
    Intel Audio Studio 2.0
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Management Engine Interface
    Intel(R) PRO Network Connections 11.2.0.69
    InterVideo WinDVD
    Java(TM) 6 Update 20
    Kofax VirtualReScan 4.10
    Kofax VRS Update for Visioneer OneTouch OEM
    LightScribe 1.6.45.1
    Malwarebytes Anti-Malware version 1.70.0.1100
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2698023)
    Microsoft .NET Framework 1.1 Security Update (KB2742597)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Default Manager
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2003 Primary Interop Assemblies
    Microsoft Office File Validation Add-In
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual Studio 2005 Tools for Office Runtime
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    Nero 7 Essentials
    neroxml
    OGA Notifier 2.0.0048.0
    OneTouch 4.0
    OneTouch 4.0 ScanSoft OmniPage OCR Module
    OneTouch 4.6
    PowerDVD
    Protected Folder
    QuickBooks
    QuickBooks Pro 2012
    Quicken 2005
    RealDownloader
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealNetworks - Microsoft Visual C++ 2010 Runtime
    RealPlayer
    REALTEK GbE & FE Ethernet PCI-E NIC Driver
    RealUpgrade 1.1
    Roxio Activation Module
    ScanSoft PaperPort 11
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2530548)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2559049)
    Security Update for Windows Internet Explorer 8 (KB2586448)
    Security Update for Windows Internet Explorer 8 (KB2618444)
    Security Update for Windows Internet Explorer 8 (KB2647516)
    Security Update for Windows Internet Explorer 8 (KB2675157)
    Security Update for Windows Internet Explorer 8 (KB2699988)
    Security Update for Windows Internet Explorer 8 (KB2722913)
    Security Update for Windows Internet Explorer 8 (KB2744842)
    Security Update for Windows Internet Explorer 8 (KB2761465)
    Security Update for Windows Internet Explorer 8 (KB2792100)
    Security Update for Windows Internet Explorer 8 (KB2797052)
    Security Update for Windows Internet Explorer 8 (KB2799329)
    Security Update for Windows Internet Explorer 8 (KB2809289)
    Security Update for Windows Internet Explorer 8 (KB2817183)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2655992)
    Security Update for Windows XP (KB2659262)
    Security Update for Windows XP (KB2676562)
    Security Update for Windows XP (KB2685939)
    Security Update for Windows XP (KB2686509)
    Security Update for Windows XP (KB2691442)
    Security Update for Windows XP (KB2695962)
    Security Update for Windows XP (KB2698365)
    Security Update for Windows XP (KB2705219-v2)
    Security Update for Windows XP (KB2705219)
    Security Update for Windows XP (KB2707511)
    Security Update for Windows XP (KB2709162)
    Security Update for Windows XP (KB2712808)
    Security Update for Windows XP (KB2718523)
    Security Update for Windows XP (KB2719985)
    Security Update for Windows XP (KB2723135)
    Security Update for Windows XP (KB2724197)
    Security Update for Windows XP (KB2727528)
    Security Update for Windows XP (KB2731847)
    Security Update for Windows XP (KB2753842-v2)
    Security Update for Windows XP (KB2753842)
    Security Update for Windows XP (KB2757638)
    Security Update for Windows XP (KB2758857)
    Security Update for Windows XP (KB2761226)
    Security Update for Windows XP (KB2770660)
    Security Update for Windows XP (KB2778344)
    Security Update for Windows XP (KB2779030)
    Security Update for Windows XP (KB2780091)
    Security Update for Windows XP (KB2799494)
    Security Update for Windows XP (KB2802968)
    Security Update for Windows XP (KB2807986)
    Security Update for Windows XP (KB2808735)
    Security Update for Windows XP (KB2813170)
    Security Update for Windows XP (KB2813345)
    Security Update for Windows XP (KB2820917)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    SigmaTel Audio
    SmartSound Quicktracks Plugin
    SupportSoft Assisted Service
    System Requirements Lab for Intel
    TeamViewer 7
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB2447568)
    Update for Windows Internet Explorer 8 (KB2598845)
    Update for Windows Internet Explorer 8 (KB2632503)
    Update for Windows Internet Explorer 8 (KB973874)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2661254-v2)
    Update for Windows XP (KB2718704)
    Update for Windows XP (KB2736233)
    Update for Windows XP (KB2749655)
    Virtual Earth - 3DVIA (Beta)
    Virtual Earth 3D (Beta)
    Visual Studio 2005 Tools for Office Second Edition Runtime
    WebEx
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    Windows Defender
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Management Framework Core
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    XPS Essentials Pack
    XPS Essentials Pack 1.0
    Yontoo Layers Runtime 1.10.01
    .
    ==== End Of File ===========================
     
  6. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    :)

    [​IMG] Download RogueKiller on the desktop
    • Close all the running programs
    • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
     
  7. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    Ok I ran RK and got to txt files which I will post at the end. I ran Malwarebytes antirootkit twice and twice it told me me that it found nothing yet the computer is till not running well.:
    RK:
    RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Website : http://tigzy.geekstogo.com/roguekiller.php
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Started in : Normal mode
    User : User [Admin rights]
    Mode : Scan -- Date : 04/17/2013 19:41:08
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 1 ¤¤¤
    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> C:\windows\system32\drivers\etc\hosts



    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: +++++
    --- User ---
    [MBR] a10749d88d638a4493543c1ce59ecc0c
    [BSP] 624ea2189a63380f10575b0b9e061b2c : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238464 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    +++++ PhysicalDrive3: +++++
    --- User ---
    [MBR] 8a4a3f84a9eda68451f8bdccda84c484
    [BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
    Partition table:
    0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 8192 | Size: 7576 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    Finished : << RKreport[1]_S_04172013_02d1941.txt >>
    RKreport[1]_S_04172013_02d1941.txt


    RK 2:
    RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Website : http://tigzy.geekstogo.com/roguekiller.php
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Started in : Normal mode
    User : User [Admin rights]
    Mode : Remove -- Date : 04/17/2013 19:50:08
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 1 ¤¤¤
    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> C:\windows\system32\drivers\etc\hosts



    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: +++++
    --- User ---
    [MBR] a10749d88d638a4493543c1ce59ecc0c
    [BSP] 624ea2189a63380f10575b0b9e061b2c : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238464 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    +++++ PhysicalDrive3: +++++
    --- User ---
    [MBR] 8a4a3f84a9eda68451f8bdccda84c484
    [BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
    Partition table:
    0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 8192 | Size: 7576 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    Finished : << RKreport[2]_D_04172013_02d1950.txt >>
    RKreport[1]_S_04172013_02d1941.txt ; RKreport[2]_D_04172013_02d1950.txt
     
  8. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    And MWB logs:

    Malwarebytes Anti-Rootkit BETA 1.05.0.1001


    v2013.03.22.01

    Windows XP Service Pack 3 x86 FAT32
    8.0.6001.18702
    User :: USER-7B0798342F

    4/17/2013 9:49:54 PM
    mbar-log-2013-04-17 (21-49-54).txt




    27791
    12 , 45

    0


    0


    0


    0


    0


    0


    0
     
  9. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    I am uploading the MWB system log
     

    Attached Files:

  10. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Please observe forum rules.
    All logs have to be pasted not attached.
     
