TechSpot

Virus and malware removal

By billtest
Feb 24, 2011
  1. had explorer occasionally being hijacked.
    Went through steps - here are the logs.

    Please advise if clear.

    Thanks

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5852

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    2/24/2011 10:08:06 AM
    mbam-log-2011-02-24 (10-08-06).txt

    Scan type: Quick scan
    Objects scanned: 172554
    Time elapsed: 9 minute(s), 15 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. billtest

    billtest TS Rookie Topic Starter

    Malware Log

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5852

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    2/24/2011 10:08:06 AM
    mbam-log-2011-02-24 (10-08-06).txt

    Scan type: Quick scan
    Objects scanned: 172554
    Time elapsed: 9 minute(s), 15 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
  4. billtest

    billtest TS Rookie Topic Starter

    DDS log

    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Bill Borkan at 21:18:30.54 on Thu 02/24/2011
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2055 [GMT -5:00]

    AV: AVG Anti-Virus Business Edition *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    svchost.exe
    C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    C:\WINDOWS\system32\acs.exe
    C:\WINDOWS\System32\svchost.exe -k Akamai
    C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    svchost.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\Program Files\AVG\AVG9\avgam.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\WINDOWS\system32\svchost.exe -k HPService
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
    C:\WINDOWS\System32\TPHDEXLG.EXE
    C:\WINDOWS\system32\TpKmpSVC.exe
    C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
    C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
    C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
    C:\Program Files\Lenovo\Rescue and Recovery\adm\IUService.exe
    C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
    C:\WINDOWS\system32\UTSCSI.EXE
    C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
    c:\program files\lenovo\system update\suservice.exe
    C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\WINDOWS\system32\TpShocks.exe
    C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    C:\Program Files\Lenovo\Zoom\TpScrex.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
    C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe
    C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
    C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
    C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Documents and Settings\Bill Borkan\My Documents\dds.exe

    ============== Pseudo HJT Report ===============

    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uStart Page = hxxp://www.msnbc.com
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>;*.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
    BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [cdloader] "c:\documents and settings\bill borkan\application data\mjusbsp\cdloader2.exe" MAGICJACK
    uRun: [AdobeBridge]
    uRun: [Google Update] "c:\documents and settings\bill borkan\local settings\application data\google\update\GoogleUpdate.exe" /c
    mRun: [PWRMGRTR] rundll32 c:\progra~1\thinkpad\utilit~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
    mRun: [BLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BatLogEx.DLL,StartBattLog
    mRun: [SynTPLpr] "c:\program files\synaptics\syntp\SynTPLpr.exe"
    mRun: [SynTPEnh] "c:\program files\synaptics\syntp\SynTPEnh.exe"
    mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe
    mRun: [TPKMAPHELPER] "c:\program files\thinkpad\utilities\TpKmapAp.exe" -helper
    mRun: [TpShocks] TpShocks.exe
    mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe
    mRun: [SoundMAXPnP] "c:\program files\analog devices\core\smax4pnp.exe"
    mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
    mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
    mRun: [LPManager] c:\progra~1\thinkv~2\prdctr\LPMGR.exe
    mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe
    mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
    mRun: [ISUSPM Startup] "c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe" -startup
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [DiskeeperSystray] "c:\program files\diskeeper corporation\diskeeper\DkIcon.exe"
    mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
    mRun: [DXM6Patch_981116] "c:\windows\p_981116.exe" /Q:A
    mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"
    mRun: [Necutray] NECUTRAY.EXE
    mRun: [MolCp Monitor] "c:\program files\musiclab\midioverlan cp\monitor.exe"
    mRun: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
    mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start
    mRun: [LENOVO.TPFNF6R] c:\program files\lenovo\hotkey\TPFNF6R.exe
    mRun: [ACWLIcon] c:\program files\thinkpad\connectutilities\ACWLIcon.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
    mRun: [Boingo Wi-Fi] "c:\program files\boingo\boingo wi-fi\Boingo.lnk"
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [AmazonGSDownloaderTray] c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderTray.exe
    mRun: [Rqunasufolif] rundll32.exe "c:\windows\ujohiqopuhuhi.dll",Startup
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
    mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
    mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
    StartupFolder: c:\docume~1\billbo~1\startm~1\programs\startup\outlook.lnk - c:\program files\outlook express\msimn.exe
    StartupFolder: c:\docume~1\billbo~1\startm~1\programs\startup\pdanet~1.lnk - c:\program files\pdanet for android\PdaNetPC.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Send from PC to TV Bookmark - file://c:\program files\send from pc to tv\SendFromPC2TV_Bookmark.htm
    IE: Send from PC to TV Play/Pause - file://c:\program files\send from pc to tv\SendFromPC2TV_PlayPause.htm
    IE: Send from PC to TV Stop - file://c:\program files\send from pc to tv\SendFromPC2TV_Stop.htm
    IE: Send to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm
    IE: Send To Bluetooth - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    Trusted Zone: etrade.com\us
    DPF: {17220B00-60CD-4E50-A244-02ED7C8E6385} - hxxp://192.168.1.64//DvrMaster.cab
    DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} - hxxp://bsb49.viewnetcam.com:50001/SysCamInst.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.1.249/plugin/client.cab
    DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://www.maunalani.com/AxisCamControl.ocx
    DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} - hxxp://192.168.1.249/plugin/h263ctrl.cab
    DPF: {B9940246-4344-4D1B-BD82-DBAF7E657FF9} - hxxp://bsb1.viewnetcam.com:50000/SysCamInst.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/RACtrl.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: ACNotify - ACNotify.dll
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    Notify: psfus - c:\program files\thinkvantage fingerprint software\psqlpwd.dll
    Notify: tpfnf2 - c:\program files\lenovo\hotkey\notifyf2.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Notification Packages = scecli ACGina c:\program files\thinkvantage fingerprint software\psqlpwd.dll
    Hosts: 192.168.1.100 HP0017A4229281
    Hosts: 192.168.1.211 HP0015604B7492

    ============= SERVICES / DRIVERS ===============

    R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-7-15 25168]
    R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-7-15 52872]
    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-7-15 216400]
    R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-7-15 29584]
    R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-7-15 243024]
    R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [2008-5-9 46144]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2006-4-30 14336]
    R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
    R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2009-1-23 53248]
    R2 smihlp;SMI Helper Driver (smihlp);c:\program files\thinkvantage fingerprint software\smihlp.sys [2009-3-13 12560]
    R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2008-10-24 62320]
    R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2008-5-14 520192]
    R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\lenovo\rescue and recovery\UpdateMonitor.exe [2008-5-9 360448]
    R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-7-15 122448]
    R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-7-15 30288]
    R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-7-15 26192]
    R3 mlnmtwdm;TransportMidi WDM Driver;c:\windows\system32\drivers\mlnmtwdm.sys [2005-11-17 46592]
    R3 pnetmdm;PdaNet Modem;c:\windows\system32\drivers\pnetmdm.sys [2010-2-7 9472]
    R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2008-2-22 37312]
    S2 asurscsi;asurscsi;c:\docume~1\billbo~1\locals~1\temp\msi4a8e.tmp --> c:\docume~1\billbo~1\locals~1\temp\MSI4A8E.tmp [?]
    S2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-7-15 5897808]
    S2 HidCom;USB-HID -> COM Driver Service;c:\windows\system32\drivers\HidCom.sys [2008-1-5 21016]
    S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-5-22 45424]
    S2 WebrootCommAgentService;Webroot CommAgent Service;c:\program files\webroot\enterprise\spy sweeper\commagent.exe --> c:\program files\webroot\enterprise\spy sweeper\commagent.exe [?]
    S2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;"c:\program files\webroot\enterprise\spy sweeper\spysweeper.exe" --> c:\program files\webroot\enterprise\spy sweeper\spysweeper.exe [?]
    S3 Amazon Download Agent;Amazon Download Agent;c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderService.exe [2010-6-11 401920]
    S3 FTD2XX;Outlaw Audio Model 990 Device Driver;c:\windows\system32\drivers\FTD2XX.sys [2008-6-11 24197]
    S3 mlmmpwdm;Miniport MIDI WDM Driver;c:\windows\system32\drivers\mlmmpwdm.sys [2005-11-17 39424]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-5-16 18176]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-5-16 7680]
    S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2008-5-16 23680]
    S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [2002-9-9 17018]
    S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
    S3 swmx01;Sierra Wireless USB MUX Driver (#01);c:\windows\system32\drivers\swmx01.sys [2005-11-18 58624]
    S3 SWNC5E01;Sierra Wireless MUX NDIS Driver (#01);c:\windows\system32\drivers\SWNC5E01.sys [2005-8-5 73600]

    =============== File Associations ===============

    .scr=AutoCADScriptFile
    .reg=Regedit.Document

    =============== Created Last 30 ================

    2011-02-19 23:00:12 180736 --sha-r- c:\windows\system32\query2.dll
    2011-02-18 14:54:04 -------- d-----r- c:\program files\Skype
    2011-02-09 04:21:34 -------- d-----w- c:\program files\iTunes
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll
    2011-02-09 04:18:03 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

    ==================== Find3M ====================

    2010-12-14 23:51:20 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    2010-11-29 22:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 22:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts

    ============= FINISH: 21:18:57.40 ===============
     
  5. billtest

    billtest TS Rookie Topic Starter

    gmer log 1

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2011-02-24 21:08:05
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK1234GSX rev.AH002E
    Running: gmer tg74ul1e.exe; Driver: C:\DOCUME~1\BILLBO~1\LOCALS~1\Temp\awtdqpow.sys


    ---- System - GMER 1.0.15 ----

    SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xAE038670]
    SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xAE038720]
    SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xAE0387C0]
    SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xAE038860]

