TechSpot

Virus disabling AV - 8 steps followed

By nismo400r
Dec 8, 2010
  1. Had to split the post as the GMEr log was too long, I did not click "show all"

    Malwarebytes' Anti-Malware 1.50
    www.malwarebytes.org

    Database version: 5274

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    12/8/2010 6:16:20 PM
    mbam-log-2010-12-08 (18-16-20).txt

    Scan type: Quick scan
    Objects scanned: 152332
    Time elapsed: 5 minute(s), 13 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-05.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 9/10/2004 8:03:15 PM
    System Uptime: 12/8/2010 6:03:24 PM (3 hours ago)

    Motherboard: Dell Inc. | | 0J3492
    Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 145 GiB total, 15.521 GiB free.
    D: is CDROM (UDF)
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP2075: 11/18/2010 12:21:38 AM - System Checkpoint
    RP2076: 11/19/2010 1:17:49 AM - System Checkpoint
    RP2077: 11/24/2010 2:32:47 AM - System Checkpoint
    RP2078: 11/26/2010 12:27:26 PM - Spybot-S&D Spyware removal
    RP2079: 11/30/2010 6:30:50 PM - Spybot-S&D Spyware removal
    RP2080: 12/1/2010 7:11:32 AM - Spybot-S&D Spyware removal
    RP2081: 12/1/2010 7:33:57 PM - Spybot-S&D Spyware removal
    RP2082: 12/2/2010 6:56:07 PM - Installed HiJackThis
    RP2083: 12/2/2010 10:54:58 PM - Restore Operation
    RP2084: 12/2/2010 11:11:51 PM - OTM Restore Point
    RP2085: 12/8/2010 12:17:15 AM - System Checkpoint

    ==== Installed Programs ======================

    Ad-Aware
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Help Center 1.0
    Adobe Photoshop Album 2.0 Starter Edition
    Adobe Photoshop CS2
    Adobe Reader 7.1.0
    Adobe Shockwave Player 11.5
    Adobe Stock Photos 1.0
    AIM 7
    AOL Instant Messenger
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Control Panel
    ATI Display Driver
    AutoUpdate
    AviSynth 2.5
    Banctec Service Agreement
    Bonjour
    Broadcom Advanced Control Suite 2
    Canon Camera Access Library
    Canon Camera Support Core Library
    Canon G.726 WMP-Decoder
    Canon MovieEdit Task for ZoomBrowser EX
    Canon RAW Image Task for ZoomBrowser EX
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities EOS Utility
    Canon Utilities MyCamera
    Canon Utilities MyCamera DC
    Canon Utilities PhotoStitch
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    Compatibility Pack for the 2007 Office system
    Critical Update for Windows Media Player 11 (KB959772)
    DeepBurner v1.5.1.192
    Dell Digital Jukebox Driver
    Dell Media Experience
    Dell Networking Guide
    Dell Photo Printer 720
    Dell Solution Center
    DellSupport
    DivX
    DivX Converter
    DivX Player
    Download Updater (AOL LLC)
    EarthLink Setup Files
    ERUNT 1.1j
    ESET Online Scanner v3
    FlashCatch
    Free FLV Converter V 6.92.0
    GenoPro 2.0.1.4
    Help and Support Customization
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HTML Executable IERuntime
    Intel Application Accelerator
    Intel(R) 537EP V9x DF PCI Modem
    Internet Explorer Default Page
    iTunes
    J2SE Runtime Environment 5.0 Update 11
    Jasc Paint Shop Photo Album
    Jasc Paint Shop Pro 8 Dell Edition
    Java Auto Updater
    Java(TM) 6 Update 22
    Juniper Networks Network Connect 6.0.0
    K-Lite Codec Pack 5.1.0 (Basic)
    Learn2 Player (Uninstall Only)
    LG USB Drivers
    Linksys Wireless-G PCI Adapter
    Malwarebytes' Anti-Malware
    McAfee SecurityCenter
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Encarta Encyclopedia Standard 2004
    Microsoft Office Standard Edition 2003
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    MobileMe Control Panel
    Modem Event Monitor
    Modem Helper
    Modem On Hold
    Move Media Player
    Mozilla Firefox (3.6.6)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    MSXML4 Parser
    Music Label 2009 v15.0.3
    Nero Digital
    Power RM AVI MPG VCD WMV Converter 6.0
    PowerDVD 5.1
    QuickTime
    RealPlayer
    Safari
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB911565)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2183461)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360131)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974455)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB976325)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981349)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982381)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Shockwave
    Sonic DLA
    Sonic MyDVD
    Sonic RecordNow!
    Sonic Update Manager
    Sound Blaster Live! 24-bit
    SPSS 13.0 for Windows Student Version
    Spybot - Search & Destroy
    SureThing CD Labeler SE - Sonic
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB976749)
    Update for Windows XP (KB978207)
    Update for Windows XP (KB980182)
    VideoThumber 1.0
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    ViviCam 3345
    VoiceOver Kit
    WebFldrs XP
    Winamp
    Winamp Detector Plug-in
    Winamp Remote
    Winamp Toolbar
    Windows Genuine Advantage Notifications (KB905474)
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    WinRAR archiver
    WordPerfect Office 12
    Yahoo! Internet Mail
    ZC Video Converter 1.8.4

    ==== Event Viewer Messages From Past Week ========

    12/4/2010 9:44:00 AM, error: System Error [1003] - Error code 000000c2, parameter1 00000007, parameter2 00000cd4, parameter3 851ae9a0, parameter4 851ae9a8.
    12/3/2010 7:06:27 AM, error: System Error [1003] - Error code 1000000a, parameter1 00000020, parameter2 00000002, parameter3 00000000, parameter4 804fb4b1.
    12/2/2010 7:38:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    12/2/2010 12:17:49 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    12/2/2010 12:00:05 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}
    12/1/2010 9:41:24 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer D39BSD21 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{5F6E4E6E-3911-49BB-. The master browser is stopping or an election is being forced.
    12/1/2010 5:49:10 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
    12/1/2010 11:58:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/1/2010 11:23:18 PM, error: System Error [1003] - Error code 000000ca, parameter1 00000004, parameter2 86d5ebc0, parameter3 00000000, parameter4 00000000.
    12/1/2010 10:05:45 PM, error: WMPNetworkSvc [14344] - A new media server was not initialized because WMCreateDeviceRegistration() encountered error '0xc00d2711'. The Windows Media DRM components on your computer might be corrupted. Verify that protected files play correctly in Windows Media Player, and then restart the WMPNetworkSvc service.

    ==== End Of File ===========================


    DDS (Ver_10-12-05.01) - NTFSx86
    Run by TOM at 21:00:13.04 on Wed 12/08/2010
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.452 [GMT -5:00]

    AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Winamp Remote\bin\OrbTray.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Documents and Settings\TOM\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.dell4me.com/myway
    mStart Page = hxxp://www.dell4me.com/myway
    uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - No File
    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
    BHO: {69D72956-317C-44bd-B369-8E44D4EF9801} - No File
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20101103172236.dll
    BHO: FlashCatchBHO Class: {88618a96-6d8a-42e7-b932-9073d5b2080f} - c:\program files\flashcatch\flashcatch.dll
    BHO: {93B98EAB-140E-4570-88E5-2B3377B0C501} - No File
    BHO: {ACD121CE-45D9-4E20-99DB-494E6E37F228} - No File
    BHO: {B5C7F75F-77D2-4F6A-BB6E-AB6BA30C5505} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
    TB: FlashCatch: {10cecf4f-a96e-4803-8ac2-f565fb29ff47} - c:\program files\flashcatch\flashcatch.dll
    TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
    TB: AIM Search: {40d41a8b-d79b-43d7-99a7-9ee0f344c385} - c:\program files\aim toolbar\AIMBar.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [Orb] "c:\program files\winamp remote\bin\OrbTray.exe" /background
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    mRun: [IAAnotif] c:\program files\intel\intel application accelerator\iaanotif.exe
    mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
    mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
    mRun: [CTSysVol] c:\program files\creative\sound blaster live! 24-bit\surround mixer\CTSysVol.exe /r
    mRun: [P17Helper] Rundll32 P17.dll,P17Helper
    mRun: [UpdReg] c:\windows\UpdReg.EXE
    mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
    mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    StartupFolder: c:\docume~1\tom\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    IE: &AIM Search - c:\program files\aim toolbar\AIMBar.dll/aimsearch.htm
    IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
    IE: &Yahoo! Search
    IE: Download All by FlashGet
    IE: Download using FlashGet
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
    IE: Yahoo! &Dictionary
    IE: Yahoo! &Maps
    IE: Yahoo! &SMS
    IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\progra~1\flashget\flashget.exe
    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    Trusted Zone: aol.com\free
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
    DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - hxxp://fdl.msn.com/zone/datafiles/heartbeat.cab
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\69bh29k8.default user\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
    FF - component: c:\documents and settings\tom\application data\mozilla\firefox\profiles\69bh29k8.default user\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
    FF - plugin: c:\documents and settings\tom\application data\move networks\plugins\npqmp071503000010.dll
    FF - plugin: c:\documents and settings\tom\application data\move networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\69bh29k8.default user\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Extension: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\69bh29k8.default user\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
    FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\69bh29k8.default user\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
    FF - Extension: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\69bh29k8.default user\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
    FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Extension: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\tom\application data\Move Networks