  11. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    I was going to but it is 7485 words long, and it did not let me paste it. What should I do?
     
  12. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    As our rules say, split it between couple of replies.
     
  13. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: FAT32
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 642285568

    ------------ Kernel report ------------
    04/17/2013 19:51:30
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    ohci1394.sys
    \windows\system32\DRIVERS\1394BUS.SYS
    compbatt.sys
    \windows\system32\DRIVERS\BATTC.SYS
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    avgrkx86.sys
    avgidshx.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\HECI.sys
    \SystemRoot\system32\DRIVERS\e1e5132.sys
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\Rtenicxp.sys
    \SystemRoot\system32\DRIVERS\nic1394.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\serscan.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\system32\DRIVERS\avgmfx86.sys
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\windows\system32\drivers\avgtpx86.sys
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\avgtdix.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\arp1394.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\System32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\System32\Drivers\Fips.SYS
    \SystemRoot\system32\DRIVERS\avgldx86.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    \SystemRoot\System32\Drivers\Fastfat.SYS
    \SystemRoot\System32\Drivers\Cdfs.SYS
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\watchdog.sys
    \SystemRoot\System32\drivers\dxg.sys
    \SystemRoot\System32\drivers\dxgthk.sys
    \SystemRoot\System32\igxpgd32.dll
    \SystemRoot\System32\igxprd32.dll
    \SystemRoot\System32\igxpdv32.DLL
    \SystemRoot\System32\igxpdx32.DLL
    \SystemRoot\System32\ATMFD.DLL
    \??\C:\Program Files\IObit\Protected Folder\pffilter.sys
    \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    \SystemRoot\system32\DRIVERS\nwlnknb.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\nwrdr.sys
    \SystemRoot\System32\drivers\BrPar.sys
    \SystemRoot\System32\Drivers\ParVdm.SYS
    \SystemRoot\system32\DRIVERS\avgidsshimx.sys
    \SystemRoot\system32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    \SystemRoot\system32\DRIVERS\avgidsfilterx.sys
    \SystemRoot\system32\DRIVERS\avgidsdriverx.sys
    \SystemRoot\System32\Drivers\HTTP.sys
    \??\C:\DOCUME~1\User\LOCALS~1\Temp\mbr.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\C:\windows\system32\drivers\mbamswissarmy.sys
    \WINDOWS\system32\ntdll.dll
    ----------- End -----------
    <<<1>>>
    Upper Device Name: \Device\Harddisk4\DR5
    Upper Device Object: 0xffffffff85f61ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000088\
    Lower Device Object: 0xffffffff85f3a388
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    Initialization returned 0x0
    Load Function returned 0x0
    <<<1>>>
    Upper Device Name: \Device\Harddisk3\DR4
    Upper Device Object: 0xffffffff85f946d0
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000087\
    Lower Device Object: 0xffffffff85f3a030
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk2\DR3
    Upper Device Object: 0xffffffff85f63318
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000086\
    Lower Device Object: 0xffffffff8602a4b8
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk1\DR2
    Upper Device Object: 0xffffffff85f5cab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000085\
    Lower Device Object: 0xffffffff85f7aea0
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xffffffff86b8d3b8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-10\
    Lower Device Object: 0xffffffff86b42b00
    Lower Device Driver Name: \Driver\atapi\
    Driver name found: atapi
    Initialization returned 0x0
    Load Function returned 0x0
    =======================================


    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 626933760

    =======================================
    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: FAT32
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 650878976

    ------------ Kernel report ------------
    04/17/2013 20:43:44
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    ohci1394.sys
    \windows\system32\DRIVERS\1394BUS.SYS
    compbatt.sys
    \windows\system32\DRIVERS\BATTC.SYS
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    avgrkx86.sys
    avgidshx.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\HECI.sys
    \SystemRoot\system32\DRIVERS\e1e5132.sys
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\Rtenicxp.sys
    \SystemRoot\system32\DRIVERS\nic1394.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\serscan.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\system32\DRIVERS\avgmfx86.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\windows\system32\drivers\avgtpx86.sys
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\avgtdix.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\arp1394.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\System32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\System32\Drivers\Fips.SYS
    \SystemRoot\system32\DRIVERS\avgldx86.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    \SystemRoot\System32\Drivers\Fastfat.SYS
    \SystemRoot\System32\Drivers\Cdfs.SYS
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\watchdog.sys
    \SystemRoot\System32\drivers\dxg.sys
    \SystemRoot\System32\drivers\dxgthk.sys
    \SystemRoot\System32\igxpgd32.dll
    \SystemRoot\System32\igxprd32.dll
    \SystemRoot\System32\igxpdv32.DLL
    \SystemRoot\System32\igxpdx32.DLL
    \SystemRoot\System32\ATMFD.DLL
    \??\C:\Program Files\IObit\Protected Folder\pffilter.sys
    \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    \SystemRoot\system32\DRIVERS\nwlnknb.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\nwrdr.sys
    \SystemRoot\System32\drivers\BrPar.sys
    \SystemRoot\System32\Drivers\ParVdm.SYS
    \SystemRoot\system32\DRIVERS\avgidsshimx.sys
    \SystemRoot\system32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    \SystemRoot\system32\DRIVERS\avgidsfilterx.sys
    \SystemRoot\system32\DRIVERS\avgidsdriverx.sys
    \SystemRoot\System32\Drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\C:\windows\system32\drivers\mbamswissarmy.sys
    \WINDOWS\system32\ntdll.dll
    ----------- End -----------
    <<<1>>>
    Upper Device Name: \Device\Harddisk4\DR5
    Upper Device Object: 0xffffffff864f3ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000089\
    Lower Device Object: 0xffffffff85f54318
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    Initialization returned 0x0
    Load Function returned 0x0
    <<<1>>>
    Upper Device Name: \Device\Harddisk3\DR4
    Upper Device Object: 0xffffffff85f58470
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000088\
    Lower Device Object: 0xffffffff85f73308
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk2\DR3
    Upper Device Object: 0xffffffff85f53ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000087\
    Lower Device Object: 0xffffffff86498030
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk1\DR2
    Upper Device Object: 0xffffffff864e4030
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000086\
    Lower Device Object: 0xffffffff85f50330
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xffffffff86b35ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-10\
    Lower Device Object: 0xffffffff86b71b00
    Lower Device Driver Name: \Driver\atapi\
    Driver name found: atapi
    Initialization returned 0x0
    Load Function returned 0x0
    Initializing...
    Done!
    <<<2>>>
    Device number: 0, partition: 1
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xffffffff86b35ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff86bc8e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff86b35ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff86b3b968, DeviceName: \Device\00000073\, DriverName: \Driver\ACPI\
    DevicePointer: 0xffffffff86b71b00, DeviceName: \Device\Ide\IdeDeviceP2T0L0-10\, DriverName: \Driver\atapi\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0xffffffffe15e67f0, 0xffffffff86b35ab8, 0xffffffff85cd3410
    Lower DeviceData: 0xffffffffe1ce2cd0, 0xffffffff86b71b00, 0xffffffff85ccfc98
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning directory: C:\windows\system32\drivers...
    <<<2>>>
    Device number: 0, partition: 1
    <<<3>>>
    Volume: C:
     