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9BE7] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\psapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\psapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryW] [6BFA9AD3] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9B5A] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryA] [6BFA9A4C] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
    IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[2116] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9C74] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs tvtumon.sys (Windows Update Monitor Driver/Lenovo)
    AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \FileSystem\Fastfat \Fat AB844C8A

    AttachedDevice \FileSystem\Fastfat \Fat tvtumon.sys (Windows Update Monitor Driver/Lenovo)
    AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\0050f2e180eb (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0050f2e180eb (not active ControlSet)
    Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0050f2e180eb
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x6B 0x65 0x49 0x6A ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x05 0x73 0x21 0xDD ...
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7C1048C4-E947-1F45-00DD-DE4F2AD367A6}
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7C1048C4-E947-1F45-00DD-DE4F2AD367A6}@oaheackikniblhkdcjfgoaglaeghac 0x69 0x61 0x6C 0x69 ...
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7C1048C4-E947-1F45-00DD-DE4F2AD367A6}@nabegakpehgppmcemiegeeldbknm 0x69 0x61 0x6C 0x69 ...
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D24B0F26-0F33-00FD-64E6-5DDCCAF66792}
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DD725422-34D9-9B3C-A779-BB6CF770628B}
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DD725422-34D9-9B3C-A779-BB6CF770628B}@oapeadlohlilhcbhpgfmkcijnadmje 0x6A 0x61 0x64 0x6A ...
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DD725422-34D9-9B3C-A779-BB6CF770628B}@najnccglggjjjcbkcmcanlhmlcdc 0x6A 0x61 0x64 0x6A ...
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DD725422-34D9-9B3C-A779-BB6CF770628B}@abdpibjjfnfgpaaipdmahokcmmfmhoioom 0x6C 0x61 0x64 0x6F ...
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DD725422-34D9-9B3C-A779-BB6CF770628B}@maapfbbjmllkgapbcfjkhijabn 0x6F 0x61 0x6B 0x6F ...

    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 08: copy of MBR

    ---- Files - GMER 1.0.15 ----

    File C:\RRbackups\C 0 bytes
    File C:\RRbackups\common 0 bytes
    File C:\RRbackups\common\backups.dat 8192 bytes
    File C:\RRbackups\common\hints.dat 8192 bytes
    File C:\RRbackups\common\mnd.dat 8192 bytes
    File C:\RRbackups\common\regcerts.dat 8192 bytes
    File C:\RRbackups\common\restore.log 246 bytes
    File C:\RRbackups\common\rr.log 108675 bytes
    File C:\RRbackups\common\SAM 262144 bytes
    File C:\RRbackups\common\seccache.dat 8192 bytes
    File C:\RRbackups\common\secpolicy.dat 57344 bytes
    File C:\RRbackups\common\settings.dat 61440 bytes
    File C:\RRbackups\common\system.dat 12288 bytes
    File C:\RRbackups\common\tvtcmn.dat 8192 bytes
    File C:\RRbackups\common\tvtns.bin 15 bytes
    File C:\RRbackups\common\usersids.dat 16640 bytes
    File C:\RRbackups\Documents and Settings 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Lenovo 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Crypto 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST 24 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500\f3fcf532-d50e-422b-9716-d052916dab05 388 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500\1a175c87-0aef-4297-bbc8-7ca90f8d6686 388 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
    File C:\RRbackups\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
    File C:\RRbackups\Documents and Settings\All Users 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security Solution 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security Solution\cspContainer.dat 332 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security Solution\encobject.dat 1608 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security Solution\hwkeys.dat 4248 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Lenovo\Client Security
     
  6. billtest

    billtest TS Rookie Topic Starter

    gmer log 2

    Solution\symkeys.dat 656 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a077ead69703e3bf1fd373a3c9376faa_ac9c06de-aa24-4641-9437-e3cff50e8a2d 901 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a5bac492b8a12a9b6bf4a5681cc06a21_ac9c06de-aa24-4641-9437-e3cff50e8a2d 888 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a5bac492b8a12a9b6bf4a5681cc06a21_af4e1300-1c9c-4d6c-8870-76abde73079c 888 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_ac9c06de-aa24-4641-9437-e3cff50e8a2d 52 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 0 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\42e7e898003fbdeb9585806ee1664b51_ac9c06de-aa24-4641-9437-e3cff50e8a2d 57 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\42e7e898003fbdeb9585806ee1664b51_af4e1300-1c9c-4d6c-8870-76abde73079c 57 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\533145ef011ddf5ca3983e2545a902b4_af4e1300-1c9c-4d6c-8870-76abde73079c 2075 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_ac9c06de-aa24-4641-9437-e3cff50e8a2d 47 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_af4e1300-1c9c-4d6c-8870-76abde73079c 47 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\8f71098770f72c7a67cd8f1151619865_ac9c06de-aa24-4641-9437-e3cff50e8a2d 54 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\8f71098770f72c7a67cd8f1151619865_af4e1300-1c9c-4d6c-8870-76abde73079c 54 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\b973ec0ff915c48a18fe09064ce3a22d_ac9c06de-aa24-4641-9437-e3cff50e8a2d 56 bytes
    File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_ac9c06de-aa24-4641-9437-e3cff50e8a2d 893 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\Bill Borkan.pwm 7328 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\config.ini 61 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\cspContainer.dat 332 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\cssversion.dat 1908 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\encobject.dat 19296 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\hibernation.dat 4 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\hwkeys.dat 10620 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\pwdrecovery.dat 1104 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\pwmaction.dat 840 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Lenovo\Client Security Solution\symkeys.dat 2296 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\146482325737612d5fbcd71839d49d49_af4e1300-1c9c-4d6c-8870-76abde73079c 50 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\1489f484ff2b2e08fcd6e01028a81fd8_af4e1300-1c9c-4d6c-8870-76abde73079c 52 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\533145ef011ddf5ca3983e2545a902b4_af4e1300-1c9c-4d6c-8870-76abde73079c 2075 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\6b29ae44e85efac3c72ff4d1865d73f1_af4e1300-1c9c-4d6c-8870-76abde73079c 53 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\83aa4cc77f591dfc2374580bbd95f6ba_af4e1300-1c9c-4d6c-8870-76abde73079c 45 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\8f71098770f72c7a67cd8f1151619865_af4e1300-1c9c-4d6c-8870-76abde73079c 54 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\932a2db58c237abd381d22df4c63a04a_ac9c06de-aa24-4641-9437-e3cff50e8a2d 87 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Crypto\RSA\S-1-5-21-3031843260-1860471724-2570160596-1005\a077ead69703e3bf1fd373a3c9376faa_ac9c06de-aa24-4641-9437-e3cff50e8a2d 77 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\CREDHIST 296 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500\f3fcf532-d50e-422b-9716-d052916dab05 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\84bec66a-6dd9-4752-bb0e-c52ac5bb2642 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\39baef25-980f-4e2d-b8a9-6c9936cb9940 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\411b98d8-2010-4361-8429-1ad554c4b92f 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\66164a33-81d9-476e-b141-706eb4886db5 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\6fad808c-a7d6-4f8b-9863-11ec3a4b196d 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\71629349-fa07-4fd2-8963-e997384df623 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\7e6e3c82-df1f-4f18-b479-2b8eecdb7cef 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\816555cb-3187-433f-b026-bd69bf516a0e 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\89598763-1102-4e56-80df-61accb07bd32 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\8c9b5eb1-e33f-45e4-83bd-8a3a88f5c332 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\9c7a9bcb-6c8d-42ad-a758-795437dc98aa 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\9dfbfc92-c0b3-440a-bfc7-356125072adb 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\a92634b1-dec0-42f1-8db4-53ef1498d374 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\aaa2d0ba-72e5-4c27-9980-23726817b3cf 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\f15f7976-c4ac-4f10-804d-f92261799583 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\f726d9e0-f39c-4913-b3f9-c21afbf1e2c2 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\ff4f5e30-a0a4-46df-9adf-eda1762b13e8 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-3031843260-1860471724-2570160596-1005\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500\1a175c87-0aef-4297-bbc8-7ca90f8d6686 388 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\My 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\Request 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\Request\Certificates 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\Request\CRLs 0 bytes
    File C:\RRbackups\Documents and Settings\Bill Borkan\Application Data\Microsoft\SystemCertificates\Request\CTLs 0 bytes
    File C:\RRbackups\Documents and Settings\Default User 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Lenovo 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Crypto 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Crypto\RSA 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\CREDHIST 24 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500\f3fcf532-d50e-422b-9716-d052916dab05 388 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-2882557466-3786498614-3819671292-500\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500\1a175c87-0aef-4297-bbc8-7ca90f8d6686 388 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-646486045-1939481219-1991869033-500\Preferred 24 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
    File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
    File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes
    File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes
    File C:\RRbackups\FR 0 bytes
    File C:\RRbackups\FR\KernelFileDigest.dat 17513 bytes
    File C:\RRbackups\FR\UF 0 bytes
    File C:\RRbackups\FR\UF\boot.ini 211 bytes
    File C:\RRbackups\FR\UF\documents and settings 0 bytes
    File C:\RRbackups\FR\UF\documents and settings\default user 0 bytes
    File C:\RRbackups\FR\UF\documents and settings\default user\ntuser.dat 786432 bytes
    File C:\RRbackups\FR\UF\NTDETECT.COM 47564 bytes
    File C:\RRbackups\FR\UF\NTLDR 250032 bytes
    File C:\RRbackups\FR\UF\WINDOWS 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\explorer.exe 1033216 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\Fonts 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\Fonts\mangal.ttf 143864 bytes
    File C:\RRbackups\FR\UF\WINDOWS\Fonts\marlett.ttf 24124 bytes
    File C:\RRbackups\FR\UF\WINDOWS\Fonts\micross.ttf 460728 bytes
    File C:\RRbackups\FR\UF\WINDOWS\Fonts\mvboli.ttf 40500 bytes
    File C:\RRbackups\FR\UF\WINDOWS\Fonts\vgaoem.fon 5168 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\advapi32.dll 617984 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\advpack.dll 128512 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\authz.dll 62464 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\autochk.exe 588800 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\basesrv.dll 52736 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\bootvid.dll 12288 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\browseui.dll 1022976 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\chkdsk.exe 11776 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\cmd.exe 388608 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\comctl32.dll 617472 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\comdlg32.dll 276992 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\config 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\config\default 786432 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\config\SAM 262144 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\config\SECURITY 262144 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\config\software 38273024 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\config\system 11272192 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\config\userdiff 262144 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\crypt32.dll 597504 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\cryptdll.dll 33280 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\cryptui.dll 512512 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\cscdll.dll 101888 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\csrsrv.dll 33280 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\csrss.exe 6144 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\c_1252.nls 66082 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\c_936.nls 196642 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\dnsapi.dll 147968 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\doskey.exe 10752 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\dpcdll.dll 96768 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\acpi.sys 187776 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\acpiec.sys 11648 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\afd.sys 138368 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\amdk6.sys 36992 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\amdk7.sys 37376 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\arp1394.sys 60800 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\asyncmac.sys 14336 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\atapi.sys 95360 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\atmarpc.sys 59904 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\atmepvc.sys 31360 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\atmlane.sys 55936 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\atmuni.sys 352256 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\audstub.sys 3072 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\beep.sys 4224 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\bridge.sys 71552 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\cbidf2k.sys 13952 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\cdaudio.sys 18688 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\cdfs.sys 63744 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\cdrom.sys 62592 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\classpnp.sys 49664 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\cpqdap01.sys 11776 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\crusoe.sys 36480 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\disk.sys 36352 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\diskdump.sys 14208 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\dmboot.sys 799744 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\dmio.sys 153344 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\dmload.sys 5888 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\dxapi.sys 10496 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\dxg.sys 71040 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\dxgthk.sys 3328 bytes executable
     