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-12-2 64288]
    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-2-14 386840]
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-4-29 84072]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-4-29 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-4-29 271480]
    R2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-4-29 271480]
    R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-4-29 171168]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-4-29 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-4-29 141792]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-2-15 24652]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-4-29 55840]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-2-14 152960]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-2-14 52104]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-4-29 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-4-29 88544]
    S0 pbrnk;pbrnk;c:\windows\system32\drivers\klmugfn.sys --> c:\windows\system32\drivers\klmugfn.sys [?]
    S2 0071801291785653mcinstcleanup;McAfee Application Installer Cleanup (0071801291785653);c:\windows\temp\007180~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\windows\temp\007180~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
    S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\c:\windows\system32\drivers\aldebaran.sys --> c:\windows\system32\drivers\Aldebaran.sys [?]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-9-23 1375992]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-4-29 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-4-29 84264]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-2-14 34248]
    S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-2-14 40552]
    S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys --> c:\windows\system32\drivers\vaxscsi.sys [?]

    =============== Created Last 30 ================

    2010-12-08 00:07:26 -------- d-s---w- C:\Combo-Fix18877C
    2010-12-03 04:30:00 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-12-03 04:26:10 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{E961CE1B-C3EA-4882-9F67-F859B555D097}
    2010-12-03 04:07:36 -------- d-----w- C:\_OTM
    2010-12-03 01:37:23 -------- d-----w- c:\program files\ESET
    2010-12-03 00:45:17 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
    2010-12-03 00:39:22 -------- d-----w- c:\windows\ERUNT
    2010-12-03 00:11:31 -------- d-----w- C:\found.002
    2010-12-03 00:04:06 -------- d-----w- C:\SDFix
    2010-12-02 23:56:13 388096 ----a-r- c:\docume~1\tom\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2010-12-02 23:56:13 -------- d-----w- c:\program files\Trend Micro
    2010-12-02 22:39:00 -------- d-----w- C:\N
    2010-12-02 05:00:13 -------- d-----w- C:\Combo-Fix27220C
    2010-12-02 03:06:16 -------- d-sha-r- C:\cmdcons
    2010-12-02 02:52:45 89088 ----a-w- c:\windows\MBR.exe
    2010-12-01 02:54:56 -------- d-----w- C:\found.001
    2010-11-30 23:33:50 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-11-30 23:31:13 -------- d-----w- c:\docume~1\tom\locals~1\applic~1\Sunbelt Software
    2010-11-19 10:25:27 -------- d-----w- C:\found.000
    2010-11-10 03:14:35 -------- d-----w- c:\program files\Bonjour

    ==================== Find3M ====================

    2010-09-18 16:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-15 08:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-15 06:29:49 73728 ----a-w- c:\windows\system32\javacpl.cpl

    ============= FINISH: 21:00:43.73 ===============
     
  2. nismo400r

    nismo400r TS Rookie Topic Starter

    Gmer

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2010-12-08 21:00:01
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST316002 rev.8.05
    Running: 8wr2lx9o.exe; Driver: C:\DOCUME~1\TOM\LOCALS~1\Temp\kgdoapow.sys


    ---- System - GMER 1.0.15 ----

    SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF76B487E]
    SSDT sptd.sys ZwEnumerateKey [0xF756FA92]
    SSDT sptd.sys ZwEnumerateValueKey [0xF756FE20]
    SSDT sptd.sys ZwOpenKey [0xF756A090]
    SSDT sptd.sys ZwQueryKey [0xF756FEF8]
    SSDT sptd.sys ZwQueryValueKey [0xF756FD78]
    SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF76B4BFE]

    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteKey [0xF73C80F9]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF73C8125]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF73C817B]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xF73C80A4]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xF73C80B8]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRenameKey [0xF73C810F]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetSecurityObject [0xF73C8151]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF73C81A5]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF73C8191]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xF73C8165]
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread
    Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetSecurityObject

    ---- Kernel code sections - GMER 1.0.15 ----

    ? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
    .text USBPORT.SYS!DllUnload F63C48AC 5 Bytes JMP 86CAE960
    init C:\WINDOWS\System32\DRIVERS\mohfilt.sys entry point in "init" section [0xF798F760]
    .text portcls.sys!PcUnregisterIoTimeout + 1056 F60E0206 1 Byte [00]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\system32\svchost.exe[324] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00B70FE5
    .text C:\WINDOWS\system32\svchost.exe[324] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B70FB9
    .text C:\WINDOWS\system32\svchost.exe[324] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B70FD4
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B60000
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B60093
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B60F9E
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B6006C
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B60FAF
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B60036
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B600C9
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B600AE
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B600F5
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B600E4
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00B60F41
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00B60051
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B60FE5
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00B60F8D
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00B6001B
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00B60FD4
    .text C:\WINDOWS\system32\svchost.exe[324] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00B60F66
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01620047
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01620098
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01620036
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0162001B
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01620FDB
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0162000A
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0162007D
    .text C:\WINDOWS\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0162006C
    .text C:\WINDOWS\system32\svchost.exe[324] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01610053
    .text C:\WINDOWS\system32\svchost.exe[324] msvcrt.dll!system 77C293C7 5 Bytes JMP 01610FC8
    .text C:\WINDOWS\system32\svchost.exe[324] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01610FD9
    .text C:\WINDOWS\system32\svchost.exe[324] msvcrt.dll!_open 77C2F566 5 Bytes JMP 0161000C
    .text C:\WINDOWS\system32\svchost.exe[324] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01610038
    .text C:\WINDOWS\system32\svchost.exe[324] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0161001D
    .text C:\WINDOWS\system32\svchost.exe[324] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00B80FEF
    .text C:\WINDOWS\system32\svchost.exe[324] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 00B90FD4
    .text C:\WINDOWS\system32\svchost.exe[324] WININET.dll!InternetOpenA 771C5796 5 Bytes JMP 00B90FEF
    .text C:\WINDOWS\system32\svchost.exe[324] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 00B90016
    .text C:\WINDOWS\system32\svchost.exe[324] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 00B90027
    .text C:\WINDOWS\System32\svchost.exe[424] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BC0000
    .text C:\WINDOWS\System32\svchost.exe[424] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BC0FDB
    .text C:\WINDOWS\System32\svchost.exe[424] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BC0011
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BB0000
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BB0F99
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BB0FAA
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BB008E
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BB007D
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BB0051
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BB00B5
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BB0F6D
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BB00E1
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BB00D0
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BB00FC
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BB0062
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BB001B
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BB0F88
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BB0040
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BB0FE5
    .text C:\WINDOWS\System32\svchost.exe[424] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BB0F52
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BA0FB9
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BA0076
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BA0014
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BA0FD4
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BA005B
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BA0FE5
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BA0040
    .text C:\WINDOWS\System32\svchost.exe[424] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BA002F
    .text C:\WINDOWS\System32\svchost.exe[424] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BD0062
    .text C:\WINDOWS\System32\svchost.exe[424] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BD0FD7
    .text C:\WINDOWS\System32\svchost.exe[424] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BD0022
    .text C:\WINDOWS\System32\svchost.exe[424] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BD0000
    .text C:\WINDOWS\System32\svchost.exe[424] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BD0047
    .text C:\WINDOWS\System32\svchost.exe[424] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BD0011
    .text C:\WINDOWS\System32\svchost.exe[832] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00920FEF
    .text C:\WINDOWS\System32\svchost.exe[832] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00920000
    .text C:\WINDOWS\System32\svchost.exe[832] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00920FCA
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00910000
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00910F6F
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00910064
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00910053
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00910F8A
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00910025
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00910F2D
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00910F48
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009100A4
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00910F0B
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00910EF0
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00910036
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00910FE5
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0091007F
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00910FB9
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00910FCA
    .text C:\WINDOWS\System32\svchost.exe[832] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00910F1C
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00900FE5
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00900FC3
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00900036
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0090001B
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00900076
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00900000
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00900065
    .text C:\WINDOWS\System32\svchost.exe[832] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00900FD4
    .text C:\WINDOWS\System32\svchost.exe[832] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00A90036
    .text C:\WINDOWS\System32\svchost.exe[832] msvcrt.dll!system 77C293C7 5 Bytes JMP 00A90FAB
    .text C:\WINDOWS\System32\svchost.exe[832] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00A90FCD
    .text C:\WINDOWS\System32\svchost.exe[832] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00A90FEF
    .text C:\WINDOWS\System32\svchost.exe[832] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00A90FBC
    .text C:\WINDOWS\System32\svchost.exe[832] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00A90FDE
    .text C:\WINDOWS\System32\svchost.exe[832] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 00A80FEF
    .text C:\WINDOWS\System32\svchost.exe[832] WININET.dll!InternetOpenA 771C5796 3 Bytes JMP 00A8000A
    .text C:\WINDOWS\System32\svchost.exe[832] WININET.dll!InternetOpenA + 4 771C579A 1 Byte [89]
    .text C:\WINDOWS\System32\svchost.exe[832] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 00A80FDE
    .text C:\WINDOWS\System32\svchost.exe[832] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 00A80FC1
    .text C:\WINDOWS\System32\svchost.exe[832] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00930FEF
    .text C:\WINDOWS\System32\svchost.exe[1072] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F60000
    .text C:\WINDOWS\System32\svchost.exe[1072] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F60040
    .text C:\WINDOWS\System32\svchost.exe[1072] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00F6001B
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F50FEF
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F500A0
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F50FAB
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F50079
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F50068
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F50043
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F500C2
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F500B1
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F50109
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F500EE
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F50124
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F50FBC
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F50FDE
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F50F86
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F5001E
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F50FCD
    .text C:\WINDOWS\System32\svchost.exe[1072] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F500D3
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F4001B
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F4005B
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F4000A
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F40FD4
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F40040
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F40FE5
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F40F94
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [14, 89] {ADC AL, 0x89}
    .text C:\WINDOWS\System32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F40FAF
    .text C:\WINDOWS\System32\svchost.exe[1072] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F80077
    .text C:\WINDOWS\System32\svchost.exe[1072] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F80066
    .text C:\WINDOWS\System32\svchost.exe[1072] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F8003A
    .text C:\WINDOWS\System32\svchost.exe[1072] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F80000
    .text C:\WINDOWS\System32\svchost.exe[1072] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F8004B
    .text C:\WINDOWS\System32\svchost.exe[1072] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F8001D
    .text C:\WINDOWS\System32\svchost.exe[1072] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F70000
    .text C:\WINDOWS\system32\services.exe[1232] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F20FEF
    .text C:\WINDOWS\system32\services.exe[1232] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F20FC3
    .text C:\WINDOWS\system32\services.exe[1232] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00F20FDE
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F1000A
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F10097
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F10086
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F10FAC
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F10069
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F10047
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F100CF
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F10F87
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F100F4
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F10F51
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F1010F
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F10058
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F1001B
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F100A8
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F1002C
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F10FDB
    .text C:\WINDOWS\system32\services.exe[1232] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F10F6C
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F50FCD
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F50FA1
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F50FDE
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F50014
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F5005E
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F50FEF
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F50FBC
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [15, 89]
    .text C:\WINDOWS\system32\services.exe[1232] ADVAPI32.dll!RegCreateKeyA
     