  14. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Done!
    Drive 0
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: C7E0C7E0

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63 Numsec = 488375937
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 250059350016 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-62-488377168-488397168)...
    Physical Sector Size: 0
    Drive: 1, DevicePointer: 0xffffffff864e4030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff864dce08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff864e4030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff85f50330, DeviceName: \Device\00000086\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Physical Sector Size: 0
    Drive: 2, DevicePointer: 0xffffffff85f53ab8, DeviceName: \Device\Harddisk2\DR3\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff864d1bd0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff85f53ab8, DeviceName: \Device\Harddisk2\DR3\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff86498030, DeviceName: \Device\00000087\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Physical Sector Size: 512
    Drive: 3, DevicePointer: 0xffffffff85f58470, DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff86500bd0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff85f58470, DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff85f73308, DeviceName: \Device\00000088\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
    Upper DeviceData: 0xffffffffe194f1e0, 0xffffffff85f58470, 0xffffffff85c9d838
    Lower DeviceData: 0xffffffffe1c184c8, 0xffffffff85f73308, 0xffffffff85ce8ce0
    Drive 3
    Scanning MBR on drive 3...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 0

    Partition information:

    Partition 0 type is Other (0xb)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 8192 Numsec = 15515648

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 7948206080 bytes
    Sector size: 512 bytes

    Physical Sector Size: 0
    Drive: 4, DevicePointer: 0xffffffff864f3ab8, DeviceName: \Device\Harddisk4\DR5\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff864f1898, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff864f3ab8, DeviceName: \Device\Harddisk4\DR5\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff85f54318, DeviceName: \Device\00000089\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Done!
    Performing system, memory and registry scan...
    Read File: File "c:\Documents and Settings\All Users\Application Data\Microsoft\Machine Debug Manager\mdm.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\AVG2012\Chjw\4024cc1e24cc1934.dat" is sparse (flags = 32768)
    Read File: File "c:\Documents and Settings\All Users\Application Data\AVG2012\log\avgual.2013-04-15.log" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Cfg\admin.cfg.install_backup" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Dumps\IEToolbar.dll_129114091864531250.exh" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Dumps\IEToolbar.dll_129114092811250000.exh" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Dumps\IEToolbar.dll_129114170002343750.exh" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\corelog.cfg.old-3447e15d" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\lnglog.cfg.old-a2156602" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\rslog.cfg.old-f747eb4c" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\wdlog.cfg.old-ba97849" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\wdsvclog.cfg.old-80ed8154" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Intuit\QuickBooks\QBGLOBALAPPCONFIG.INI" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Intuit\QuickBooks 2009\OLBMTRC.INI" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\Atds.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\colortransformhp4345-bh8000.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\colortransformricoh-bh8000.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\colortransform_lexmark_x646e_d9of9_bkg-4_c0-bh8000.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\kpl.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\proflist.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\VRSUpdateManager\VRSUpdateManager.xml" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f1.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f2.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f5.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\ScanSoft\Swizard\wizconf.xml" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\QBDataServiceUser19\Application Data\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\QBDataServiceUser19\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\QBDataServiceUser19\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Ahead\NeroVision\Direct3D.log" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Kofax\VRSUI\VRSUI.xml" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Microsoft\Media Player\006DB1AA.wpl" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Microsoft\Office\Excel12.pip" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Microsoft\Office\VB11.pip" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Microsoft\Protect\CREDHIST" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\OneTouch 4.0\O4F1F5CA4-DAC2-41C0-A235-CE4F0D734E86T.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Application Data\Roxio\MediaManager10\CollectionList.xml" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt" is compressed (flags = 1)
    Read File: File "c:\Program Files\Mozilla Firefox\dxva_sig.txt" is compressed (flags = 1)
    Read File: File "c:\Program Files\Outlook Express\msoe.txt" is compressed (flags = 1)
    Read File: File "c:\Program Files\Windows Media Player\dxva_sig.txt" is compressed (flags = 1)
    Read File: File "c:\Program Files\Windows Media Player\npdrmv2.zip" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\dsound.vxd" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\l_except.nls" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\perfwci.h" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\cmos.ram" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\pscript.sep" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\pcl.sep" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\perfci.h" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\perffilt.h" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\zhp2600.log" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\View Channels.scf" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\drivers\etc\networks" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\oobe\migip.dun" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\oobe\migrate.isp" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\oobe\msobe.isp" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\oobe\obeip.dun" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\oobe\oobeinfo.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\oobe\reg.isp" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\wbem\wmiclivalueformat.xsl" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\explorer.scf" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\ODBC.INI" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\UNNeroBackItUp.cfg" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\UNNeroMediaHome.cfg" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\UNNeroShowTime.cfg" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\UNNeroVision.cfg" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\UNRecode.cfg" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\vb.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\vbaddin.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\BRDIAG.INI" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\brmx2001.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Brownie.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\BRPP2KA.INI" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\BRVIDEO.INI" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\brwmark.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\XWEBVI~1.INI" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\QBChanUtil_Trigger.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Quicken.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\opt_1470.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.PowerPoint\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\dao\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\IEProtocol\2.0.0.129__82cc56431f1a971d\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Access\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Excel\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Graph\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.InfoPath\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.InfoPath.Xml\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
     
  15. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Outlook\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.OutlookViewCtl\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Owc11\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\office\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\QBWCInterfaces\2.0.0.129__82cc56431f1a971d\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Publisher\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.SmartTag\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Word\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Downloaded Program Files\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Downloaded Program Files\gp.inf" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Downloaded Program Files\muweb.inf" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\ciadmin.htm" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\conf.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\connect.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\ratings.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\mshearts.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\msnauth.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\nocontnt.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\update.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\windows.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Help\winhlp32.cnt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet.mof.uninstall" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ieexec.exe.config" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\jsc.exe.config" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.htm" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\Web\bullet.gif" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\Default User\Local Settings\History\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\Default User\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\LocalService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\QBDataServiceUser19\Local Settings\History\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\QBDataServiceUser19\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\History\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Local Settings\Application Data\Ahead\Nero Home\SII.db" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Feeds Cache\desktop.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Desktop\Unused Desktop Shortcuts\Best Card for Quicken Users - low APR, optional rewards program.url" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Desktop\Unused Desktop Shortcuts\Shortcut to My Documents.lnk" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\User\Desktop\Unused Desktop Shortcuts\Windows Live Hotmail.url" is compressed (flags = 1)
    Done!
    Scan finished
    =======================================


    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: FAT32
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 662753280

    ------------ Kernel report ------------
    04/17/2013 21:01:38
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    ohci1394.sys
    \windows\system32\DRIVERS\1394BUS.SYS
    compbatt.sys
    \windows\system32\DRIVERS\BATTC.SYS
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    avgrkx86.sys
    avgidshx.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\HECI.sys
    \SystemRoot\system32\DRIVERS\e1e5132.sys
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
     