  7. billtest

    billtest TS Rookie Topic Starter

    gmer log 3

    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\fastfat.sys 143360 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\fdc.sys 27392 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\fips.sys 34944 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\flpydisk.sys 20480 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\fltMgr.sys 128896 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\fsvga.sys 12160 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\fs_rec.sys 7936 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ftdisk.sys 125056 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\hidclass.sys 36224 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\hidparse.sys 24960 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\hidusb.sys 9600 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\http.sys 263552 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\i8042prt.sys 52736 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\imapi.sys 41984 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\intelppm.sys 36096 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ip6fw.sys 29056 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ipfltdrv.sys 32896 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ipinip.sys 20992 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ipnat.sys 134912 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ipsec.sys 74752 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\irenum.sys 11264 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\isapnp.sys 35840 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\kbdclass.sys 24576 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ks.sys 140928 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ksecdd.sys 92544 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mcd.sys 7680 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mnmdd.sys 4224 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\modem.sys 30080 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mouclass.sys 23040 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mountmgr.sys 42240 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mrxdav.sys 179584 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mrxsmb.sys 454016 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\msfs.sys
    19072 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\msgpc.sys 35072 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mssmbios.sys 15488 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mup.sys 107904 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ndis.sys 182656 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ndistapi.sys 9600 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ndisuio.sys 14592 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ndiswan.sys 91776 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ndproxy.sys 38016 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\netbios.sys 34560 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\netbt.sys 162816 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nic1394.sys 61824 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nmnt.sys 40320 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\npfs.sys 30848 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ntfs.sys 574464 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\null.sys 2944 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nwlnkflt.sys 12416 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nwlnkfwd.sys 32512 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nwlnkipx.sys 88448 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nwlnknb.sys 63232 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nwlnkspx.sys 55936 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\oprghdlr.sys 3456 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\p3.sys 42496 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\parport.sys 80128 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\partmgr.sys 18688 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\parvdm.sys 6784 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\pci.sys 68224 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\pciide.sys 3328 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\pciidex.sys 25088 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\pcmcia.sys 119936 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\psched.sys 69120 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ptilink.sys 17792 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rasacd.sys 8832 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rasl2tp.sys 51328 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\raspppoe.sys 41472 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\raspptp.sys 48384 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\raspti.sys 16512 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rawwan.sys 34432 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rdbss.sys 174592 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rdpcdd.sys 4224 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rdpdr.sys 196864 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rdpwd.sys 139528 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\redbook.sys 57472 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rio8drv.sys 12032 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\riodrv.sys 12032 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\RMCast.sys 202752 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rndismp.sys 30080 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\rootmdm.sys 5888 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\scsiport.sys 96256 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\cinemst2.sys 262528 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\gm.dls 3440660 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\mf.sys 63744 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\nikedrv.sys 12032 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\processr.sys 35456 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\sdbus.sys 67584 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\termdd.sys 40840 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\secdrv.sys 20480 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\serenum.sys 15488 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\serial.sys 64896 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\sffdisk.sys 11136 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\sffp_sd.sys 10240 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\sfloppy.sys 11392 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\smclib.sys 14592 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\sonydcam.sys 25472 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\sr.sys 73472 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\srv.sys 352640 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\stream.sys 48768 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\swenum.sys 4352 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\syntp.sys 177664 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tape.sys 14976 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tcpip.sys 360960 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tcpip6.sys 226880 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tdi.sys 18560 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tdpipe.sys 12040 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tdtcp.sys 21896 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tosdvd.sys 51712 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tsbvcap.sys 21376 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\tunmp.sys 12416 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\udfs.sys 66176 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\update.sys 364160 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usb8023.sys 12672 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbcamd.sys 23808 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbcamd2.sys 23936 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbd.sys 4736 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbehci.sys 30080 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbhub.sys 57856 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbintel.sys 16000 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbport.sys 143360 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbstor.sys 26496 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\usbuhci.sys 20608 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\vdmindvd.sys 58112 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\vga.sys 20992 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\videoprt.sys 79744 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\volsnap.sys 52352 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\wanarp.sys 34560 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\wmilib.sys 4352 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\drivers\ws2ifsl.sys 12032 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\duser.dll 304128 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\eventlog.dll 55808 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\faultrep.dll 80384 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\feclient.dll 21504 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\filemgmt.dll 337920 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fldrclnr.dll 87552 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fltlib.dll 16896 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fmifs.dll 16384 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fontext.dll 382976 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fontsub.dll 82432 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\framebuf.dll 9344 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fsusd.dll 81408 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\fwcfg.dll 60416 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\gdi32.dll 284160 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\hal.dll 134272 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\imagehlp.dll 144384 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\imm32.dll 110080 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\iphlpapi.dll 94720 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\kdcom.dll 7040 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\kernel32.dll 986112 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\licdll.dll 423936 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\locale.nls 249270 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\logonui.exe 514560 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\lsasrv.dll 729600 bytes executable
     
  8. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    GMER log seems to be incomplete. It should end with:
    =EOF=

    Attach.txt part of DDS is missing.
     
  9. billtest

    billtest TS Rookie Topic Starter

    gmer log 4 (resending)

    File C:\RRbackups\FR\UF\WINDOWS\system32\samlib.dll 64000 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\samsrv.dll 415744 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\scesrv.dll 313856 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\secupd.dat 4569 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\secupd.sig 7208 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\services.exe 110592 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\setupapi.dll 983552 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\sfc.dll 5120 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\sfc_os.dll 140288 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\shdocvw.dll 1497600 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\shell32.dll 8460800 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\shfolder.dll 25088 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\shgina.dll 68096 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\shlwapi.dll 474112 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\shsvcs.dll 135168 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\smss.exe 50688 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\sortkey.nls 262148 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\sorttbls.nls 22040 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\svchost.exe 14336 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\sxs.dll 713216 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\umpnpmgr.dll 123392 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\unicode.nls 89588 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\usbmon.dll 16896 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\ctype.nls 8386 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\ftsrch.dll 176128 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\mpr.dll 59904 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\oembios.bin 13107200 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\secur32.dll 56320 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\usbui.dll 74240 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\user32.dll 578048 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\userenv.dll 723456 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\userinit.exe 24576 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\uxtheme.dll 218624 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\version.dll 18944 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\vga.dll 9344 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\vga.drv 2176 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\watchdog.sys 17664 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\win32k.sys 1859968 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\wininet.dll 916480 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\winlogon.exe 502784 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\winmm.dll 176128 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\winspool.drv 146432 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\winspool.exe 2112 bytes
    File C:\RRbackups\FR\UF\WINDOWS\system32\winsrv.dll 292864 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\winsta.dll 53760 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\winstrm.dll 18944 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\wintrust.dll 177664 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\wldap32.dll 172032 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\ws2help.dll 19968 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\ws2_32.dll 82944 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\system32\wsock32.dll 22528 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.cat 7232 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.Manifest 1819 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.cat 7238 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.Manifest 1784 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.cat 7433 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.Manifest 1862 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.Manifest 494 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.cat 7433 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.Manifest 500 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.cat 7236 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.Manifest 391 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.cat 7431 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.Manifest 397 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.cat 7429 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.cat 7429 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.Manifest 1177 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.0.0_x-ww_fc342b0b.cat 7236 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.0.0_x-ww_fc342b0b.Manifest 640 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.2600.2000_x-ww_bcc9a281.cat 7431 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.2600.2000_x-ww_bcc9a281.Manifest 1237 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.cat 7238 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.Manifest 1877 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.2180.cat 7431 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.2180.Policy 605 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.cat 7431 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.Policy 623 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.cat 7429 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.Policy 641 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.cat 7429 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.Policy 641 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.2180.cat 7429 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.2180.Policy 621 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.2180.cat 7433 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.2180.Policy 623 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\atl.dll 74802 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\mfc42.dll 995383 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\mfc42u.dll 995384 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\msvcp60.dll 401462 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll 921088 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll 1050624 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcirt.dll 50688 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll 54784 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll 343040 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll 1700352 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll 1712128 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll 853504 bytes executable
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95 0 bytes
    File C:\RRbackups\FR\UF\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll 991232 bytes executable
    File C:\RRbackups\FR\UpdatingFiles.dat 17 bytes
    File C:\RRbackups\SIS 0 bytes
    File C:\RRbackups\SIS\C 0 bytes

    ---- EOF - GMER 1.0.15 ----
     
  10. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

    =====================================================================

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.
     