  3. nismo400r

    nismo400r TS Rookie Topic Starter

    .text C:\WINDOWS\system32\services.exe[1232] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F40051
    .text C:\WINDOWS\system32\services.exe[1232] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F40FC6
    .text C:\WINDOWS\system32\services.exe[1232] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F40022
    .text C:\WINDOWS\system32\services.exe[1232] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F40000
    .text C:\WINDOWS\system32\services.exe[1232] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F40FD7
    .text C:\WINDOWS\system32\services.exe[1232] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F40011
    .text C:\WINDOWS\system32\services.exe[1232] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F30FEF
    .text C:\WINDOWS\system32\lsass.exe[1244] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00B7000A
    .text C:\WINDOWS\system32\lsass.exe[1244] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B70FDB
    .text C:\WINDOWS\system32\lsass.exe[1244] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B7001B
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B60FEF
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B60F6B
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B60060
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B60F7C
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B60F8D
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B60FB9
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B60F3D
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B60F4E
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B60F11
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B60F22
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00B600CF
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00B60F9E
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B60FDE
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00B60085
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00B60025
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00B60014
    .text C:\WINDOWS\system32\lsass.exe[1244] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00B600A0
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D3002F
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D30FB2
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D30FD4
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D3000A
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D30065
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D30FEF
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00D3004A
    .text C:\WINDOWS\system32\lsass.exe[1244] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D30FC3
    .text C:\WINDOWS\system32\lsass.exe[1244] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00B9005A
    .text C:\WINDOWS\system32\lsass.exe[1244] msvcrt.dll!system 77C293C7 5 Bytes JMP 00B90049
    .text C:\WINDOWS\system32\lsass.exe[1244] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00B9001D
    .text C:\WINDOWS\system32\lsass.exe[1244] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00B9000C
    .text C:\WINDOWS\system32\lsass.exe[1244] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00B90038
    .text C:\WINDOWS\system32\lsass.exe[1244] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00B90FEF
    .text C:\WINDOWS\system32\lsass.exe[1244] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00B80FEF
    .text C:\WINDOWS\system32\svchost.exe[1436] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F50000
    .text C:\WINDOWS\system32\svchost.exe[1436] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F50036
    .text C:\WINDOWS\system32\svchost.exe[1436] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00F5001B
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F40FEF
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F40045
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F40F46
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F40F57
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F40F72
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F40F97
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F40F1A
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F40F2B
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F40087
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F40EF8
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F40EDD
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F40014
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F40FD4
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F40056
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F40FA8
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F40FC3
    .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F40F09
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F80FAF
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F8005B
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F80FD4
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F80FE5
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F80040
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F80000
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00F80025
    .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F80F9E
    .text C:\WINDOWS\system32\svchost.exe[1436] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F70F8B
    .text C:\WINDOWS\system32\svchost.exe[1436] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F70FA6
    .text C:\WINDOWS\system32\svchost.exe[1436] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F70FD2
    .text C:\WINDOWS\system32\svchost.exe[1436] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F70FEF
    .text C:\WINDOWS\system32\svchost.exe[1436] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F70FB7
    .text C:\WINDOWS\system32\svchost.exe[1436] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F7000C
    .text C:\WINDOWS\system32\svchost.exe[1436] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F60FEF
    .text C:\WINDOWS\system32\svchost.exe[1524] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00CA0000
    .text C:\WINDOWS\system32\svchost.exe[1524] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00CA0FD4
    .text C:\WINDOWS\system32\svchost.exe[1524] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CA0FEF
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C90FE5
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C90F57
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C9004C
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C9003B
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C90F7C
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C90FA8
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C90082
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C90067
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C90EF0
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C90F15
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C900A4
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C90F8D
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C90FCA
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C90F3C
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C90FB9
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C90000
    .text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C90093
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CD0025
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CD0051
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CD0FDE
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CD0FEF
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CD0F9E
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CD000A
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00CD0FAF
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ED, 88]
    .text C:\WINDOWS\system32\svchost.exe[1524] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CD0036
    .text C:\WINDOWS\system32\svchost.exe[1524] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CC0047
    .text C:\WINDOWS\system32\svchost.exe[1524] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CC002C
    .text C:\WINDOWS\system32\svchost.exe[1524] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CC0011
    .text C:\WINDOWS\system32\svchost.exe[1524] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00CC0000
    .text C:\WINDOWS\system32\svchost.exe[1524] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CC0FBC
    .text C:\WINDOWS\system32\svchost.exe[1524] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CC0FE3
    .text C:\WINDOWS\system32\svchost.exe[1524] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CB0FEF
    .text C:\WINDOWS\system32\svchost.exe[1692] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 01460FEF
    .text C:\WINDOWS\system32\svchost.exe[1692] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0146001B
    .text C:\WINDOWS\system32\svchost.exe[1692] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 01460000
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01450000
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01450F6D
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01450F92
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0145006C
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01450051
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01450FCA
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01450098
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01450F46
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 014500DF
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 014500C4
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 014500F0
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01450FAF
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01450FE5
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0145007D
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01450036
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0145001B
    .text C:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 014500B3
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01440014
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01440F9E
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01440FC3
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01440FD4
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01440051
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01440FE5
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01440040
    .text C:\WINDOWS\system32\svchost.exe[1692] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0144002F
    .text C:\WINDOWS\system32\svchost.exe[1692] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01480FB0
    .text C:\WINDOWS\system32\svchost.exe[1692] msvcrt.dll!system 77C293C7 5 Bytes JMP 01480031
    .text C:\WINDOWS\system32\svchost.exe[1692] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0148000C
    .text C:\WINDOWS\system32\svchost.exe[1692] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01480FEF
    .text C:\WINDOWS\system32\svchost.exe[1692] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01480FC1
    .text C:\WINDOWS\system32\svchost.exe[1692] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01480FD2
    .text C:\WINDOWS\system32\svchost.exe[1692] WS2_32.dll!socket
     