  16. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    \SystemRoot\system32\DRIVERS\Rtenicxp.sys
    \SystemRoot\system32\DRIVERS\nic1394.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\serscan.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\system32\DRIVERS\avgmfx86.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\windows\system32\drivers\avgtpx86.sys
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\avgtdix.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\arp1394.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\System32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\System32\Drivers\Fips.SYS
    \SystemRoot\system32\DRIVERS\avgldx86.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    \SystemRoot\System32\Drivers\Fastfat.SYS
    \SystemRoot\System32\Drivers\Cdfs.SYS
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\watchdog.sys
    \SystemRoot\System32\drivers\dxg.sys
    \SystemRoot\System32\drivers\dxgthk.sys
    \SystemRoot\System32\igxpgd32.dll
    \SystemRoot\System32\igxprd32.dll
    \SystemRoot\System32\igxpdv32.DLL
    \SystemRoot\System32\igxpdx32.DLL
    \SystemRoot\System32\ATMFD.DLL
    \??\C:\Program Files\IObit\Protected Folder\pffilter.sys
    \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    \SystemRoot\system32\DRIVERS\nwlnknb.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\nwrdr.sys
    \SystemRoot\System32\drivers\BrPar.sys
    \SystemRoot\System32\Drivers\ParVdm.SYS
    \SystemRoot\system32\DRIVERS\avgidsshimx.sys
    \SystemRoot\system32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    \SystemRoot\system32\DRIVERS\avgidsfilterx.sys
    \SystemRoot\system32\DRIVERS\avgidsdriverx.sys
    \SystemRoot\System32\Drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\C:\windows\system32\drivers\mbamswissarmy.sys
    \WINDOWS\system32\ntdll.dll
    ----------- End -----------
    <<<1>>>
    Upper Device Name: \Device\Harddisk4\DR5
    Upper Device Object: 0xffffffff864f3ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000089\
    Lower Device Object: 0xffffffff85f54318
    Lower Device Driver Name: \Driver\usbstor\
    Device already Exists: 0xffffffff85e16708
    <<<1>>>
    Upper Device Name: \Device\Harddisk3\DR4
    Upper Device Object: 0xffffffff85f58470
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000088\
    Lower Device Object: 0xffffffff85f73308
    Lower Device Driver Name: \Driver\usbstor\
    Device already Exists: 0xffffffff85ce8ce0
    <<<1>>>
    Upper Device Name: \Device\Harddisk2\DR3
    Upper Device Object: 0xffffffff85f53ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000087\
    Lower Device Object: 0xffffffff86498030
    Lower Device Driver Name: \Driver\usbstor\
    Device already Exists: 0xffffffff85e45d28
    <<<1>>>
    Upper Device Name: \Device\Harddisk1\DR2
    Upper Device Object: 0xffffffff864e4030
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000086\
    Lower Device Object: 0xffffffff85f50330
    Lower Device Driver Name: \Driver\usbstor\
    Device already Exists: 0xffffffff86a81790
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xffffffff86b35ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-10\
    Lower Device Object: 0xffffffff86b71b00
    Lower Device Driver Name: \Driver\atapi\
    Device already Exists: 0xffffffff85ccfc98
    =======================================


    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 586194944

    =======================================
    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: FAT32
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 588189696

    ------------ Kernel report ------------
    04/17/2013 21:05:45
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    ohci1394.sys
    \windows\system32\DRIVERS\1394BUS.SYS
    compbatt.sys
    \windows\system32\DRIVERS\BATTC.SYS
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    avgrkx86.sys
    avgidshx.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\HECI.sys
    \SystemRoot\system32\DRIVERS\e1e5132.sys
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\Rtenicxp.sys
    \SystemRoot\system32\DRIVERS\nic1394.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\serscan.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\system32\DRIVERS\avgmfx86.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\windows\system32\drivers\avgtpx86.sys
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\system32\DRIVERS\avgtdix.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\arp1394.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\System32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\System32\Drivers\Fips.SYS
    \SystemRoot\system32\DRIVERS\avgldx86.sys
     
  17. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    [​IMG] Create new restore point before proceeding with the next step....
    How to:
    - Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
    - Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
    - Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
    - XP: http://support.microsoft.com/kb/948247

    [​IMG] Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  18. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    \SystemRoot\System32\Drivers\Fastfat.SYS
    \SystemRoot\System32\Drivers\Cdfs.SYS
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\watchdog.sys
    \SystemRoot\System32\drivers\dxg.sys
    \SystemRoot\System32\drivers\dxgthk.sys
    \SystemRoot\System32\igxpgd32.dll
    \SystemRoot\System32\igxprd32.dll
    \SystemRoot\System32\igxpdv32.DLL
    \SystemRoot\System32\igxpdx32.DLL
    \SystemRoot\System32\ATMFD.DLL
    \??\C:\Program Files\IObit\Protected Folder\pffilter.sys
    \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    \SystemRoot\system32\DRIVERS\nwlnknb.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\nwrdr.sys
    \SystemRoot\System32\drivers\BrPar.sys
    \SystemRoot\System32\Drivers\ParVdm.SYS
    \SystemRoot\system32\DRIVERS\avgidsshimx.sys
    \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    \SystemRoot\system32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\avgidsfilterx.sys
    \SystemRoot\system32\DRIVERS\avgidsdriverx.sys
    \SystemRoot\System32\Drivers\HTTP.sys
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\C:\windows\system32\drivers\mbamswissarmy.sys
    \WINDOWS\system32\ntdll.dll
    ----------- End -----------
    <<<1>>>
    Upper Device Name: \Device\Harddisk4\DR5
    Upper Device Object: 0xffffffff85f4d718
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000089\
    Lower Device Object: 0xffffffff85f4bc90
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    Initialization returned 0x0
    Load Function returned 0x0
    <<<1>>>
    Upper Device Name: \Device\Harddisk3\DR4
    Upper Device Object: 0xffffffff86013ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000088\
    Lower Device Object: 0xffffffff85f7cd78
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk2\DR3
    Upper Device Object: 0xffffffff85f33ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000087\
    Lower Device Object: 0xffffffff85f7d1a8
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk1\DR2
    Upper Device Object: 0xffffffff85f50518
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000086\
    Lower Device Object: 0xffffffff8649d030
    Lower Device Driver Name: \Driver\usbstor\
    Driver name found: usbstor
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xffffffff86ba3428
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-10\
    Lower Device Object: 0xffffffff86b78b00
    Lower Device Driver Name: \Driver\atapi\
    Driver name found: atapi
    Initialization returned 0x0
    Load Function returned 0x0
    Initializing...
    Done!
    <<<2>>>
    Device number: 0, partition: 1
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xffffffff86ba3428, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff86b4d718, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff86ba3428, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff86af99e8, DeviceName: \Device\00000073\, DriverName: \Driver\ACPI\
    DevicePointer: 0xffffffff86b78b00, DeviceName: \Device\Ide\IdeDeviceP2T0L0-10\, DriverName: \Driver\atapi\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0xffffffffe312a100, 0xffffffff86ba3428, 0xffffffff85cd6040
    Lower DeviceData: 0xffffffffe2fe32c0, 0xffffffff86b78b00, 0xffffffff85e55ce0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning directory: C:\windows\system32\drivers...
    <<<2>>>
    Device number: 0, partition: 1
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Done!
    Drive 0
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: C7E0C7E0