  11. billtest

    billtest TS Rookie Topic Starter

    TDSKiller Log

    2011/02/28 22:24:53.0640 5464 TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08
    2011/02/28 22:24:53.0843 5464 ================================================================================
    2011/02/28 22:24:53.0843 5464 SystemInfo:
    2011/02/28 22:24:53.0843 5464
    2011/02/28 22:24:53.0843 5464 OS Version: 5.1.2600 ServicePack: 2.0
    2011/02/28 22:24:53.0843 5464 Product type: Workstation
    2011/02/28 22:24:53.0843 5464 ComputerName: BB-T60
    2011/02/28 22:24:53.0843 5464 UserName: Bill Borkan
    2011/02/28 22:24:53.0843 5464 Windows directory: C:\WINDOWS
    2011/02/28 22:24:53.0843 5464 System windows directory: C:\WINDOWS
    2011/02/28 22:24:53.0843 5464 Processor architecture: Intel x86
    2011/02/28 22:24:53.0843 5464 Number of processors: 2
    2011/02/28 22:24:53.0843 5464 Page size: 0x1000
    2011/02/28 22:24:53.0843 5464 Boot type: Normal boot
    2011/02/28 22:24:53.0843 5464 ================================================================================
    2011/02/28 22:24:54.0406 5464 Initialize success
    2011/02/28 22:24:58.0234 5084 ================================================================================
    2011/02/28 22:24:58.0234 5084 Scan started
    2011/02/28 22:24:58.0234 5084 Mode: Manual;
    2011/02/28 22:24:58.0234 5084 ================================================================================
    2011/02/28 22:25:01.0187 5084 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
    2011/02/28 22:25:01.0453 5084 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
    2011/02/28 22:25:01.0531 5084 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/02/28 22:25:01.0812 5084 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
    2011/02/28 22:25:01.0906 5084 ADIHdAudAddService (66614b9fdc7e74ab736a84d89f7b06b6) C:\WINDOWS\system32\drivers\ADIHdAud.sys
    2011/02/28 22:25:02.0046 5084 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
    2011/02/28 22:25:02.0296 5084 AEAudioService (03be587e90c8b37c7ff1fe2e9c1d1c90) C:\WINDOWS\system32\drivers\AEAudio.sys
    2011/02/28 22:25:02.0375 5084 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
    2011/02/28 22:25:02.0500 5084 AFD (6a0397376853e604de8e1e7a87fc08ac) C:\WINDOWS\System32\drivers\afd.sys
    2011/02/28 22:25:02.0812 5084 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
    2011/02/28 22:25:02.0859 5084 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
    2011/02/28 22:25:02.0906 5084 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
    2011/02/28 22:25:02.0968 5084 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
    2011/02/28 22:25:03.0218 5084 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
    2011/02/28 22:25:03.0281 5084 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
    2011/02/28 22:25:03.0343 5084 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
    2011/02/28 22:25:03.0390 5084 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
    2011/02/28 22:25:03.0453 5084 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
    2011/02/28 22:25:03.0640 5084 ANC (11ab185a7af224800bbfb5b836974a17) C:\WINDOWS\system32\drivers\ANC.SYS
    2011/02/28 22:25:03.0812 5084 AR5416 (6c21f270afec1e423c00e96d3bd234dc) C:\WINDOWS\system32\DRIVERS\athw.sys
    2011/02/28 22:25:04.0078 5084 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
    2011/02/28 22:25:04.0171 5084 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
    2011/02/28 22:25:04.0250 5084 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
    2011/02/28 22:25:04.0328 5084 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
    2011/02/28 22:25:04.0593 5084 Aspi32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\aspi32.sys
    2011/02/28 22:25:04.0687 5084 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/02/28 22:25:04.0765 5084 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/02/28 22:25:04.0875 5084 ati2mtag (e150424208c8a91deed8c45019a6cdd2) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
    2011/02/28 22:25:05.0187 5084 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/02/28 22:25:05.0281 5084 atmeltpm (dbf0d7e2df33b469eb55406fea759350) C:\WINDOWS\system32\DRIVERS\atmeltpm.sys
    2011/02/28 22:25:05.0375 5084 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/02/28 22:25:05.0593 5084 AVGIDSDriverxpx (97670687f6c8f35e7b611f2ce1f94472) C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys
    2011/02/28 22:25:05.0812 5084 AVGIDSErHrxpx (277fc6b0f0be23bae7e63f184034b2fe) C:\WINDOWS\system32\Drivers\AVGIDSxx.sys
    2011/02/28 22:25:05.0875 5084 AVGIDSFilterxpx (dba65f23b686bdf043bbb54e55c72887) C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys
    2011/02/28 22:25:06.0015 5084 AVGIDSShimxpx (a552461aab7a36c2465ff19e59af08bf) C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys
    2011/02/28 22:25:06.0078 5084 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\system32\Drivers\avgldx86.sys
    2011/02/28 22:25:06.0265 5084 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\system32\Drivers\avgmfx86.sys
    2011/02/28 22:25:06.0281 5084 AvgRkx86 (5bbcd8646074a3af4ee9b321d12c2b64) C:\WINDOWS\system32\Drivers\avgrkx86.sys
    2011/02/28 22:25:06.0359 5084 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\WINDOWS\system32\Drivers\avgtdix.sys
    2011/02/28 22:25:06.0421 5084 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/02/28 22:25:06.0531 5084 btaudio (3dc7b0c7be6164d3152513c0c208ad3b) C:\WINDOWS\system32\drivers\btaudio.sys
    2011/02/28 22:25:06.0734 5084 BTDriver (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
    2011/02/28 22:25:06.0796 5084 BthEnum (d24b8d1784c68a25060fffbe8ed34b76) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
    2011/02/28 22:25:06.0859 5084 BthPan (10355270be12641b9764235da39dcf0f) C:\WINDOWS\system32\DRIVERS\bthpan.sys
    2011/02/28 22:25:06.0968 5084 BTHPORT (95ef6f3f386d93ee1e4d9ca45a50252a) C:\WINDOWS\system32\Drivers\BTHport.sys
    2011/02/28 22:25:07.0187 5084 BTHUSB (f06d4cb9918b462a84d9ac00027efc30) C:\WINDOWS\system32\Drivers\BTHUSB.sys
    2011/02/28 22:25:07.0296 5084 BTKRNL (9f704f40cd50ae05bbfc492c0342e765) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
    2011/02/28 22:25:07.0375 5084 BTWDNDIS (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
    2011/02/28 22:25:07.0593 5084 BTWUSB (1166cb501e1c34750a91600579efeab3) C:\WINDOWS\system32\Drivers\btwusb.sys
    2011/02/28 22:25:07.0656 5084 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
    2011/02/28 22:25:07.0671 5084 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/02/28 22:25:07.0734 5084 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2011/02/28 22:25:07.0781 5084 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
    2011/02/28 22:25:07.0859 5084 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/02/28 22:25:08.0078 5084 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/02/28 22:25:08.0203 5084 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/02/28 22:25:08.0296 5084 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
    2011/02/28 22:25:08.0562 5084 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
    2011/02/28 22:25:08.0609 5084 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
    2011/02/28 22:25:08.0671 5084 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
    2011/02/28 22:25:08.0750 5084 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
    2011/02/28 22:25:08.0796 5084 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
    2011/02/28 22:25:09.0031 5084 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/02/28 22:25:09.0125 5084 DLABOIOM (35cbc02546335ea41a5d516da6626c8a) C:\WINDOWS\system32\DLA\DLABOIOM.SYS
    2011/02/28 22:25:09.0203 5084 DLACDBHM (ec6ae8bc9f773382d2eed49e4dfdae2a) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
    2011/02/28 22:25:09.0234 5084 DLADResN (19e3db16de2bb3db81b172a78d140b03) C:\WINDOWS\system32\DLA\DLADResN.SYS
    2011/02/28 22:25:09.0406 5084 DLAIFS_M (e4859ca5bd8412a9a60d62067a653522) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
    2011/02/28 22:25:09.0484 5084 DLAOPIOM (20c24a3d1cf0825487c93f806625805e) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
    2011/02/28 22:25:09.0609 5084 DLAPoolM (8a530da5dc81954bcf1966813f699b49) C:\WINDOWS\system32\DLA\DLAPoolM.SYS
    2011/02/28 22:25:09.0765 5084 DLARTL_N (0605b66052f82b6f07204dbdb61c13ff) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
    2011/02/28 22:25:09.0906 5084 DLAUDFAM (7eda68af6a91bf64af6f301e39928ebf) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
    2011/02/28 22:25:09.0968 5084 DLAUDF_M (a18423bbc6d92b01fdf3c51e7510ee70) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
    2011/02/28 22:25:10.0109 5084 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/02/28 22:25:10.0265 5084 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
    2011/02/28 22:25:10.0437 5084 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/02/28 22:25:10.0500 5084 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/02/28 22:25:10.0687 5084 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
    2011/02/28 22:25:10.0843 5084 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/02/28 22:25:10.0937 5084 DRVMCDB (48c7008d23dcfce0d0232f49307efced) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
    2011/02/28 22:25:11.0093 5084 DRVNDDM (05467e44a42c777dd1534bb4539b16d1) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