  4. nismo400r

    nismo400r TS Rookie Topic Starter

    .text C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe[1824] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 62419A20 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
    .text C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe[1824] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 62419AE2 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
    .text C:\WINDOWS\System32\svchost.exe[1876] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BB0FEF
    .text C:\WINDOWS\System32\svchost.exe[1876] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BB0025
    .text C:\WINDOWS\System32\svchost.exe[1876] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BB0014
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BA0FEF
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BA0069
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BA0058
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BA0047
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BA0F8A
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BA001B
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BA0F3E
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BA0090
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BA00A1
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BA0F08
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BA0EED
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BA002C
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BA0FD4
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BA0F59
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BA0FB9
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BA000A
    .text C:\WINDOWS\System32\svchost.exe[1876] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BA0F2D
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0598002C
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 05980F80
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 05980011
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 05980FE5
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 05980F9B
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 05980000
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 05980FB6
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [B8, 8D]
    .text C:\WINDOWS\System32\svchost.exe[1876] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0598003D
    .text C:\WINDOWS\System32\svchost.exe[1876] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 05970FC6
    .text C:\WINDOWS\System32\svchost.exe[1876] msvcrt.dll!system 77C293C7 5 Bytes JMP 05970047
    .text C:\WINDOWS\System32\svchost.exe[1876] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 05970022
    .text C:\WINDOWS\System32\svchost.exe[1876] msvcrt.dll!_open 77C2F566 5 Bytes JMP 05970000
    .text C:\WINDOWS\System32\svchost.exe[1876] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 05970FD7
    .text C:\WINDOWS\System32\svchost.exe[1876] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 05970011
    .text C:\WINDOWS\System32\svchost.exe[1876] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BC000A
    .text C:\WINDOWS\System32\svchost.exe[1876] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 00BD0FEF
    .text C:\WINDOWS\System32\svchost.exe[1876] WININET.dll!InternetOpenA 771C5796 5 Bytes JMP 00BD000A
    .text C:\WINDOWS\System32\svchost.exe[1876] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 00BD0FD2
    .text C:\WINDOWS\System32\svchost.exe[1876] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 00BD0FC1
    .text C:\WINDOWS\System32\svchost.exe[2008] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 0079000A
    .text C:\WINDOWS\System32\svchost.exe[2008] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00790036
    .text C:\WINDOWS\System32\svchost.exe[2008] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00790025
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0078000A
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00780071
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00780F86
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00780060
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00780F97
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0078002F
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 0078009D
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00780F61
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00780F33
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00780F44
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00780F22
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00780FB2
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00780FEF
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0078008C
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00780FC3
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00780FD4
    .text C:\WINDOWS\System32\svchost.exe[2008] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 007800C2
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 007C003D
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 007C0FA2
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 007C002C
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 007C001B
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 007C005F
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 007C0000
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 007C004E
    .text C:\WINDOWS\System32\svchost.exe[2008] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 007C0FD1
    .text C:\WINDOWS\System32\svchost.exe[2008] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 007B0049
    .text C:\WINDOWS\System32\svchost.exe[2008] msvcrt.dll!system 77C293C7 5 Bytes JMP 007B002E
    .text C:\WINDOWS\System32\svchost.exe[2008] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 007B001D
    .text C:\WINDOWS\System32\svchost.exe[2008] msvcrt.dll!_open 77C2F566 5 Bytes JMP 007B0FEF
    .text C:\WINDOWS\System32\svchost.exe[2008] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 007B0FC8
    .text C:\WINDOWS\System32\svchost.exe[2008] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 007B000C
    .text C:\WINDOWS\System32\svchost.exe[2008] WS2_32.dll!socket 71AB4211 5 Bytes JMP 007A0000
    .text C:\WINDOWS\Explorer.EXE[2204] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 014B000A
    .text C:\WINDOWS\Explorer.EXE[2204] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 014B002C
    .text C:\WINDOWS\Explorer.EXE[2204] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 014B001B
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 014A0FEF
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 014A0F68
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 014A0053
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 014A0F79
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 014A0F8A
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 014A0FAF
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 014A0095
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 014A0084
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 014A00D5
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 014A00BA
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 014A00E6
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 014A002C
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 014A0000
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 014A0F57
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 014A0FC0
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 014A001B
    .text C:\WINDOWS\Explorer.EXE[2204] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 014A0F3C
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01490036
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01490FAF
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01490FE5
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01490011
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01490FCA
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01490000
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0149006C
    .text C:\WINDOWS\Explorer.EXE[2204] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01490051
    .text C:\WINDOWS\Explorer.EXE[2204] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 015E0FB7
    .text C:\WINDOWS\Explorer.EXE[2204] msvcrt.dll!system 77C293C7 5 Bytes JMP 015E0038
    .text C:\WINDOWS\Explorer.EXE[2204] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 015E0FC8
    .text C:\WINDOWS\Explorer.EXE[2204] msvcrt.dll!_open 77C2F566 5 Bytes JMP 015E0000
    .text C:\WINDOWS\Explorer.EXE[2204] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 015E001D
    .text C:\WINDOWS\Explorer.EXE[2204] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 015E0FE3
    .text C:\WINDOWS\Explorer.EXE[2204] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 015D0FD4
    .text C:\WINDOWS\Explorer.EXE[2204] WININET.dll!InternetOpenA 771C5796 5 Bytes JMP 015D0FEF
    .text C:\WINDOWS\Explorer.EXE[2204] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 015D0FC3
    .text C:\WINDOWS\Explorer.EXE[2204] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 015D0FA6
    .text C:\WINDOWS\Explorer.EXE[2204] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00B2000A
    .text C:\Program Files\Windows Media Player\WMPNetwk.exe[2840] SHELL32.dll!FindExeDlgProc + 50431 7CB48D3E 1 Byte [89]
    .text C:\WINDOWS\System32\alg.exe[3312] ntdll.dll!wcstombs + 87FD 7C97A92E 1 Byte [95]
    .text C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe[3404] SHELL32.dll!ShellExecuteEx + 209 7CA41086 1 Byte [E8]
    .text C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe[3404] SHELL32.dll!ShellExecuteEx + 321 7CA4119E 1 Byte [E9]
    .text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[3572] ntdll.dll!RtlMultiByteToUnicodeN + 904 7C90F5BE 1 Byte [71]
    .text C:\WINDOWS\system32\Rundll32.exe[3644] ole32.dll!ComPs_NdrStubCall2 + B036 775B191E 1 Byte [87]
    .text C:\Program Files\Dell\Media Experience\PCMService.exe[3680] ntdll.dll!RtlDeleteAce + 71CD 7C93F31E 1 Byte [DE]
    .text C:\Program Files\Dell\Media Experience\PCMService.exe[3680] SHELL32.dll!FindExeDlgProc + 61779 7CB5A086 1 Byte [F0]
    .text C:\Program Files\Dell\Media Experience\PCMService.exe[3680] SHELL32.dll!FindExeDlgProc + 62011 7CB5A91E 1 Byte [FF]
    .text C:\Program Files\Winamp Remote\bin\OrbTray.exe[3832] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 00413C70 C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb/Orb Networks)

    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!IoConnectInterrupt] [F757E97E] sptd.sys
    IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F757E92A] sptd.sys
    IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7599B4E] sptd.sys
    IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F757E97E] sptd.sys
    IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F756AAB4] sptd.sys
    IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F756ABFA] sptd.sys
    IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F756AB7C] sptd.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F756B728] sptd.sys
    IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F756B5FE] sptd.sys
    IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F757DC5A] sptd.sys

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe[216] @ C:\WINDOWS\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [00407740] C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
    IAT C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe[216] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [004077A0] C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs 8735D1E8

    AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

    Device \FileSystem\Udfs \UdfsCdRom 859BB7C0
    Device \FileSystem\Udfs \UdfsCdRom tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
    Device \FileSystem\Udfs \UdfsDisk 859BB7C0
    Device \FileSystem\Udfs \UdfsDisk tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

    AttachedDevice \Driver\Tcpip \Device\Ip mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

    Device \Driver\usbuhci \Device\USBPDO-0 86D45980
    Device \Driver\dmio \Device\DmControl\DmIoDaemon 8735F1E8
    Device \Driver\dmio \Device\DmControl\DmConfig 8735F1E8
    Device \Driver\dmio \Device\DmControl\DmPnP 8735F1E8
    Device \Driver\dmio \Device\DmControl\DmInfo 8735F1E8
    Device \Driver\usbuhci \Device\USBPDO-1 86D45980
    Device \Driver\usbuhci \Device\USBPDO-2 86D45980
    Device \Driver\usbuhci \Device\USBPDO-3 86D45980
    Device \Driver\usbehci \Device\USBPDO-4 86CB7980

    AttachedDevice \Driver\Tcpip \Device\Tcp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