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63 Numsec = 488375937
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 250059350016 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-62-488377168-488397168)...
    Physical Sector Size: 0
    Drive: 1, DevicePointer: 0xffffffff85f50518, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff85f4a020, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff85f50518, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff8649d030, DeviceName: \Device\00000086\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Physical Sector Size: 0
    Drive: 2, DevicePointer: 0xffffffff85f33ab8, DeviceName: \Device\Harddisk2\DR3\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff85f33890, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff85f33ab8, DeviceName: \Device\Harddisk2\DR3\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff85f7d1a8, DeviceName: \Device\00000087\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Physical Sector Size: 512
    Drive: 3, DevicePointer: 0xffffffff86013ab8, DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff86013890, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff86013ab8, DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff85f7cd78, DeviceName: \Device\00000088\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk3\DR4\, DriverName: \Driver\Disk\
    Upper DeviceData: 0xffffffffe3309b78, 0xffffffff86013ab8, 0xffffffff85ea25b0
    Lower DeviceData: 0xffffffffe3067248, 0xffffffff85f7cd78, 0xffffffff85eb1f18
    Drive 3
    Scanning MBR on drive 3...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 0

    Partition information:

    Partition 0 type is Other (0xb)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 8192 Numsec = 15515648

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 7948206080 bytes
    Sector size: 512 bytes

    Physical Sector Size: 0
    Drive: 4, DevicePointer: 0xffffffff85f4d718, DeviceName: \Device\Harddisk4\DR5\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff85f4a268, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff85f4d718, DeviceName: \Device\Harddisk4\DR5\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff85f4bc90, DeviceName: \Device\00000089\, DriverName: \Driver\usbstor\
    ------------ End ----------
    Done!
    Performing system, memory and registry scan...
    Read File: File "c:\Documents and Settings\All Users\Application Data\Microsoft\Machine Debug Manager\mdm.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\AVG2012\Chjw\4024cc1e24cc1934.dat" is sparse (flags = 32768)
    Read File: File "c:\Documents and Settings\All Users\Application Data\AVG2012\log\avgual.2013-04-15.log" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Cfg\admin.cfg.install_backup" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Dumps\IEToolbar.dll_129114091864531250.exh" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Dumps\IEToolbar.dll_129114092811250000.exh" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Dumps\IEToolbar.dll_129114170002343750.exh" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\corelog.cfg.old-3447e15d" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\lnglog.cfg.old-a2156602" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\rslog.cfg.old-f747eb4c" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\wdlog.cfg.old-ba97849" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\avg9\Log\wdsvclog.cfg.old-80ed8154" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Intuit\QuickBooks\QBGLOBALAPPCONFIG.INI" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Intuit\QuickBooks 2009\OLBMTRC.INI" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\Atds.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\colortransformhp4345-bh8000.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\colortransformricoh-bh8000.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\colortransform_lexmark_x646e_d9of9_bkg-4_c0-bh8000.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\kpl.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\Vrs\proflist.ini" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Kofax\VRSUpdateManager\VRSUpdateManager.xml" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f1.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f2.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\Nero\Nero Container\f5.bin" is compressed (flags = 1)
    Read File: File "c:\Documents and Settings\All Users\Application Data\ScanSoft\Swizard\wizconf.xml" is compressed (flags = 1)
    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 626003968

    =======================================
    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    Java version: 1.6.0_20

    File system is: FAT32
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.197000 GHz
    Memory total: 1054552064, free: 556208128

    ------------ Kernel report ------------
    04/17/2013 21:36:52
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    ohci1394.sys
    \windows\system32\DRIVERS\1394BUS.SYS
    compbatt.sys
    \windows\system32\DRIVERS\BATTC.SYS
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    avgrkx86.sys
    avgidshx.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\HECI.sys
    \SystemRoot\system32\DRIVERS\e1e5132.sys
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\Rtenicxp.sys
    \SystemRoot\system32\DRIVERS\nic1394.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\serscan.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\system32\DRIVERS\avgmfx86.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\windows\system32\drivers\avgtpx86.sys
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\avgtdix.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\arp1394.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\System32\drivers\afd.sys
     
  19. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Please read my reply #17.
     
  20. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    What ever I have disabled System Restore so I am unable to create a Restore point.
     
  21. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Did YOU disable system restore or you can't use it for whatever reason?
    If the latter skip creating restore point.
    If you disabled it re-enable it.
     
  22. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    Ok Combofix download a new one so I ma crossing my fingers
     