    2011/02/28 22:25:11.0281 5084 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
    2011/02/28 22:25:11.0453 5084 e1express (180b383bb935487e01ee6e4b50aa969e) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
    2011/02/28 22:25:11.0531 5084 EGATHDRV (938f1ec77ba35858248e584b2d2e9776) C:\WINDOWS\SYSTEM32\EGATHDRV.SYS
    2011/02/28 22:25:11.0703 5084 ENUM1394 (80d1b490b60e74e002dc116ec5d41748) C:\WINDOWS\system32\DRIVERS\enum1394.sys
    2011/02/28 22:25:11.0734 5084 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/02/28 22:25:11.0937 5084 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/02/28 22:25:12.0015 5084 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
    2011/02/28 22:25:12.0156 5084 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/02/28 22:25:12.0250 5084 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
    2011/02/28 22:25:12.0468 5084 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/02/28 22:25:12.0578 5084 FTD2XX (b907d2b20db2f6392995f5379e2a9666) C:\WINDOWS\system32\Drivers\FTD2XX.sys
    2011/02/28 22:25:12.0671 5084 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/02/28 22:25:12.0765 5084 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
    2011/02/28 22:25:12.0812 5084 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/02/28 22:25:13.0000 5084 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2011/02/28 22:25:13.0156 5084 HidCom (e77383ae71a1b5acb3e634f17fb0b700) C:\WINDOWS\system32\DRIVERS\HidCom.sys
    2011/02/28 22:25:13.0250 5084 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2011/02/28 22:25:13.0296 5084 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
    2011/02/28 22:25:13.0484 5084 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
    2011/02/28 22:25:13.0640 5084 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
    2011/02/28 22:25:13.0750 5084 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
    2011/02/28 22:25:13.0781 5084 HSFHWAZL (0aaef566e6782957252fa79f566fbc0b) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
    2011/02/28 22:25:14.0015 5084 HSF_DPV (e472e0cb4e716cc34c0e045f2c196221) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
    2011/02/28 22:25:14.0156 5084 HSXHWAZL (3af45f5b4157c88ffae24d89ba408302) C:\WINDOWS\system32\DRIVERS\hsxhwazl.sys
    2011/02/28 22:25:14.0281 5084 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/02/28 22:25:14.0453 5084 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
    2011/02/28 22:25:14.0578 5084 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
    2011/02/28 22:25:14.0656 5084 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/02/28 22:25:14.0765 5084 iaStor (309c4d86d989fb1fcf64bd30dc81c51b) C:\WINDOWS\system32\DRIVERS\iaStor.sys
    2011/02/28 22:25:15.0015 5084 IBMPMDRV (7285cd0c2b686e0590f941b48414a9f4) C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
    2011/02/28 22:25:15.0062 5084 IBMTPCHK (3a7dbe81ec5edb96a0a61c7d4af3198d) C:\WINDOWS\system32\Drivers\IBMBLDID.sys
    2011/02/28 22:25:15.0187 5084 Imapi (12c59b8929121ace2f55acc86682cf12) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/02/28 22:25:15.0265 5084 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
    2011/02/28 22:25:15.0343 5084 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
    2011/02/28 22:25:15.0531 5084 intelppm (db8a1859cf9e48914dcc0a7206d87be5) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/02/28 22:25:15.0640 5084 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
    2011/02/28 22:25:15.0703 5084 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/02/28 22:25:15.0765 5084 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/02/28 22:25:15.0828 5084 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/02/28 22:25:16.0062 5084 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/02/28 22:25:16.0140 5084 irda (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys
    2011/02/28 22:25:16.0171 5084 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/02/28 22:25:16.0250 5084 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/02/28 22:25:16.0312 5084 Iviaspi (f59c3569a2f2c464bb78cb1bdcdca55e) C:\WINDOWS\system32\drivers\iviaspi.sys
    2011/02/28 22:25:16.0500 5084 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/02/28 22:25:16.0593 5084 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/02/28 22:25:16.0687 5084 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/02/28 22:25:16.0765 5084 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
    2011/02/28 22:25:16.0953 5084 mlmmpwdm (94295f30a49041a8c102d6f102a1664d) C:\WINDOWS\system32\Drivers\mlmmpwdm.sys
    2011/02/28 22:25:17.0125 5084 mlnmtwdm (928969e43c27b5d8ee262ca67f8afd8d) C:\WINDOWS\system32\Drivers\mlnmtwdm.sys
    2011/02/28 22:25:17.0156 5084 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/02/28 22:25:17.0187 5084 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
    2011/02/28 22:25:17.0265 5084 motccgp (a10fa04b73a9d97e5cf77eb1d5a88165) C:\WINDOWS\system32\DRIVERS\motccgp.sys
    2011/02/28 22:25:17.0375 5084 motccgpfl (aad6191a4daa519f04ab12b2af73e356) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
    2011/02/28 22:25:17.0406 5084 motmodem (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motmodem.sys
    2011/02/28 22:25:17.0500 5084 motport (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motport.sys
    2011/02/28 22:25:17.0656 5084 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/02/28 22:25:17.0734 5084 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2011/02/28 22:25:17.0750 5084 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/02/28 22:25:17.0828 5084 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
    2011/02/28 22:25:17.0890 5084 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/02/28 22:25:18.0125 5084 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/02/28 22:25:18.0281 5084 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/02/28 22:25:18.0359 5084 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/02/28 22:25:18.0500 5084 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/02/28 22:25:18.0546 5084 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/02/28 22:25:18.0609 5084 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/02/28 22:25:18.0734 5084 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
    2011/02/28 22:25:18.0843 5084 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/02/28 22:25:19.0046 5084 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2011/02/28 22:25:19.0156 5084 NDIS (bc84c4f67d0e880b0c46dc0ce2b8cbaa) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/02/28 22:25:19.0250 5084 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2011/02/28 22:25:19.0312 5084 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/02/28 22:25:19.0437 5084 Ndisuio (8d3ce6b579cde8d37acc690b67dc2106) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/02/28 22:25:19.0500 5084 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/02/28 22:25:19.0625 5084 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/02/28 22:25:19.0687 5084 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/02/28 22:25:19.0765 5084 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/02/28 22:25:19.0953 5084 NIC1394 (e1532ad506e0e874d1e6b4581c4f64ae) C:\WINDOWS\system32\DRIVERS\nic1394.sys
    2011/02/28 22:25:20.0046 5084 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/02/28 22:25:20.0140 5084 NSCIRDA (6216798d29c3ba9d0d6f40bbbab694a5) C:\WINDOWS\system32\DRIVERS\nscirda.sys
    2011/02/28 22:25:20.0234 5084 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/02/28 22:25:20.0375 5084 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/02/28 22:25:20.0484 5084 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/02/28 22:25:20.0718 5084 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/02/28 22:25:21.0046 5084 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/02/28 22:25:21.0296 5084 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
    2011/02/28 22:25:21.0656 5084 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
    2011/02/28 22:25:21.0984 5084 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
    2011/02/28 22:25:22.0281 5084 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
    2011/02/28 22:25:22.0609 5084 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
    2011/02/28 22:25:22.0796 5084 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/02/28 22:25:22.0859 5084 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/02/28 22:25:22.0953 5084 PCASp50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\WINDOWS\system32\Drivers\PCASp50.sys
    2011/02/28 22:25:23.0046 5084 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/02/28 22:25:23.0125 5084 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/02/28 22:25:23.0281 5084 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
    2011/02/28 22:25:23.0484 5084 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
    2011/02/28 22:25:23.0609 5084 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
    2011/02/28 22:25:23.0687 5084 PLCNDIS5 (9fa04a9accc08030d87168b5559a4869) C:\WINDOWS\system32\PLCNDIS5.SYS
    2011/02/28 22:25:23.0859 5084 pmem (dedef40e1d05842639491365cb2c069e) C:\WINDOWS\System32\drivers\pmemnt.sys
    2011/02/28 22:25:24.0156 5084 pnetmdm (da19e3401f39c10df193be029c7e7bba) C:\WINDOWS\system32\DRIVERS\pnetmdm.sys