    Device \Driver\Ftdisk \Device\HarddiskVolume1 873D11E8
    Device \Driver\Ftdisk \Device\HarddiskVolume2 873D11E8
    Device \Driver\Cdrom \Device\CdRom0 86D2E1E8
    Device \Driver\iaStor \Device\Ide\iaStor0 8735E1E8
    Device \Driver\atapi \Device\Ide\IdePort0 [F74A0B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 [F74A0B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c [F74A0B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 8735E1E8
    Device \Driver\Cdrom \Device\CdRom1 86D2E1E8
    Device \Driver\Ftdisk \Device\HarddiskVolume3 873D11E8
    Device \Driver\NetBT \Device\NetBT_Tcpip_{46FD8B10-4DCB-4FE9-BF61-163CA04D73FD} 85E93980
    Device \Driver\NetBT \Device\NetBT_Tcpip_{5F6E4E6E-3911-49BB-B857-8B1503DD728B} 85E93980
    Device \Driver\NetBT \Device\NetBt_Wins_Export 85E93980
    Device \Driver\NetBT \Device\NetbiosSmb 85E93980

    AttachedDevice \Driver\Tcpip \Device\Udp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
    AttachedDevice \Driver\Tcpip \Device\RawIp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

    Device \Driver\usbuhci \Device\USBFDO-0 86D45980
    Device \Driver\usbuhci \Device\USBFDO-1 86D45980
    Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 85F35980
    Device \Driver\usbuhci \Device\USBFDO-2 86D45980
    Device \FileSystem\MRxSmb \Device\LanmanRedirector 85F35980
    Device \Driver\usbuhci \Device\USBFDO-3 86D45980
    Device \Driver\usbehci \Device\USBFDO-4 86CB7980
    Device \Driver\Ftdisk \Device\FtControl 873D11E8
    Device \FileSystem\Fastfat \Fat 861C6460
    Device \FileSystem\Fastfat \Fat AC629297

    AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    Device \FileSystem\Cdfs \Cdfs 864AE1E8
    Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 1776911465
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 166451483
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x85 0x0D 0x45 0x39 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7A 0xCE 0x56 0x75 ...
    Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x85 0x0D 0x45 0x39 ...
    Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 1
    Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7A 0xCE 0x56 0x75 ...
    Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x85 0x0D 0x45 0x39 ...
    Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 1
    Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7A 0xCE 0x56 0x75 ...
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1

    ---- EOF - GMER 1.0.15 ----


    Again I apologize for the huge post, no one else's seems to be this long. Thanks for your time and any help you can give.
     
  5. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =======================================================================

    So far, I don't see much...

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    ======================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AVG Remover to uninstall it: http://www.avg.com/us-en/download-tools
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.pif
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  6. nismo400r

    nismo400r TS Rookie Topic Starter

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000001c

    Kernel Drivers (total 161):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806FF000 \WINDOWS\system32\hal.dll
    0xF7B64000 \WINDOWS\system32\KDCOM.DLL
    0xF7A74000 \WINDOWS\system32\BOOTVID.dll
    0xF7569000 sptd.sys
    0xF7B66000 \WINDOWS\System32\Drivers\WMILIB.SYS
    0xF7551000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
    0xF7523000 ACPI.sys
    0xF7512000 pci.sys
    0xF7664000 isapnp.sys
    0xF7A78000 compbatt.sys
    0xF7A7C000 \WINDOWS\System32\DRIVERS\BATTC.SYS
    0xF7C2C000 pciide.sys
    0xF78E4000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
    0xF74F4000 pcmcia.sys
    0xF7674000 MountMgr.sys
    0xF74D5000 ftdisk.sys
    0xF7B68000 dmload.sys
    0xF74AF000 dmio.sys
    0xF78EC000 PartMgr.sys
    0xF7684000 VolSnap.sys
    0xF7497000 atapi.sys
    0xF7424000 iaStor.sys
    0xF7694000 disk.sys
    0xF76A4000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
    0xF7404000 fltmgr.sys
    0xF73F2000 sr.sys
    0xF7395000 mfehidk.sys
    0xF76B4000 Lbd.sys
    0xF76C4000 PxHelp20.sys
    0xF7380000 drvmcdb.sys
    0xF7369000 KSecDD.sys
    0xF72DC000 Ntfs.sys
    0xF72AF000 NDIS.sys
    0xF7295000 Mup.sys
    0xF7884000 \SystemRoot\System32\DRIVERS\intelppm.sys
    0xF6412000 \SystemRoot\System32\DRIVERS\ati2mtag.sys
    0xF63FE000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
    0xF63D0000 \SystemRoot\System32\DRIVERS\b57xp32.sys
    0xF797C000 \SystemRoot\System32\DRIVERS\usbuhci.sys
    0xF63AC000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
    0xF7984000 \SystemRoot\System32\DRIVERS\usbehci.sys
    0xF7894000 \SystemRoot\System32\DRIVERS\IntelC53.sys
    0xF6389000 \SystemRoot\System32\DRIVERS\ks.sys
    0xF6262000 \SystemRoot\System32\DRIVERS\IntelC51.sys
    0xF61CD000 \SystemRoot\System32\DRIVERS\IntelC52.sys
    0xF798C000 \SystemRoot\System32\DRIVERS\mohfilt.sys
    0xF7994000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF60FF000 \SystemRoot\system32\drivers\P17.sys
    0xF60DB000 \SystemRoot\system32\drivers\portcls.sys
    0xF78A4000 \SystemRoot\system32\drivers\drmk.sys
    0xF60AF000 \SystemRoot\System32\DRIVERS\ctoss2k.sys
    0xF608B000 \SystemRoot\system32\drivers\mfeavfk.sys
    0xF6040000 \SystemRoot\system32\drivers\mfefirek.sys
    0xF5FF8000 \SystemRoot\System32\DRIVERS\ctsfm2k.sys
    0xF78B4000 \SystemRoot\System32\DRIVERS\i8042prt.sys
    0xF799C000 \SystemRoot\System32\DRIVERS\kbdclass.sys
    0xF5FE4000 \SystemRoot\System32\DRIVERS\parport.sys
    0xF78C4000 \SystemRoot\System32\DRIVERS\serial.sys
    0xF6B46000 \SystemRoot\System32\DRIVERS\serenum.sys
    0xF78D4000 \SystemRoot\System32\DRIVERS\cdrom.sys
    0xF76E4000 \SystemRoot\System32\DRIVERS\redbook.sys
    0xF79A4000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xF76F4000 \SystemRoot\System32\DRIVERS\imapi.sys
    0xF7704000 \SystemRoot\system32\DRIVERS\dsNcAdpt.sys
    0xF7C88000 \SystemRoot\System32\DRIVERS\audstub.sys
    0xF5FD0000 \SystemRoot\system32\DRIVERS\mfendisk.sys
    0xF7BA2000 \SystemRoot\System32\Drivers\RootMdm.sys
    0xF7714000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
    0xF6B3A000 \SystemRoot\System32\DRIVERS\ndistapi.sys
    0xF5FB9000 \SystemRoot\System32\DRIVERS\ndiswan.sys
    0xF656F000 \SystemRoot\System32\DRIVERS\raspppoe.sys
    0xF655F000 \SystemRoot\System32\DRIVERS\raspptp.sys
    0xF79AC000 \SystemRoot\System32\DRIVERS\TDI.SYS
    0xF5FA8000 \SystemRoot\System32\DRIVERS\psched.sys
    0xF654F000 \SystemRoot\System32\DRIVERS\msgpc.sys
    0xF79B4000 \SystemRoot\System32\DRIVERS\ptilink.sys
    0xF79BC000 \SystemRoot\System32\DRIVERS\raspti.sys
    0xF5F78000 \SystemRoot\System32\DRIVERS\rdpdr.sys
    0xF653F000 \SystemRoot\System32\DRIVERS\termdd.sys
    0xF79C4000 \SystemRoot\System32\DRIVERS\mouclass.sys
    0xF7BA4000 \SystemRoot\System32\DRIVERS\swenum.sys
    0xF5F1A000 \SystemRoot\System32\DRIVERS\update.sys
    0xF79CC000 \SystemRoot\System32\DRIVERS\omci.sys
    0xF7258000 \SystemRoot\System32\DRIVERS\mssmbios.sys
    0xF77A4000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF7864000 \SystemRoot\System32\DRIVERS\usbhub.sys
    0xF7BCE000 \SystemRoot\System32\DRIVERS\USBD.SYS
    0xF5F06000 \SystemRoot\system32\drivers\MODEMCSA.sys
    0xECA28000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF7BD6000 \SystemRoot\system32\drivers\sscdbhk5.sys
    0xF7BD8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7C37000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7BDA000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF796C000 \SystemRoot\system32\drivers\ssrtln.sys
    0xF7974000 \SystemRoot\System32\drivers\vga.sys
    0xF7BDC000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7BDE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xEC71D000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xEC715000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xECA24000 \SystemRoot\System32\DRIVERS\rasacd.sys
    0xF6878000 \SystemRoot\System32\DRIVERS\ipsec.sys
    0xF681F000 \SystemRoot\System32\DRIVERS\tcpip.sys
    0xF680C000 \SystemRoot\system32\drivers\mfetdi2k.sys
    0xF67E6000 \SystemRoot\System32\DRIVERS\ipnat.sys
    0xF67BE000 \SystemRoot\System32\DRIVERS\netbt.sys
    0xF68EB000 \SystemRoot\System32\DRIVERS\wanarp.sys
    0xECA0C000 \SystemRoot\System32\drivers\ws2ifsl.sys
    0xF6788000 \SystemRoot\System32\drivers\afd.sys
    0xF68DB000 \SystemRoot\System32\DRIVERS\netbios.sys
    0xF675D000 \SystemRoot\System32\DRIVERS\rdbss.sys
    0xF66ED000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
    0xEC9AA000 \SystemRoot\System32\Drivers\Fips.SYS
    0xEB1F8000 \SystemRoot\System32\DRIVERS\hidusb.sys
    0xB7982000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
    0xEB007000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
    0xEB1F4000 \SystemRoot\System32\DRIVERS\mouhid.sys
    0xAED71000 \SystemRoot\System32\Drivers\Udfs.SYS
    0xB066F000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xAECFE000 \SystemRoot\System32\Drivers\dump_iaStor.sys
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xAFAB2000 \SystemRoot\System32\drivers\Dxapi.sys
    0xAF9D5000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xB5024000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF049000 \SystemRoot\System32\ati2cqag.dll
    0xBF083000 \SystemRoot\System32\ati3duag.dll
    0xBF257000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xB3C20000 \SystemRoot\system32\drivers\drvnddm.sys
    0xF7D70000 \SystemRoot\system32\dla\tfsndres.sys
    0xADCE9000 \SystemRoot\system32\dla\tfsnifs.sys
    0xB3A89000 \SystemRoot\system32\dla\tfsnopio.sys
    0xF7BF0000 \SystemRoot\system32\dla\tfsnpool.sys
    0xAED9A000 \SystemRoot\system32\dla\tfsnboio.sys
    0xB3C10000 \SystemRoot\system32\dla\tfsncofs.sys
    0xF7D72000 \SystemRoot\system32\dla\tfsndrct.sys
    0xADCD0000 \SystemRoot\system32\dla\tfsnudf.sys
    0xADCB7000 \SystemRoot\system32\dla\tfsnudfa.sys
    0xB7705000 \SystemRoot\system32\DRIVERS\AegisP.sys
    0xECA04000 \SystemRoot\System32\DRIVERS\ndisuio.sys
    0xADC62000 \SystemRoot\System32\DRIVERS\mrxdav.sys
    0xAF332000 \SystemRoot\System32\Drivers\ParVdm.SYS
    0xAF32A000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
    0xADBD1000 \SystemRoot\System32\Drivers\HTTP.sys
    0xADB29000 \SystemRoot\System32\DRIVERS\srv.sys
    0xF7744000 \SystemRoot\System32\DRIVERS\secdrv.sys
    0xAD640000 \SystemRoot\system32\drivers\wdmaud.sys
    0xAD735000 \SystemRoot\system32\drivers\sysaudio.sys
    0xAD875000 \SystemRoot\system32\drivers\cfwids.sys
    0xAC634000 \??\C:\DOCUME~1\TOM\LOCALS~1\Temp\kgdoapow.sys
    0xAC610000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xF7A54000 \??\C:\DOCUME~1\TOM\LOCALS~1\Temp\mbr.sys
    0xAC5CF000 \SystemRoot\system32\drivers\mfeapfk.sys
    0xAD715000 \SystemRoot\system32\drivers\mfebopk.sys
    0xAF3C7000 \SystemRoot\System32\drivers\pxkbf.sys
    0xAC51E000 \SystemRoot\System32\drivers\pxrts.sys
    0xB3A45000 \SystemRoot\System32\drivers\pxscan.sys
    0xAC3DB000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