  23. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    ComboFix 13-04-10.02 - User 04/17/2013 23:19:05.1.2 - x86
    Running from: c:\documents and settings\User\Desktop\ComboFix.exe
    .
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    - REDUCED FUNCTIONALITY MODE -
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\User\Local Settings\Application Data\assembly\tmp
    c:\documents and settings\User\WINDOWS
    c:\program files\TotalRecipeSearch_14EI
    c:\windows\system32\AegisI5Installer.exe
    c:\windows\system32\Cache
    c:\windows\system32\Cache\05a857207e9155f0.fb
    c:\windows\system32\Cache\075884af680ff6dc.fb
    c:\windows\system32\Cache\227113dfa1ca894d.fb
    c:\windows\system32\Cache\49fbbc5a8678d502.fb
    c:\windows\system32\Cache\5c54eb1a1655b076.fb
    c:\windows\system32\Cache\613e8ce7ab7106af.fb
    c:\windows\system32\Cache\633a76311867bd11.fb
    c:\windows\system32\Cache\691f14230153a9e1.fb
    c:\windows\system32\Cache\6cb409d7ac73d9f1.fb
    c:\windows\system32\Cache\7614bd6cfa99e546.fb
    c:\windows\system32\Cache\77664b6ccc36be9f.fb
    c:\windows\system32\Cache\881b3593316772f0.fb
    c:\windows\system32\Cache\98657d0579ae1930.fb
    c:\windows\system32\Cache\b0a828b71b5b6b08.fb
    c:\windows\system32\Cache\c4e10d1be905349b.fb
    c:\windows\system32\Cache\d5c0f4e7bbe35bf3.fb
    c:\windows\system32\Cache\d9ca663388d21ec0.fb
    c:\windows\system32\Cache\f2cda51fd108941f.fb
    c:\windows\system32\Cache\f34d8db84131d925.fb
    c:\windows\system32\system
    c:\windows\system32\URTTemp
    c:\windows\system32\URTTemp\fusion.dll
    c:\windows\system32\URTTemp\mscoree.dll
    c:\windows\system32\URTTemp\mscoree.dll.local
    c:\windows\system32\URTTemp\mscorsn.dll
    c:\windows\system32\URTTemp\mscorwks.dll
    c:\windows\system32\URTTemp\msvcr71.dll
    c:\windows\system32\URTTemp\regtlib.exe
    .
    Infected copy of c:\windows\system32\srsvc.dll was found and disinfected
    Restored copy from - c:\windows\ServicePackFiles\i386\srsvc.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-03-18 to 2013-04-18 )))))))))))))))))))))))))))))))
    .
    .
    2013-04-18 00:42 . 2010-06-08 18:50 692768 ----a-w- c:\windows\system32\drivers\RTL8192su.sys
    2013-04-18 00:42 . 2009-07-14 00:07 24576 ----a-w- c:\windows\system32\drivers\vwifibus.sys
    2013-04-18 00:09 . 2005-04-04 03:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
    2013-04-18 00:09 . 2005-04-04 03:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
    2013-04-18 00:09 . 2005-04-04 03:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
    2013-04-18 00:09 . 2005-04-04 03:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
    2013-04-18 00:09 . 2013-04-18 00:09 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
    2013-04-18 00:09 . 2013-04-18 00:09 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
    2013-04-18 00:06 . 2013-04-18 01:35 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys
    2013-04-18 00:03 . 2013-04-18 00:03 -------- d-----w- c:\windows\OPTIONS
    2013-04-18 00:03 . 2010-12-31 11:00 854632 ----a-w- c:\windows\system32\drivers\rtl8192cu.sys
    2013-04-18 00:03 . 2013-04-18 00:13 -------- d-----w- c:\windows\system32\RtlGina
    2013-04-18 00:03 . 2009-02-05 06:49 451072 ----a-w- c:\windows\system32\ISSRemoveSP.exe
    2013-04-17 23:58 . 2009-08-14 14:20 757852 ----a-w- c:\windows\system32\Scutum.dll
    2013-04-17 23:58 . 2009-07-21 14:50 180224 ----a-w- c:\windows\system32\W32N55.dll
    2013-04-17 23:58 . 2008-12-30 20:55 143459 ----a-w- c:\windows\system32\RalinkGina.dll
    2013-04-17 23:58 . 2008-09-10 19:55 200704 ----a-w- c:\windows\system32\ssleay32.dll
    2013-04-17 23:58 . 2008-09-10 19:55 1085440 ----a-w- c:\windows\system32\libeay32.dll
    2013-04-17 23:58 . 2009-05-11 15:45 147456 ----a-w- c:\windows\system32\DiagFunc.dll
    2013-04-17 23:58 . 2009-04-21 19:31 19072 ----a-w- c:\windows\system32\drivers\Scutum50.sys
    2013-04-17 23:58 . 2013-04-17 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Ralink Driver
    2013-04-17 23:57 . 2013-04-17 23:58 -------- d-----w- c:\program files\Ralink
    2013-04-17 23:57 . 2013-04-17 23:57 -------- d-----w- c:\documents and settings\User\Application Data\InstallShield
    2013-04-17 17:08 . 2008-04-13 23:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
    2013-04-17 17:08 . 2008-04-13 23:11 21504 ----a-w- c:\windows\system32\hidserv.dll
    2013-04-17 17:08 . 2008-04-13 17:39 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
    2013-04-17 17:08 . 2008-04-13 17:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
    2013-04-17 17:08 . 2008-04-13 17:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
    2013-04-17 17:08 . 2008-04-13 17:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
    2013-04-16 19:05 . 2013-04-16 19:05 -------- d-----w- c:\documents and settings\User\Application Data\AVG8
    2013-04-16 19:00 . 2012-06-02 19:19 577048 -c--a-w- c:\windows\system32\dllcache\wuapi.dll
    2013-04-16 19:00 . 2012-06-02 19:19 577048 ----a-w- c:\windows\system32\wuapi.dll
    2013-04-16 13:38 . 2004-08-04 12:00 90112 -c--a-w- c:\windows\system32\dllcache\mycomput.dll
    2013-04-16 13:38 . 2004-08-04 12:00 90112 ----a-w- c:\windows\system32\mycomput.dll
    2013-04-15 22:31 . 2013-04-15 22:31 -------- d-----w- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
    2013-03-29 13:17 . 2013-03-29 13:17 -------- d-----w- C:\$NtUninstallXPSEP$
    2013-03-29 13:16 . 2010-10-05 17:56 14048 ------w- c:\windows\system32\spmsg2.dll
    2013-03-28 14:23 . 2013-03-28 14:23 -------- d-----w- c:\documents and settings\User\Application Data\RealNetworks
    2013-03-28 14:14 . 2013-03-28 14:14 -------- d-----w- c:\program files\RealNetworks
    2013-03-28 14:14 . 2013-03-28 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\RealNetworks
    2013-03-28 14:14 . 2013-03-28 14:14 -------- d-----w- c:\program files\Common Files\xing shared
    2013-03-28 14:13 . 2013-03-28 14:14 -------- d-----w- c:\program files\real
    2013-03-23 14:42 . 2013-03-23 14:42 -------- d-----w- C:\QuickBooksAutoDataRecovery
    2013-03-23 14:36 . 2013-03-23 14:36 -------- d-----w- C:\Restored_Le Cartier Maintenance_Files
    2013-03-21 18:42 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys
    2013-03-21 18:42 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-03-28 14:13 . 2003-03-19 01:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2013-03-13 16:16 . 2012-10-24 12:48 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-03-13 16:16 . 2011-09-28 13:32 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-03-08 08:36 . 2006-02-28 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
    2013-03-07 01:32 . 2006-02-28 12:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
    2013-03-07 00:50 . 2004-08-03 22:59 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2013-03-02 02:06 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2013-03-02 02:06 . 2006-02-28 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