    2011/02/28 22:25:24.0218 5084 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/02/28 22:25:24.0390 5084 Processor (9e372a156f92425a1904b84589093a37) C:\WINDOWS\system32\DRIVERS\processr.sys
    2011/02/28 22:25:24.0468 5084 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/02/28 22:25:24.0484 5084 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/02/28 22:25:24.0625 5084 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2011/02/28 22:25:24.0687 5084 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
    2011/02/28 22:25:24.0812 5084 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
    2011/02/28 22:25:24.0875 5084 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
    2011/02/28 22:25:24.0968 5084 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
    2011/02/28 22:25:25.0046 5084 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
    2011/02/28 22:25:25.0109 5084 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/02/28 22:25:25.0203 5084 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
    2011/02/28 22:25:25.0281 5084 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/02/28 22:25:25.0312 5084 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/02/28 22:25:25.0406 5084 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/02/28 22:25:25.0515 5084 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/02/28 22:25:25.0609 5084 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/02/28 22:25:25.0687 5084 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/02/28 22:25:25.0718 5084 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/02/28 22:25:25.0875 5084 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/02/28 22:25:26.0000 5084 RFCOMM (99c4b74981a1413f142a3903130088cb) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
    2011/02/28 22:25:26.0062 5084 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
    2011/02/28 22:25:26.0093 5084 s24trans (87940243ea2ad3ebe274f5409c5e9072) C:\WINDOWS\system32\DRIVERS\s24trans.sys
    2011/02/28 22:25:26.0187 5084 sbp2port (3e2c3b180872be4120f246d85560b734) C:\WINDOWS\system32\DRIVERS\sbp2port.sys
    2011/02/28 22:25:26.0218 5084 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/02/28 22:25:26.0375 5084 Ser2pl (95eeb5a6843238c829aaa9c05168c09c) C:\WINDOWS\system32\DRIVERS\ser2pl.sys
    2011/02/28 22:25:26.0468 5084 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2011/02/28 22:25:26.0625 5084 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
    2011/02/28 22:25:26.0687 5084 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
    2011/02/28 22:25:26.0765 5084 ShockMgr (1a9b76c8e0d77bcaca24fdf36781b59d) C:\WINDOWS\system32\drivers\ShockMgr.sys
    2011/02/28 22:25:26.0890 5084 Shockprf (cb0c065af3ac9ac307408ea021cdd20e) C:\WINDOWS\system32\drivers\Shockprf.sys
    2011/02/28 22:25:27.0093 5084 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
    2011/02/28 22:25:27.0156 5084 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2011/02/28 22:25:27.0218 5084 Smapint (26341d0dd225d19fd50e0ee3c3c77502) C:\WINDOWS\system32\drivers\Smapint.sys
    2011/02/28 22:25:27.0375 5084 smihlp (0b9c01236d25bdcb37aa79dc59dfb7d3) C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys
    2011/02/28 22:25:27.0546 5084 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
    2011/02/28 22:25:27.0656 5084 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
    2011/02/28 22:25:27.0703 5084 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/02/28 22:25:27.0765 5084 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/02/28 22:25:27.0875 5084 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/02/28 22:25:28.0187 5084 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
    2011/02/28 22:25:28.0296 5084 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2011/02/28 22:25:28.0359 5084 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/02/28 22:25:28.0406 5084 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/02/28 22:25:28.0546 5084 swmx01 (e04b2937dcddab8fe1ea413284ccabce) C:\WINDOWS\system32\DRIVERS\swmx01.sys
    2011/02/28 22:25:28.0687 5084 SWNC5E01 (6afe9a256c21fb32f9047cde1f6f426a) C:\WINDOWS\system32\DRIVERS\SWNC5E01.sys
    2011/02/28 22:25:28.0781 5084 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
    2011/02/28 22:25:28.0859 5084 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
    2011/02/28 22:25:28.0875 5084 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
    2011/02/28 22:25:28.0984 5084 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
    2011/02/28 22:25:29.0031 5084 SynTP (7c02db7416d52c02b131d0e3a8d2337c) C:\WINDOWS\system32\DRIVERS\SynTP.sys
    2011/02/28 22:25:29.0140 5084 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/02/28 22:25:29.0218 5084 Tcpip (744e57c99232201ae98c49168b918f48) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/02/28 22:25:29.0390 5084 TcUsb (64abea4001f8eb869385e65d85bc302b) C:\WINDOWS\system32\Drivers\tcusb.sys
    2011/02/28 22:25:29.0531 5084 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/02/28 22:25:29.0593 5084 TDSMAPI (564b337034271b7bddcabfddc91c6b7a) C:\WINDOWS\system32\drivers\TDSMAPI.SYS
    2011/02/28 22:25:29.0812 5084 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/02/28 22:25:29.0937 5084 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/02/28 22:25:30.0000 5084 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
    2011/02/28 22:25:30.0046 5084 TPHKDRV (8aef2188630f5ecd79ad9abba630630b) C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys
    2011/02/28 22:25:30.0109 5084 TPPWRIF (44672de6cea9569c21c4b7a8d2560750) C:\WINDOWS\system32\drivers\Tppwrif.sys
    2011/02/28 22:25:30.0250 5084 tvtfilter (49258a02a1e8d304ed88b0f1c56b1738) C:\WINDOWS\system32\DRIVERS\tvtfilter.sys
    2011/02/28 22:25:30.0312 5084 TVTI2C (7e66dda1ef146bfc3a6e36e08e036602) C:\WINDOWS\system32\DRIVERS\Tvti2c.sys
    2011/02/28 22:25:30.0421 5084 TVTPktFilter (6c60a5209be2fa1f94bb98a056418f66) C:\WINDOWS\system32\DRIVERS\tvtpktfilter.sys
    2011/02/28 22:25:30.0468 5084 tvtumon (930b8b8ef659a714cf1c755928b8850c) C:\WINDOWS\system32\DRIVERS\tvtumon.sys
    2011/02/28 22:25:30.0578 5084 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/02/28 22:25:30.0609 5084 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
    2011/02/28 22:25:30.0671 5084 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/02/28 22:25:30.0875 5084 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
    2011/02/28 22:25:31.0125 5084 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
    2011/02/28 22:25:31.0156 5084 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/02/28 22:25:31.0203 5084 usbehci (b0d7020386c7187ef9c5a9643f289cd3) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/02/28 22:25:31.0343 5084 usbhub (d31e07bf822c7f2bd32714e9ddca8be2) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/02/28 22:25:31.0390 5084 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2011/02/28 22:25:31.0593 5084 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2011/02/28 22:25:31.0671 5084 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/02/28 22:25:31.0703 5084 usbuhci (ff6e4fdeb82dc228efa490336409c6bd) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/02/28 22:25:31.0812 5084 usbvideo (8968ff3973a883c49e8b564200f565b9) C:\WINDOWS\system32\Drivers\usbvideo.sys
    2011/02/28 22:25:31.0875 5084 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
    2011/02/28 22:25:32.0015 5084 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
    2011/02/28 22:25:32.0093 5084 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
    2011/02/28 22:25:32.0187 5084 vmm (e41fef9e3056fe88c71e411f705be41e) C:\WINDOWS\system32\Drivers\vmm.sys
    2011/02/28 22:25:32.0265 5084 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/02/28 22:25:32.0296 5084 VPCNetS2 (f96a678debdccb0b4bb7f38cb2580589) C:\WINDOWS\system32\DRIVERS\VMNetSrv.sys
    2011/02/28 22:25:32.0343 5084 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/02/28 22:25:32.0484 5084 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
    2011/02/28 22:25:32.0546 5084 wceusbsh (b85b448fd2c398970382a28e47cf4bc6) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
    2011/02/28 22:25:32.0656 5084 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2011/02/28 22:25:32.0765 5084 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/02/28 22:25:32.0875 5084 winachsf (0e666ac2766f2fd860cc03f405a2ace1) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
    2011/02/28 22:25:33.0046 5084 WinUSB (fd600b032e741eb6aab509fc630f7c42) C:\WINDOWS\system32\DRIVERS\WinUSB.sys
    2011/02/28 22:25:33.0156 5084 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    2011/02/28 22:25:33.0234 5084 Wpsnuio (904571ee28f8f7d98b3ef1635a77c6d4) C:\WINDOWS\system32\DRIVERS\wpsnuio.sys
    2011/02/28 22:25:33.0343 5084 WSIMD (21ac4f228f3d36876a42277c76a766c0) C:\WINDOWS\system32\DRIVERS\wsimd.sys
    2011/02/28 22:25:33.0484 5084 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2011/02/28 22:25:33.0656 5084 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2011/02/28 22:25:33.0734 5084 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2011/02/28 22:25:33.0796 5084 zumbus (763ac56e714907e9d420b9ab694f7b18) C:\WINDOWS\system32\DRIVERS\zumbus.sys
    2011/02/28 22:25:33.0921 5084 ================================================================================
    2011/02/28 22:25:33.0921 5084 Scan finished
    2011/02/28 22:25:33.0921 5084 ================================================================================
     