    Processes (total 56):
    0 System Idle Process
    4 System
    1108 C:\WINDOWS\SYSTEM32\smss.exe
    1164 csrss.exe
    1188 C:\WINDOWS\SYSTEM32\winlogon.exe
    1232 C:\WINDOWS\SYSTEM32\services.exe
    1244 C:\WINDOWS\SYSTEM32\lsass.exe
    1420 C:\WINDOWS\SYSTEM32\ati2evxx.exe
    1436 C:\WINDOWS\SYSTEM32\svchost.exe
    1524 svchost.exe
    1876 C:\WINDOWS\SYSTEM32\svchost.exe
    2008 svchost.exe
    324 svchost.exe
    608 C:\WINDOWS\SYSTEM32\LEXBCES.EXE
    632 C:\WINDOWS\SYSTEM32\spoolsv.exe
    660 C:\WINDOWS\SYSTEM32\LEXPPS.EXE
    832 svchost.exe
    872 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    884 C:\Program Files\Bonjour\mDNSResponder.exe
    916 C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE
    944 C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
    1072 C:\WINDOWS\SYSTEM32\svchost.exe
    1768 C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe
    1792 C:\Program Files\Java\jre6\bin\jqs.exe
    1824 C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    216 C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    424 C:\WINDOWS\SYSTEM32\svchost.exe
    1048 C:\Program Files\Viewpoint\Common\ViewpointService.exe
    1484 C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
    1588 C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    1692 C:\WINDOWS\SYSTEM32\svchost.exe
    1700 C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    2100 C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    2516 C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    2840 wmpnetwk.exe
    2172 C:\Program Files\Canon\CAL\CALMAIN.exe
    3312 alg.exe
    3724 C:\WINDOWS\SYSTEM32\wscntfy.exe
    3404 C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe
    3572 C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    3644 C:\WINDOWS\SYSTEM32\rundll32.exe
    3680 C:\Program Files\Dell\Media Experience\PCMService.exe
    3672 C:\WINDOWS\SYSTEM32\dla\tfswctrl.exe
    3784 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    3816 C:\Program Files\iTunes\iTunesHelper.exe
    3832 C:\Program Files\Winamp Remote\bin\OrbTray.exe
    3844 C:\Program Files\Windows Media Player\wmpnscfg.exe
    2580 C:\Program Files\iPod\bin\iPodService.exe
    3216 C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    3468 C:\Program Files\Prevx\prevx.exe
    1656 C:\Program Files\Prevx\prevx.exe
    4468 C:\Program Files\McAfee.com\Agent\mcagent.exe
    5836 C:\WINDOWS\explorer.exe
    5940 C:\Program Files\Mozilla Firefox\firefox.exe
    5208 C:\Program Files\Mozilla Firefox\plugin-container.exe
    3632 C:\Documents and Settings\TOM\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000 (NTFS)

    PhysicalDrive0 Model Number: ST3160023AS, Rev: 8.05

    Size Device Name MBR Status
    --------------------------------------------
    149 GB \\.\PhysicalDrive0 Dell MBR code detected
    SHA1: 84B95CE8A54B7C5C3AAF149934FC46FB70FF8365


    Done!

    Attempted to run combofix after downloading from your link. Got a windows error message

    "grep.exe has encountered a problem and needs to close" blah blah blah

    Attempted to run combofix again and got the error message
    "not safe to run combofix since it has been compromised your computer may be infected with Virut"

    Downloaded it again,started to run. Then blue screen which said

    "hardware malfunction. Call hardware vendor for support.
    NMI: Parity check / memory parity error.
    ***The system has halted***"
    The computer was unresponsive so I turned it off then back on. CHKDSK ran once started and everything seemed ok. Before it fully finished I only caught one thing which was
    "correcting errors in the volume bitmap."

    Attempted to run combofix in safe mode, errors with grep.cfxxe sed.cfxxe and pev.cfxxe. but it did produce the following log.
    I could not get rkill to run, the 3rd link gives a 404 error.

    ComboFix 10-12-08.04 - TOM 12/09/2010 18:10:50.11.2 - x86 MINIMAL
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.701 [GMT -5:00]
    Running from: c:\documents and settings\TOM\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    .

    ((((((((((((((((((((((((( Files Created from 2010-11-09 to 2010-12-09 )))))))))))))))))))))))))))))))
    .