    2013-03-02 02:06 . 2006-02-28 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2013-03-02 01:25 . 2006-02-28 12:00 1867264 ------w- c:\windows\system32\win32k.sys
    2013-03-02 01:08 . 2006-02-28 12:00 385024 ------w- c:\windows\system32\html.iec
    2013-02-27 07:56 . 2008-01-31 19:37 2067456 ------w- c:\windows\system32\mstscax.dll
    2013-02-19 14:39 . 2013-01-30 14:33 33112 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2013-02-12 00:32 . 2008-08-19 13:37 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
    2013-02-12 00:32 . 2006-02-28 12:00 12928 ------w- c:\windows\system32\drivers\usb8023.sys
    2013-01-26 03:55 . 2006-02-28 12:00 552448 ------w- c:\windows\system32\oleaut32.dll
    2009-08-13 17:23 . 2009-08-13 17:23 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
    2009-08-13 17:23 . 2009-08-13 17:23 125848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [7] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll
    [7] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
    [7] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll
    .
    c:\windows\System32\es.dll ... is missing !!
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
    2013-02-19 14:39 1929392 ----a-w- c:\program files\AVG SafeGuard toolbar\14.2.0.1\AVG SafeGuard toolbar_toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG SafeGuard toolbar\14.2.0.1\AVG SafeGuard toolbar_toolbar.dll" [2013-02-19 1929392]
    .
    [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
    [HKEY_CLASSES_ROOT\AVG SafeGuard toolbar.PugiObj.1]
    [HKEY_CLASSES_ROOT\AVG SafeGuard toolbar.PugiObj]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-02 94208]
    "IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2006-09-21 9138176]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-05-14 30248]
    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-05-14 46632]
    "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-04-11 413696]
    "XeroxScannerDaemon"="c:\program files\Xerox\NWWia\XrxFTPLt.exe" [2001-08-18 27648]
    "vProt"="c:\program files\AVG SafeGuard toolbar\vprot.exe" [2013-02-19 1151152]
    "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-03-28 295512]
    .
    c:\documents and settings\User\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\documents and settings\User\Application Data\Dropbox\bin\Dropbox.exe [N/A]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Belkin Wireless Networking Utility.lnk - c:\program files\Belkin\F6D4050\v1\BelkinWCUI.exe [N/A]
    Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [N/A]
    QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [N/A]
    QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2009\QBW32.EXE [2012-12-6 1181584]
    Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe [2013-4-17 1560576]
    REALTEK 11n USB Wireless LAN Utility.lnk - c:\program files\Realtek\11n USB Wireless LAN Utility\RtWLan.exe [2013-4-17 991232]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\008DH06]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ControlSe]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\f5b4b800.sys]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @=""
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\windows\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
    "c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
    "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
    "c:\\Program Files\\xerox\\nwwia\\XrxFTPLt.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R1 ControlSe;ControlSe;c:\windows\system32\drivers\SYSTEM\ControlSe.sys [x]
    R1 Dri;Dri;c:\windows\system32\drivers\Dri.sys [x]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [x]
    R2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [x]
    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [x]
    R3 npf;Supereal Netgroup Packet Filter Driver;d:\ap03\AP Software\English\npf32.sys [x]
    R3 ssmirrdr;ssmirrdr;c:\windows\system32\DRIVERS\ssmirrdr.sys [x]
    R4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [x]
    R4 SessionLauncher;SessionLauncher;c:\docume~1\User\LOCALS~1\Temp\DX9\SessionLauncher.exe [x]
    S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
    S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
    S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
    S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
    S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [x]
    S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
    S2 PfFilter;PfFilter;c:\program files\IObit\Protected Folder\pffilter.sys [x]
    S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
    S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
    S2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [x]
    S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
    S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
    S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9b12f18-509e-11e0-a6b7-001676badf5c}]
    \Shell\AutoRun\command - I:\LaunchU3.exe -a
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2007-05-15 22:08 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-04-18 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-24 16:16]
    .
    2013-02-15 c:\windows\Tasks\Disk Cleanup.job
    - c:\windows\system32\cleanmgr.exe [2006-02-28 00:12]
    .
    2013-04-18 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://www.google.com/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
    DPF: {D25A9538-F962-4501-9E68-D7C3DDECB148} - hxxp://75.144.211.249:8080/template/xWebView2.cab
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    HKLM-Run-SigmatelSysTrayApp - sttray.exe
    Notify-AutorunsDisabled - avgrsstx.dll
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2013-04-17 23:24
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d5,35,c4,0e,7b,35,d2,46,a0,fd,6d,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d5,35,c4,0e,7b,35,d2,46,a0,fd,6d,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(2084)
    c:\windows\system32\WININET.dll
    c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
    c:\program files\Common Files\Ahead\Lib\MSVCP71.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVG\AVG2012\avgrsx.exe
    c:\program files\AVG\AVG2012\avgcsrvx.exe
    c:\windows\system32\WgaTray.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\program files\Ralink\Common\RaRegistry.exe
    c:\program files\AVG\AVG2012\avgnsx.exe
    c:\program files\TeamViewer\Version7\TeamViewer.exe
    c:\program files\TeamViewer\Version7\tv_w32.exe
    .
    **************************************************************************
    .
    Completion time: 2013-04-17 23:26:19 - machine was rebooted
    ComboFix-quarantined-files.txt 2013-04-18 03:26
    .
    Pre-Run: 218,377,691,136 bytes free
    Post-Run: 219,307,511,808 bytes free
    .
    - - End Of File - - B5358E0C2C41D07C83E208236AFE184B
     