  12. billtest

    billtest TS Rookie Topic Starter

    MBR log

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x00000004

    Kernel Drivers (total 190):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806E3000 \WINDOWS\system32\hal.dll
    0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
    0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
    0xB9F79000 ACPI.sys
    0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xB9F68000 pci.sys
    0xBA0A8000 isapnp.sys
    0xBA4BC000 compbatt.sys
    0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xBA670000 pciide.sys
    0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xB9F4A000 pcmcia.sys
    0xBA0B8000 MountMgr.sys
    0xB9F2B000 ftdisk.sys
    0xBA5AC000 dmload.sys
    0xB9F05000 dmio.sys
    0xBA330000 PartMgr.sys
    0xBA4C4000 ACPIEC.sys
    0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xB9EEF000 Shockprf.sys
    0xBA0C8000 VolSnap.sys
    0xB9ED7000 atapi.sys
    0xB9E01000 iaStor.sys
    0xBA0D8000 disk.sys
    0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xB9DE1000 fltMgr.sys
    0xB9DCF000 sr.sys
    0xB9DB9000 DRVMCDB.SYS
    0xBA0F8000 PxHelp20.sys
    0xB9DA2000 KSecDD.sys
    0xB9D8F000 WudfPf.sys
    0xB9D02000 Ntfs.sys
    0xB9CD5000 NDIS.sys
    0xBA108000 sbp2port.sys
    0xBA118000 ohci1394.sys
    0xBA128000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xB9CBA000 Mup.sys
    0xBA138000 avgrkx86.sys
    0xBA148000 AVGIDSxx.sys
    0xB984F000 \SystemRoot\System32\Drivers\ks.sys
    0xB983E000 \SystemRoot\System32\Drivers\mlnmtwdm.sys
    0xBA428000 \SystemRoot\System32\Drivers\TDI.SYS
    0xB9A7E000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xB9686000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xB9672000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xB964D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0xB94C7000 \SystemRoot\system32\DRIVERS\athw.sys
    0xBA440000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xB94A4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xBA448000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xB9A6E000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xBA450000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xB9478000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xBA60A000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xBA458000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xBA460000 \SystemRoot\system32\DRIVERS\atmeltpm.sys
    0xB9C59000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xBA468000 \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
    0xB9387000 \SystemRoot\system32\DRIVERS\btkrnl.sys
    0xB9A5E000 \SystemRoot\system32\DRIVERS\VMNetSrv.sys
    0xBA60C000 \SystemRoot\system32\DRIVERS\serscan.sys
    0xBA470000 \SystemRoot\system32\DRIVERS\tvtpktfilter.sys
    0xBA710000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xBA478000 \SystemRoot\system32\DRIVERS\rasirda.sys
    0xBA188000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xB9C4D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xB9370000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xBA198000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xBA1A8000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xB935F000 \SystemRoot\system32\DRIVERS\psched.sys
    0xBA1B8000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xBA480000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xBA488000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xBA490000 \SystemRoot\system32\DRIVERS\wanatw4.sys
    0xB9C49000 \SystemRoot\system32\DRIVERS\pnetmdm.sys
    0xBA498000 \SystemRoot\System32\Drivers\Modem.SYS
    0xB932E000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xBA1C8000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xBA4A0000 \SystemRoot\system32\DRIVERS\Tvti2c.sys
    0xBA60E000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xB92D5000 \SystemRoot\system32\DRIVERS\update.sys
    0xB98B8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xBA1D8000 \SystemRoot\system32\DRIVERS\zumbus.sys
    0xBA1E8000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
    0xB9259000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
    0xBA1F8000 \SystemRoot\system32\DRIVERS\wsimd.sys
    0xBA4B0000 \SystemRoot\system32\DRIVERS\btport.sys
    0xBA238000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xB0D40000 \SystemRoot\system32\drivers\ADIHdAud.sys
    0xB0C9B000 \SystemRoot\system32\drivers\portcls.sys
    0xBA308000 \SystemRoot\system32\drivers\drmk.sys
    0xB0C84000 \SystemRoot\system32\drivers\AEAudio.sys
    0xB0C50000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
    0xB0B5E000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
    0xB0AAB000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xB9AAE000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xBA63C000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xB0E52000 \SystemRoot\system32\DRIVERS\tvtumon.sys
    0xBA63E000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
    0xBA640000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xBA6C7000 \SystemRoot\System32\Drivers\Null.SYS
    0xBA642000 \SystemRoot\System32\Drivers\Beep.SYS
    0xBA3B8000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
    0xBA3C0000 \SystemRoot\System32\drivers\vga.sys
    0xBA644000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xBA646000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xBA3C8000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xBA3D0000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xB9C96000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xB096D000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xB0914000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xB08DA000 \SystemRoot\System32\Drivers\avgtdix.sys
    0xB08B9000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xB0E32000 \SystemRoot\System32\Drivers\tcusb.sys
    0xB0891000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xB086F000 \SystemRoot\System32\drivers\afd.sys
    0xB0E22000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xB0834000 \??\C:\WINDOWS\system32\Drivers\vmm.sys
    0xBA3E0000 \SystemRoot\System32\drivers\Tppwrif.sys
    0xBA3E8000 \SystemRoot\system32\DRIVERS\TPHKDRV.sys
    0xBA3F0000 \SystemRoot\System32\drivers\TDSMAPI.SYS
    0xBA3F8000 \SystemRoot\System32\drivers\Smapint.sys
    0xBA64E000 \SystemRoot\System32\Drivers\ShockMgr.SYS
    0xB0799000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xB072A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xBA652000 \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys
    0xB0DD2000 \SystemRoot\System32\Drivers\Fips.SYS
    0xBA408000 \SystemRoot\System32\Drivers\avgmfx86.sys
    0xB06F6000 \SystemRoot\System32\Drivers\avgldx86.sys
    0xBA568000 \SystemRoot\System32\drivers\ANC.SYS
    0xB0616000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xBA5CC000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xBA59C000 \SystemRoot\System32\drivers\Dxapi.sys
    0xBA368000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xBA690000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF055000 \SystemRoot\System32\ati2cqag.dll
    0xBF09C000 \SystemRoot\System32\atikvmag.dll
    0xBF0E2000 \SystemRoot\System32\ati3duag.dll
    0xBF32D000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xBA278000 \SystemRoot\system32\DRIVERS\tvtfilter.sys
    0xBA2C8000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
    0xBA7FD000 \SystemRoot\System32\DLA\DLADResN.SYS
    0xAE360000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
    0xAE3F6000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
    0xBA5E0000 \SystemRoot\System32\DLA\DLAPoolM.SYS
    0xBA5E2000 \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys
    0xB07F4000 \SystemRoot\System32\DLA\DLABOIOM.SYS
    0xAE320000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
    0xAE30A000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
    0xAE204000 \SystemRoot\system32\DRIVERS\irda.sys
    0xAE1EE000 \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    0xB0686000 \SystemRoot\system32\DRIVERS\nwlnknb.sys
    0xAE37A000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xAE354000 \SystemRoot\system32\DRIVERS\s24trans.sys
    0xAE350000 \SystemRoot\system32\DRIVERS\wpsnuio.sys
    0xAE036000 \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys
    0xADFCE000 \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys
    0xADDDE000 \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys
    0xBA438000 \SystemRoot\System32\Drivers\TDTCP.SYS
    0xADC2B000 \SystemRoot\System32\Drivers\RDPWD.SYS
    0xADB87000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xB07C4000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xBA420000 \SystemRoot\System32\drivers\aspi32.sys
    0xBA5B4000 \??\C:\WINDOWS\SYSTEM32\EGATHDRV.SYS
    0xACBBC000 \SystemRoot\system32\DRIVERS\srv.sys
    0xACD93000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xACED3000 \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    0xBA5F0000 \??\C:\WINDOWS\System32\drivers\pmemnt.sys
    0xAC607000 \SystemRoot\system32\drivers\wdmaud.sys
    0xAC794000 \SystemRoot\system32\drivers\sysaudio.sys
    0xAC250000 \SystemRoot\System32\Drivers\HTTP.sys
    0xAC569000 \SystemRoot\System32\Drivers\PCASp50.sys
    0xAB860000 \??\C:\DOCUME~1\BILLBO~1\LOCALS~1\Temp\awtdqpow.sys
    0xAB83D000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xAC571000 \??\C:\DOCUME~1\BILLBO~1\LOCALS~1\Temp\mbr.sys
    0xAB55F000 \SystemRoot\system32\DRIVERS\asyncmac.sys
    0x8BE87000 \SystemRoot\system32\DRIVERS\e1e5132.sys
    0xABB20000 \SystemRoot\System32\Drivers\btwusb.sys
    0x8BD91000 \SystemRoot\system32\DRIVERS\swmx01.sys
    0x92A19000 \SystemRoot\system32\drivers\btaudio.sys
    0x8C0C7000 \SystemRoot\system32\DRIVERS\SWNC5E01.sys
    0xBA388000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0x8C0D9000 \SystemRoot\system32\drivers\kmixer.sys
    0x9294D000 \SystemRoot\system32\drivers\klmd.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 109):
    0 System Idle Process
    4 System
    1428 C:\WINDOWS\system32\smss.exe
    1536 csrss.exe
    1564 C:\WINDOWS\system32\winlogon.exe
    1608 C:\WINDOWS\system32\services.exe
    1620 C:\WINDOWS\system32\lsass.exe
    1800 C:\WINDOWS\system32\ibmpmsvc.exe
    1832 C:\WINDOWS\system32\ati2evxx.exe
    1852 C:\WINDOWS\system32\svchost.exe
    1908 svchost.exe
    1948 C:\WINDOWS\system32\svchost.exe
    1988 C:\WINDOWS\system32\svchost.exe
    160 C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
    588 svchost.exe
    672 svchost.exe
    696 C:\WINDOWS\system32\ati2evxx.exe
    708 C:\Program Files\AVG\AVG9\avgchsvx.exe
    716 C:\Program Files\AVG\AVG9\avgrsx.exe
    1272 C:\Program Files\AVG\AVG9\avgcsrvx.exe
    1472 C:\WINDOWS\system32\spoolsv.exe
    1484 C:\WINDOWS\system32\rundll32.exe
    1180 svchost.exe
    1172 C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
    1740 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    1140 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
    2064 C:\WINDOWS\system32\acs.exe
    2104 C:\WINDOWS\system32\svchost.exe
    2116 C:\Program Files\Common Files\aol\acs\AOLacsd.exe
    2220 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    2312 C:\Program Files\AVG\AVG9\avgwdsvc.exe
    2368 C:\Program Files\Bonjour\mDNSResponder.exe
    2396 svchost.exe
    2424 C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    2540 C:\Program Files\AVG\AVG9\avgam.exe
    2576 C:\Program Files\AVG\AVG9\avgnsx.exe
    2584 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    2800 PresentationFontCache.exe
    2992 C:\WINDOWS\system32\svchost.exe
    3008 C:\Program Files\Java\jre6\bin\jqs.exe
    3052 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    3144 C:\WINDOWS\system32\svchost.exe
    3212 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    3248 C:\WINDOWS\system32\svchost.exe
    3272 C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
    3308 C:\WINDOWS\system32\TPHDEXLG.exe
    3340 C:\WINDOWS\system32\TpKmpSvc.exe
    3372 C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
    3396 C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
    3424 C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
    3468 C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
    3500 C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
    3564 C:\WINDOWS\system32\UTSCSI.EXE
    3592 C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
    3620 C:\Program Files\Lenovo\System Update\SUService.exe
    3888 C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
    416 alg.exe
    1456 C:\WINDOWS\explorer.exe
    2320 C:\WINDOWS\system32\rundll32.exe
    3140 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    3240 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2288 C:\PROGRA~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE
    2484 C:\WINDOWS\system32\TpShocks.exe
    2500 C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
    2636 C:\Program Files\Analog Devices\Core\smax4pnp.exe
    1260 C:\WINDOWS\system32\wuauclt.exe
    1452 C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    1376 C:\Program Files\Lenovo\ZOOM\TpScrex.exe
    644 C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
    3064 C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.EXE
    1972 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    3112 C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
    3748 C:\WINDOWS\system32\DLA\DLACTRLW.EXE
    3780 C:\Program Files\Common Files\Installshield\UpdateService\issch.exe
    3820 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    3752 C:\WINDOWS\system32\rundll32.exe
    3760 C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe
    192 C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe
    1136 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
    168 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2028 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    560 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
    1524 C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
    3992 C:\PROGRA~1\AVG\AVG9\avgtray.exe
    4156 C:\Program Files\iTunes\iTunesHelper.exe
    4168 C:\WINDOWS\system32\ctfmon.exe
    5092 C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    5140 C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
    5148 C:\Program Files\Digital Line Detect\DLG.exe
    5268 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    3828 C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
    4816 C:\Program Files\iPod\bin\iPodService.exe
    4428 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    4152 C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
    1612 C:\Program Files\AVG\AVG9\avgcsrvx.exe
    4940 C:\WINDOWS\system32\WISPTIS.EXE
    7908 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    5520 C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe
    6436 C:\Program Files\Internet Explorer\iexplore.exe
    8172 C:\Program Files\Internet Explorer\iexplore.exe
    5264 C:\Program Files\Internet Explorer\iexplore.exe
    7420 C:\Program Files\Internet Explorer\iexplore.exe
    512 C:\WINDOWS\system32\svchost.exe
    6940 C:\Program Files\Internet Explorer\iexplore.exe
    6424 C:\WINDOWS\explorer.exe
    4952 C:\Documents and Settings\Bill Borkan\My Documents\tdsskiller\TDSSKiller.exe
    7128 C:\WINDOWS\system32\notepad.exe
    7936 C:\Program Files\Internet Explorer\iexplore.exe
    5260 C:\Documents and Settings\Bill Borkan\My Documents\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: TOSHIBAMK1234GSX, Rev: AH002E