    2010-12-03 04:21 . 2010-12-03 04:21 -------- d-----w- c:\program files\ERUNT
    2010-12-03 04:07 . 2010-12-03 04:07 -------- d-----w- C:\_OTM
    2010-12-03 01:37 . 2010-12-03 01:37 -------- d-----w- c:\program files\ESET
    2010-12-03 00:45 . 2010-12-03 00:45 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
    2010-12-03 00:39 . 2010-12-03 00:39 -------- d-----w- c:\windows\ERUNT
    2010-12-03 00:11 . 2010-12-03 00:11 -------- d-----w- C:\found.002
    2010-12-03 00:04 . 2010-12-03 01:31 -------- d-----w- C:\SDFix
    2010-12-02 23:56 . 2010-12-02 23:56 388096 ----a-r- c:\documents and settings\TOM\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-12-02 23:56 . 2010-12-02 23:56 -------- d-----w- c:\program files\Trend Micro
    2010-12-02 22:39 . 2010-12-02 22:54 -------- d-----w- C:\N
    2010-12-02 05:00 . 2010-12-02 05:17 -------- d-----w- C:\Combo-Fix27220C
    2010-12-01 02:54 . 2010-12-01 02:54 -------- d-----w- C:\found.001
    2010-11-30 23:33 . 2010-11-30 23:33 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-11-30 23:31 . 2010-11-30 23:31 -------- d-----w- c:\documents and settings\TOM\Local Settings\Application Data\Sunbelt Software
    2010-11-19 10:25 . 2010-11-19 10:25 -------- d-----w- C:\found.000
    2010-11-10 03:14 . 2010-11-10 03:14 -------- d-----w- c:\program files\Bonjour

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-29 22:42 . 2009-08-09 21:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-29 22:42 . 2009-08-09 21:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-14 02:28 . 2010-04-30 02:38 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2010-10-14 02:28 . 2010-04-30 02:38 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2010-10-14 02:28 . 2010-04-30 02:38 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys
    2010-10-14 02:28 . 2010-04-30 02:38 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2010-10-14 02:28 . 2010-04-30 02:38 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
    2010-10-14 02:28 . 2010-04-30 02:38 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2010-10-14 02:28 . 2010-04-30 02:38 313288 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2010-10-14 02:28 . 2007-02-14 16:04 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2010-10-14 02:28 . 2007-02-14 16:04 386840 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2010-10-14 02:28 . 2007-02-14 16:04 152960 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2010-09-18 16:23 . 2004-03-19 22:38 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53 . 2004-03-19 22:38 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53 . 2004-03-19 22:38 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53 . 2004-03-19 22:38 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-15 08:50 . 2010-04-16 01:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-15 06:29 . 2010-10-19 21:44 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-10-14 02:28 . 2010-04-30 02:38 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]

    [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-26 335872]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "P17Helper"="P17.dll" [2004-06-10 60928]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

    c:\documents and settings\TOM\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtUopmMC]
    [BU]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk
    backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Metacafe.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Metacafe.lnk
    backup=c:\windows\pss\Metacafe.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
    2004-04-11 16:43 53248 ------w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hcsystray]
    2006-11-02 01:46 30928 ----a-w- c:\program files\Kuma Games\hcsystray\hc_tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-09-24 07:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 15:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    2009-03-05 20:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2008-04-09 15:22 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
    2003-08-19 06:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2006-10-19 01:05 204288 ------w- c:\program files\Windows Media Player\wmpnscfg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    "DisableNotifications"= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\AIM\\aim.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AIM7\\aim.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "6881:TCP"= 6881:TCP:bit
    "1043:TCP"= 1043:TCP:Akamai NetSession Interface
    "5000:UDP"= 5000:UDP:Akamai NetSession Interface

    R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [9/23/2006 8:25 PM 646392]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S0 pbrnk;pbrnk;c:\windows\system32\drivers\klmugfn.sys --> c:\windows\system32\drivers\klmugfn.sys [?]
    S1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\SYSTEM32\DRIVERS\mfetdi2k.sys [4/29/2010 9:38 PM 84072]
    S2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [4/29/2010 9:38 PM 271480]
    S2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [4/29/2010 9:38 PM 271480]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [4/29/2010 9:38 PM 188136]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [4/29/2010 9:38 PM 141792]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/15/2007 1:27 PM 24652]
    S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\c:\windows\system32\Drivers\Aldebaran.sys --> c:\windows\system32\Drivers\Aldebaran.sys [?]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\SYSTEM32\DRIVERS\cfwids.sys [4/29/2010 9:38 PM 55840]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\SYSTEM32\DRIVERS\mfefirek.sys [4/29/2010 9:38 PM 313288]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [4/29/2010 9:38 PM 88544]
    S3 mfendiskmp;mfendiskmp;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [4/29/2010 9:38 PM 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\SYSTEM32\DRIVERS\mferkdet.sys [4/29/2010 9:38 PM 84264]
    S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.dell4me.com/myway
    mStart Page = hxxp://www.dell4me.com/myway
    uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
    uInternet Settings,ProxyOverride = *.local
    IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: &Yahoo! Search
    IE: Download All by FlashGet
    IE: Download using FlashGet
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    IE: Yahoo! &Dictionary
    IE: Yahoo! &Maps
    IE: Yahoo! &SMS
    Trusted Zone: aol.com\free
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - ProfilePath - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
    FF - component: c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
    FF - plugin: c:\documents and settings\TOM\Application Data\Move Networks\plugins\npqmp071503000010.dll
    FF - plugin: c:\documents and settings\TOM\Application Data\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Extension: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
    FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
    FF - Extension: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
    FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Extension: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\TOM\Application Data\Move Networks

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{93B98EAB-140E-4570-88E5-2B3377B0C501} - (no file)
    BHO-{ACD121CE-45D9-4E20-99DB-494E6E37F228} - (no file)
    BHO-{B5C7F75F-77D2-4F6A-BB6E-AB6BA30C5505} - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-12-09 18:20
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-3266271178-1978187353-1186075606-1006\Software\Creative Tech\Component Installed\{B17F00C9-19EC-43A2-BD81-44D8E5D4D994}\Object\{00000000-0000-0000-0000-000000000000}\User Settings\8**0 ]
    "AlwaysCovertFormat"=dword:00000000
    "Format"=dword:00000000
    "Format_Channel"=dword:00000002
    "Format_Value"=dword:00000000
    "Format_Quality"=dword:0001f400
    "Encoding Language"=dword:00000000

    [HKEY_USERS\S-1-5-21-3266271178-1978187353-1186075606-1006\Software\Creative Tech\Component Installed\{B17F00C9-19EC-43A2-BD81-44D8E5D4D994}\Object\{00000000-0000-0000-0000-000000000000}\User Settings\x**0 ]
    "AlwaysCovertFormat"=dword:00000000
    "Format"=dword:00000000
    "Format_Channel"=dword:00000002
    "Format_Value"=dword:00000000
    "Format_Quality"=dword:0001f400
    "Encoding Language"=dword:00000000
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(1360)
    c:\progra~1\WINDOW~2\wmpband.dll
    .
    Completion time: 2010-12-09 18:41:18
    ComboFix-quarantined-files.txt 2010-12-09 23:41
    ComboFix2.txt 2010-12-03 03:41
    ComboFix3.txt 2010-12-03 03:17
    ComboFix4.txt 2010-12-02 22:54
    ComboFix5.txt 2010-12-08 00:07

    Pre-Run: 17,965,568,000 bytes free
    Post-Run: 18,010,132,480 bytes free

    Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,4,5
    - - End Of File - - 595C757E9AACA4959EBBC98E178F97E5
     
  7. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Unless you installed Viewpoint Manager knowledgeably...
    Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
    Uninstall any of the following programs associated with Viewpoint:
    * Viewpoint Manager
    * Viewpoint Media Player
    * Viewpoint Toolbar
    This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ("drive-by-install") as it is installed without your consent through programs like AOL, AIM, Compuserve, etc.

    =======================================================================

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\system32\drivers\klmugfn.sys
    
    
    Driver::
    pbrnk
    
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=-
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  8. nismo400r

    nismo400r TS Rookie Topic Starter

    ComboFix 10-12-08.04 - TOM 12/09/2010 22:23:58.12.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.578 [GMT -5:00]
    Running from: c:\documents and settings\TOM\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\TOM\Desktop\CFScript.txt
    AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    FILE ::
    "c:\windows\system32\drivers\klmugfn.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_pbrnk


    ((((((((((((((((((((((((( Files Created from 2010-11-10 to 2010-12-10 )))))))))))))))))))))))))))))))
    .