  24. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Combofix says:
    Make sure on the following Combofix run you allow Recovery Console installation.

    1. Please open Notepad (Start>All Programs>Accessories>Notepad).

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    FCopy::
    c:\windows\system32\dllcache\es.dll | c:\windows\System32\es.dll
    
    ClearJavaCache::
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  25. Hank1972

    Hank1972 TS Rookie Topic Starter Posts: 18

    Hello again, this morning I went back to the office to rerun the scan using combofix and having install Recovery Console. Yet when it tried to install it I got an error message saying "partition numbered wrong" or something to that effect . ComboFix did do a scan again and here is that log. I am curious, as to what to do now, should I run rKiller?
    ComboFix 13-04-10.02 - User 04/18/2013 9:27.2.2 - x86
    Running from: c:\documents and settings\User\Desktop\ComboFix.exe
    .
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    - REDUCED FUNCTIONALITY MODE -
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-03-18 to 2013-04-18 )))))))))))))))))))))))))))))))
    .
    .
    2013-04-18 00:42 . 2010-06-08 18:50 692768 ----a-w- c:\windows\system32\drivers\RTL8192su.sys
    2013-04-18 00:42 . 2009-07-14 00:07 24576 ----a-w- c:\windows\system32\drivers\vwifibus.sys
    2013-04-18 00:09 . 2005-04-04 03:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
    2013-04-18 00:09 . 2005-04-04 03:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
    2013-04-18 00:09 . 2005-04-04 03:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
    2013-04-18 00:09 . 2005-04-04 03:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
    2013-04-18 00:09 . 2013-04-18 00:09 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
    2013-04-18 00:09 . 2013-04-18 00:09 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
    2013-04-18 00:06 . 2013-04-18 01:35 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys
    2013-04-18 00:03 . 2013-04-18 00:03 -------- d-----w- c:\windows\OPTIONS
    2013-04-18 00:03 . 2010-12-31 11:00 854632 ----a-w- c:\windows\system32\drivers\rtl8192cu.sys
    2013-04-18 00:03 . 2013-04-18 00:13 -------- d-----w- c:\windows\system32\RtlGina
    2013-04-18 00:03 . 2009-02-05 06:49 451072 ----a-w- c:\windows\system32\ISSRemoveSP.exe
    2013-04-17 23:58 . 2009-08-14 14:20 757852 ----a-w- c:\windows\system32\Scutum.dll
    2013-04-17 23:58 . 2009-07-21 14:50 180224 ----a-w- c:\windows\system32\W32N55.dll
    2013-04-17 23:58 . 2008-12-30 20:55 143459 ----a-w- c:\windows\system32\RalinkGina.dll
    2013-04-17 23:58 . 2008-09-10 19:55 200704 ----a-w- c:\windows\system32\ssleay32.dll
    2013-04-17 23:58 . 2008-09-10 19:55 1085440 ----a-w- c:\windows\system32\libeay32.dll
    2013-04-17 23:58 . 2009-05-11 15:45 147456 ----a-w- c:\windows\system32\DiagFunc.dll
    2013-04-17 23:58 . 2009-04-21 19:31 19072 ----a-w- c:\windows\system32\drivers\Scutum50.sys
    2013-04-17 23:58 . 2013-04-17 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Ralink Driver
    2013-04-17 23:57 . 2013-04-17 23:58 -------- d-----w- c:\program files\Ralink
    2013-04-17 23:57 . 2013-04-17 23:57 -------- d-----w- c:\documents and settings\User\Application Data\InstallShield
    2013-04-17 17:08 . 2008-04-13 23:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
    2013-04-17 17:08 . 2008-04-13 23:11 21504 ----a-w- c:\windows\system32\hidserv.dll
    2013-04-17 17:08 . 2008-04-13 17:39 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
    2013-04-17 17:08 . 2008-04-13 17:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
    2013-04-17 17:08 . 2008-04-13 17:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
    2013-04-17 17:08 . 2008-04-13 17:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
    2013-04-16 19:05 . 2013-04-16 19:05 -------- d-----w- c:\documents and settings\User\Application Data\AVG8
    2013-04-16 19:00 . 2012-06-02 19:19 577048 -c--a-w- c:\windows\system32\dllcache\wuapi.dll
    2013-04-16 19:00 . 2012-06-02 19:19 577048 ----a-w- c:\windows\system32\wuapi.dll
    2013-04-16 13:38 . 2004-08-04 12:00 90112 -c--a-w- c:\windows\system32\dllcache\mycomput.dll
    2013-04-16 13:38 . 2004-08-04 12:00 90112 ----a-w- c:\windows\system32\mycomput.dll
    2013-04-15 22:31 . 2013-04-15 22:31 -------- d-----w- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
    2013-03-29 13:17 . 2013-03-29 13:17 -------- d-----w- C:\$NtUninstallXPSEP$
    2013-03-29 13:16 . 2010-10-05 17:56 14048 ------w- c:\windows\system32\spmsg2.dll
    2013-03-28 14:23 . 2013-03-28 14:23 -------- d-----w- c:\documents and settings\User\Application Data\RealNetworks
    2013-03-28 14:14 . 2013-03-28 14:14 -------- d-----w- c:\program files\RealNetworks
    2013-03-28 14:14 . 2013-03-28 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\RealNetworks
    2013-03-28 14:14 . 2013-03-28 14:14 -------- d-----w- c:\program files\Common Files\xing shared
    2013-03-28 14:13 . 2013-03-28 14:14 -------- d-----w- c:\program files\real
    2013-03-23 14:42 . 2013-03-23 14:42 -------- d-----w- C:\QuickBooksAutoDataRecovery
    2013-03-23 14:36 . 2013-03-23 14:36 -------- d-----w- C:\Restored_Le Cartier Maintenance_Files
    2013-03-21 18:42 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys
    2013-03-21 18:42 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-03-28 14:13 . 2003-03-19 01:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2013-03-13 16:16 . 2012-10-24 12:48 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-03-13 16:16 . 2011-09-28 13:32 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-03-08 08:36 . 2006-02-28 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
    2013-03-07 01:32 . 2006-02-28 12:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
    2013-03-07 00:50 . 2004-08-03 22:59 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2013-03-02 02:06 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2013-03-02 02:06 . 2006-02-28 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
    2013-03-02 02:06 . 2006-02-28 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2013-03-02 01:25 . 2006-02-28 12:00 1867264 ------w- c:\windows\system32\win32k.sys
    2013-03-02 01:08 . 2006-02-28 12:00 385024 ------w- c:\windows\system32\html.iec
    2013-02-27 07:56 . 2008-01-31 19:37 2067456 ------w- c:\windows\system32\mstscax.dll
    2013-02-19 14:39 . 2013-01-30 14:33 33112 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2013-02-12 00:32 . 2008-08-19 13:37 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
    2013-02-12 00:32 . 2006-02-28 12:00 12928 ------w- c:\windows\system32\drivers\usb8023.sys
    2013-01-26 03:55 . 2006-02-28 12:00 552448 ------w- c:\windows\system32\oleaut32.dll
    2009-08-13 17:23 . 2009-08-13 17:23 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
    2009-08-13 17:23 . 2009-08-13 17:23 125848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
    2013-02-19 14:39 1929392 ----a-w- c:\program files\AVG SafeGuard toolbar\14.2.0.1\AVG SafeGuard toolbar_toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG SafeGuard toolbar\14.2.0.1\AVG SafeGuard toolbar_toolbar.dll" [2013-02-19 1929392]
    .
    [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
    [HKEY_CLASSES_ROOT\AVG SafeGuard toolbar.PugiObj.1]
    [HKEY_CLASSES_ROOT\AVG SafeGuard toolbar.PugiObj]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32 129272 ----a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-02 94208]
    "IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2006-09-21 9138176]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-05-14 30248]
    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-05-14 46632]
    "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-04-11 413696]
    "XeroxScannerDaemon"="c:\program files\Xerox\NWWia\XrxFTPLt.exe" [2001-08-18 27648]
    "vProt"="c:\program files\AVG SafeGuard toolbar\vprot.exe" [2013-02-19 1151152]
    "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-03-28 295512]
    .
    c:\documents and settings\User\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\documents and settings\User\Application Data\Dropbox\bin\Dropbox.exe [N/A]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Belkin Wireless Networking Utility.lnk - c:\program files\Belkin\F6D4050\v1\BelkinWCUI.exe [N/A]
    Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [N/A]
    QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [N/A]
    QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2009\QBW32.EXE [2012-12-6 1181584]
    Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe [2013-4-17 1560576]
    REALTEK 11n USB Wireless LAN Utility.lnk - c:\program files\Realtek\11n USB Wireless LAN Utility\RtWLan.exe [2013-4-17 991232]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\008DH06]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ControlSe]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\f5b4b800.sys]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @=""
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\windows\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
    "c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
    "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
    "c:\\Program Files\\xerox\\nwwia\\XrxFTPLt.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R1 ControlSe;ControlSe;c:\windows\system32\drivers\SYSTEM\ControlSe.sys [x]
    R1 Dri;Dri;c:\windows\system32\drivers\Dri.sys [x]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [x]
    R2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [x]
    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [x]
    R3 npf;Supereal Netgroup Packet Filter Driver;d:\ap03\AP Software\English\npf32.sys [x]
    R3 ssmirrdr;ssmirrdr;c:\windows\system32\DRIVERS\ssmirrdr.sys [x]
    R4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [x]
    R4 SessionLauncher;SessionLauncher;c:\docume~1\User\LOCALS~1\Temp\DX9\SessionLauncher.exe [x]
    S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
    S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
    S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
    S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
    S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [x]
    S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
    S2 PfFilter;PfFilter;c:\program files\IObit\Protected Folder\pffilter.sys [x]
    S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
    S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
    S2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [x]
    S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
    S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
    S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
    .
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9b12f18-509e-11e0-a6b7-001676badf5c}]
    \Shell\AutoRun\command - I:\LaunchU3.exe -a
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2007-05-15 22:08 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-04-18 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-24 16:16]
    .
    2013-02-15 c:\windows\Tasks\Disk Cleanup.job
    - c:\windows\system32\cleanmgr.exe [2006-02-28 00:12]
    .
    2013-04-18 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://www.google.com/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
    DPF: {D25A9538-F962-4501-9E68-D7C3DDECB148} - hxxp://75.144.211.249:8080/template/xWebView2.cab
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2013-04-18 09:30
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d5,35,c4,0e,7b,35,d2,46,a0,fd,6d,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d5,35,c4,0e,7b,35,d2,46,a0,fd,6d,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(3692)
    c:\windows\system32\WININET.dll
    c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.17.dll
    c:\windows\system32\ieframe.dll
    c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
    c:\program files\Common Files\Ahead\Lib\MSVCP71.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    .
    Completion time: 2013-04-18 09:31:15
    ComboFix-quarantined-files.txt 2013-04-18 13:31
    ComboFix2.txt 2013-04-18 03:26
    .
    Pre-Run: 219,512,246,272 bytes free
    Post-Run: 219,499,094,016 bytes free
    .
    - - End Of File - - 170D7BE4F3BA1A549201EB7F0551FB2C
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...