    Size Device Name MBR Status
    --------------------------------------------
    111 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: BBF289AC40BA09F2CC1797655D4799D2AB148CB5


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    Options:
    [1] Dump the MBR of a physical disk to file.
    [2] Restore the MBR of a physical disk with a standard boot code.
    [3] Exit.

    Enter your choice:

    Done!
     
  13. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  14. billtest

    billtest TS Rookie Topic Starter

    Combofix

    Cannot run Combofix because I have AVG installed and no longer have the disks and misplaced the codes so I don't can't uninstall and reinstall.
    I can shut down resident and online shield.

    Is there another tool I can use?

    Thanks,

    Bill
     
  15. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    You have to uninstall AVG.
    You can replace it with one of couple of other AV programs.
    I stopped recommending AVG quite some time ago anyway.
     
  16. billtest

    billtest TS Rookie Topic Starter

    Have license through next year - AVG business edition.
    Is there no other tool we can use?
     
  17. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Not really.
    You can contact AVG and if you have a proof of purchase, they'll send you a copy of your license number.
     
  18. billtest

    billtest TS Rookie Topic Starter

    Used ASP

    Downloaded advances System Protector for free.
    Ran scan and log attached.

    Seems like problem may be resolved. Do you see things that could have caused it in this log?
    Might this be a good alternative for others like me that don't want to uninstall and reinstall AVG?

    Thanks,
    Bill
    Start Time: Mar 02, 2011 at 10:27:28 AM End Time: Mar 02, 2011 at 12:09:46 PM



    Cookie.Tracking-Cookie (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@ad.yieldmanager[2].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@ads.pointroll[2].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@apmebf[1].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@atwola[1].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@xiti[1].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@xiti[2].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@zedo[2].txt


    --------------------------------------------------------------------------------

    Cookie.BS.Serving-Sys (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@bs.serving-sys[1].txt


    --------------------------------------------------------------------------------

    Cookie.casalemedia.com (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@casalemedia[1].txt


    --------------------------------------------------------------------------------

    Cookie.Citi.BridgeTrack (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@citi.bridgetrack[1].txt


    --------------------------------------------------------------------------------

    Cookie.DoubleClick (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@doubleclick[1].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@doubleclick[3].txt


    --------------------------------------------------------------------------------

    Cookie.LookSmart (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@looksmart[1].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@looksmart[2].txt


    --------------------------------------------------------------------------------

    Cookie.Mediaplex.com (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@mediaplex[1].txt


    --------------------------------------------------------------------------------

    Cookie.PriceGrabber (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@pricegrabber[2].txt


    --------------------------------------------------------------------------------

    Cookie.QuestionMarket.com (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@questionmarket[1].txt


    --------------------------------------------------------------------------------

    Cookie.SmartAdServer.com (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@smartadserver[2].txt


    --------------------------------------------------------------------------------

    Cookie.Statcounter (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@statcounter[1].txt


    --------------------------------------------------------------------------------

    Cookie.SuperStats (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@superstats[1].txt


    --------------------------------------------------------------------------------

    Cookie.Travelocity.com (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@travelocity[2].txt
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@www.travelocity[1].txt


    --------------------------------------------------------------------------------

    Cookie.TribalFusion.com (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@tribalfusion[2].txt


    --------------------------------------------------------------------------------

    Cookie.USPS (Tracking Cookies)
    Status : Quarantined

    Infected Cookies
    C:\Documents and Settings\Bill Borkan\Cookies\bill_borkan@usps[1].txt


    --------------------------------------------------------------------------------

    Trojan.Agent.eml (Trojan)
    Status : Quarantined

    Infected files detected

    FileName: c:\windows\system32\acs.exe
    MD5: 5ea84d39320db122e84dba2ebe909c9c (475220 Bytes)
    Signature:
    Infected registry keys/values detected
    hkey_local_machine\system\currentcontrolset\services\acs\imagepath


    --------------------------------------------------------------------------------

    Monitoring.watch-right (Monitoring Tool)
    Status : Quarantined

    Infected files detected

    FileName: c:\windows\system32\ffjmpweb.dll
    MD5: 954aaf35d7e0c406594a1fdb8650862a (30720 Bytes)
    Signature:
    Infected registry keys/values detected
    hkey_local_machine\software\microsoft\windows\currentversion\shareddlls\c:\windows\system32\ffjmpweb.dll


    --------------------------------------------------------------------------------

    Trojan-Downloader.zlob.pmm (Trojan-Downloader)
    Status : Quarantined

    Infected files detected

    FileName: c:\program files\dbxanalyzer\uninstall.exe
    MD5: a9452c4c7e103604976a48c48e167ec8 (80375 Bytes)
    Signature:
    Infected registry keys/values detected
    hkey_local_machine\software\microsoft\windows\currentversion\uninstall\dbxanalyzer\uninstallstring


    --------------------------------------------------------------------------------

    RCS.Remote-Support-System (Remote Control Tool)
    Status : Quarantined

    Infected files detected

    FileName: c:\program files\lenovo\system update\7za.exe
    MD5: d9826ed773d07813bf9f5ee4974d640e (487936 Bytes)
    Signature:


    --------------------------------------------------------------------------------

    Trojan-Backdoor.radmin.aj (Backdoor)
    Status : Quarantined

    Infected files detected

    FileName: c:\program files\winmpg videoconvert\flv\bugrpt.dll
    MD5: 8282572f917cd199524bd1030bcbfb5b (49152 Bytes)
    Signature:


    --------------------------------------------------------------------------------

    Adware.onestep.c (Adware)
    Status : Quarantined

    Infected files detected

    FileName: c:\windows\system32\config\systemprofile\application data\microsoft\cryptneturlcache\content\486cc6afd08942336c61fcd401c4a1d1
    MD5: 771f46749e88be3cd6b194422cdfbd88 (979701 Bytes)
    Signature:

    FileName: c:\windows\system32\config\systemprofile\application data\microsoft\cryptneturlcache\content\74bfd122c0875ec75dbe5c6db4c59019
    MD5: 032111ce43c2c43caa6d77a417ae5448 (476444 Bytes)
    Signature:

    FileName: c:\windows\system32\config\systemprofile\application data\microsoft\cryptneturlcache\metadata\486cc6afd08942336c61fcd401c4a1d1
    MD5: 90f0490d3cdeca9866481b95d369d199 (120 Bytes)
    Signature:

    FileName: c:\windows\system32\config\systemprofile\application data\microsoft\cryptneturlcache\metadata\74bfd122c0875ec75dbe5c6db4c59019
    MD5: 9843b0d7dce1fe58a8b6a21b93cad8f8 (124 Bytes)
    Signature:


    --------------------------------------------------------------------------------

    Trojan-Backdoor.agent.rev (Backdoor)
    Status : Quarantined

    Infected files detected

    FileName: c:\windows\system32\wbem\autorecover\23bde61f1f4face17e9b0c01f2a1fd9b.mof
    MD5: 5e221f2b645fb0afdc3071ef7c6a5c25 (32872 Bytes)
    Signature:

    FileName: c:\windows\system32\wbem\autorecover\c8463ecbe33bc240263a0b094e46d510.mof
    MD5: 034a2302f68bf59f4ce451dcdbd69370 (2570652 Bytes)
    Signature:
     
  19. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    System Protector is a rogue program.

    Since you're trying to do things on your own, your way, I can't help you anymore.

    Good luck.
     
  20. billtest

    billtest TS Rookie Topic Starter

    Brioni -
    That isn't very sociable. I just don't want to lose my AVG subscription.
    Probably others have the same problem. Can't you help us
    with a reasonable alternative please.

    Thanks,

    Bill
     
  21. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    I'm not the one, who infected your computer.

    You're the very first one, who resist to uninstall AVG.

    Combofix is a very crucial tool in malware removal and it has to be run.

    I stopped recommending AVG long time ago and AVG conflicting with running Combofix is the latest reason, why I don't recommend AVG anymore.

    I gave you options what to do. Contact AVG, or switch to some other security program.

    The decision is yours and I'm not going to go back and forth with you over something what has to be done, if you want to clean your computer.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...