    2010-12-03 04:21 . 2010-12-03 04:21 -------- d-----w- c:\program files\ERUNT
    2010-12-03 04:07 . 2010-12-03 04:07 -------- d-----w- C:\_OTM
    2010-12-03 01:37 . 2010-12-03 01:37 -------- d-----w- c:\program files\ESET
    2010-12-03 00:45 . 2010-12-03 00:45 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
    2010-12-03 00:39 . 2010-12-03 00:39 -------- d-----w- c:\windows\ERUNT
    2010-12-03 00:11 . 2010-12-03 00:11 -------- d-----w- C:\found.002
    2010-12-03 00:04 . 2010-12-03 01:31 -------- d-----w- C:\SDFix
    2010-12-02 23:56 . 2010-12-02 23:56 388096 ----a-r- c:\documents and settings\TOM\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-12-02 23:56 . 2010-12-02 23:56 -------- d-----w- c:\program files\Trend Micro
    2010-12-02 22:39 . 2010-12-02 22:54 -------- d-----w- C:\N
    2010-12-02 05:00 . 2010-12-02 05:17 -------- d-----w- C:\Combo-Fix27220C
    2010-12-01 02:54 . 2010-12-01 02:54 -------- d-----w- C:\found.001
    2010-11-30 23:33 . 2010-11-30 23:33 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-11-30 23:31 . 2010-11-30 23:31 -------- d-----w- c:\documents and settings\TOM\Local Settings\Application Data\Sunbelt Software
    2010-11-19 10:25 . 2010-11-19 10:25 -------- d-----w- C:\found.000

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-29 22:42 . 2009-08-09 21:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-29 22:42 . 2009-08-09 21:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-14 02:28 . 2010-04-30 02:38 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2010-10-14 02:28 . 2010-04-30 02:38 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2010-10-14 02:28 . 2010-04-30 02:38 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys
    2010-10-14 02:28 . 2010-04-30 02:38 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2010-10-14 02:28 . 2010-04-30 02:38 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
    2010-10-14 02:28 . 2010-04-30 02:38 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2010-10-14 02:28 . 2010-04-30 02:38 313288 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2010-10-14 02:28 . 2007-02-14 16:04 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2010-10-14 02:28 . 2007-02-14 16:04 386840 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2010-10-14 02:28 . 2007-02-14 16:04 152960 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2010-09-18 16:23 . 2004-03-19 22:38 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53 . 2004-03-19 22:38 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53 . 2004-03-19 22:38 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53 . 2004-03-19 22:38 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-15 08:50 . 2010-04-16 01:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-15 06:29 . 2010-10-19 21:44 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-10-14 02:28 . 2010-04-30 02:38 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]

    [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-26 335872]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "P17Helper"="P17.dll" [2004-06-10 60928]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

    c:\documents and settings\TOM\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtUopmMC]
    [BU]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk
    backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Metacafe.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Metacafe.lnk
    backup=c:\windows\pss\Metacafe.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
    2004-04-11 16:43 53248 ------w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hcsystray]
    2006-11-02 01:46 30928 ----a-w- c:\program files\Kuma Games\hcsystray\hc_tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-09-24 07:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 15:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    2009-03-05 20:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2008-04-09 15:22 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
    2003-08-19 06:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2006-10-19 01:05 204288 ------w- c:\program files\Windows Media Player\wmpnscfg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    "DisableNotifications"= 1 (0x1)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\AIM\\aim.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AIM7\\aim.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
    "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "6881:TCP"= 6881:TCP:bit
    "1043:TCP"= 1043:TCP:Akamai NetSession Interface
    "5000:UDP"= 5000:UDP:Akamai NetSession Interface

    R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [9/23/2006 8:25 PM 646392]
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\SYSTEM32\DRIVERS\mfetdi2k.sys [4/29/2010 9:38 PM 84072]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [4/29/2010 9:38 PM 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [4/29/2010 9:38 PM 271480]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [4/29/2010 9:38 PM 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [4/29/2010 9:38 PM 141792]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\SYSTEM32\DRIVERS\cfwids.sys [4/29/2010 9:38 PM 55840]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\SYSTEM32\DRIVERS\mfefirek.sys [4/29/2010 9:38 PM 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [4/29/2010 9:38 PM 88544]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S2 0227231291940928mcinstcleanup;McAfee Application Installer Cleanup (0227231291940928);c:\windows\TEMP\022723~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\windows\TEMP\022723~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
    S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\c:\windows\system32\Drivers\Aldebaran.sys --> c:\windows\system32\Drivers\Aldebaran.sys [?]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [4/29/2010 9:38 PM 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\SYSTEM32\DRIVERS\mferkdet.sys [4/29/2010 9:38 PM 84264]
    S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - 0227231291940928MCINSTCLEANUP
    *Deregistered* - mfeavfk01
    .
    Contents of the 'Scheduled Tasks' folder

    2010-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.dell4me.com/myway
    mStart Page = hxxp://www.dell4me.com/myway
    uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
    uInternet Settings,ProxyOverride = *.local
    IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: &Yahoo! Search
    IE: Download All by FlashGet
    IE: Download using FlashGet
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    IE: Yahoo! &Dictionary
    IE: Yahoo! &Maps
    IE: Yahoo! &SMS
    Trusted Zone: aol.com\free
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - ProfilePath - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
    FF - component: c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
    FF - plugin: c:\documents and settings\TOM\Application Data\Move Networks\plugins\npqmp071503000010.dll
    FF - plugin: c:\documents and settings\TOM\Application Data\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Extension: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
    FF - Extension: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
    FF - Extension: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - c:\documents and settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
    FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Extension: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\TOM\Application Data\Move Networks

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{93B98EAB-140E-4570-88E5-2B3377B0C501} - (no file)
    BHO-{ACD121CE-45D9-4E20-99DB-494E6E37F228} - (no file)
    BHO-{B5C7F75F-77D2-4F6A-BB6E-AB6BA30C5505} - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-12-09 22:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-3266271178-1978187353-1186075606-1006\Software\Creative Tech\Component Installed\{B17F00C9-19EC-43A2-BD81-44D8E5D4D994}\Object\{00000000-0000-0000-0000-000000000000}\User Settings\8**0 ]
    "AlwaysCovertFormat"=dword:00000000
    "Format"=dword:00000000
    "Format_Channel"=dword:00000002
    "Format_Value"=dword:00000000
    "Format_Quality"=dword:0001f400
    "Encoding Language"=dword:00000000

    [HKEY_USERS\S-1-5-21-3266271178-1978187353-1186075606-1006\Software\Creative Tech\Component Installed\{B17F00C9-19EC-43A2-BD81-44D8E5D4D994}\Object\{00000000-0000-0000-0000-000000000000}\User Settings\x**0 ]
    "AlwaysCovertFormat"=dword:00000000
    "Format"=dword:00000000
    "Format_Channel"=dword:00000002
    "Format_Value"=dword:00000000
    "Format_Quality"=dword:0001f400
    "Encoding Language"=dword:00000000
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(420)
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\Ati2evxx.exe
    c:\windows\system32\LEXBCES.EXE
    c:\windows\system32\LEXPPS.EXE
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\CTsvcCDA.EXE
    c:\program files\Juniper Networks\Common Files\dsNcService.exe
    c:\program files\Intel\Intel Application Accelerator\iaantmon.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\System32\MsPMSPSv.exe
    c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
    c:\program files\Windows Media Player\WMPNetwk.exe
    c:\program files\Canon\CAL\CALMAIN.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\Rundll32.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2010-12-09 22:45:00 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-12-10 03:44
    ComboFix2.txt 2010-12-09 23:41
    ComboFix3.txt 2010-12-03 03:41
    ComboFix4.txt 2010-12-03 03:17
    ComboFix5.txt 2010-12-10 03:22

    Pre-Run: 16,830,955,520 bytes free
    Post-Run: 16,849,571,840 bytes free

    Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
    - - End Of File - - 2EC77FA3E9473C499E26D05049749BB5






    After Stage 50 completed received error for PEV.cfxxe
    During reboot, received error message
    "One of the files containing the system's Registry data had to be recovered by use of log or alternate copy. The recovery was successful."
     
  9. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Looks good :)

    How is computer doing?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  10. nismo400r

    nismo400r TS Rookie Topic Starter

    OTL logfile created on: 12/9/2010 11:03:56 PM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\TOM\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1,022.00 Mb Total Physical Memory | 574.00 Mb Available Physical Memory | 56.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 145.49 Gb Total Space | 15.72 Gb Free Space | 10.80% Space Free | Partition Type: NTFS
    Drive D: | 3.89 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

    Computer Name: D4SQSM51 | User Name: TOM | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/12/09 23:03:03 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\OTL.exe
    PRC - [2010/10/13 21:28:54 | 000,188,136 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    PRC - [2010/10/13 21:28:54 | 000,141,792 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    PRC - [2010/09/30 12:10:36 | 001,193,848 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
    PRC - [2010/08/24 13:57:38 | 000,171,168 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    PRC - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2010/03/10 09:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2008/03/31 20:54:06 | 000,507,904 | ---- | M] (Orb Networks) -- C:\Program Files\Winamp Remote\bin\OrbTray.exe
    PRC - [2007/08/10 00:03:36 | 000,423,280 | ---- | M] (Juniper Networks) -- C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
    PRC - [2007/01/31 14:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
    PRC - [2005/11/16 05:49:44 | 005,238,272 | ---- | M] (Linksys) -- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    PRC - [2004/03/23 12:16:16 | 000,135,168 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe
    PRC - [2004/03/23 12:15:40 | 000,073,852 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe
    PRC - [2004/02/06 21:56:14 | 000,041,025 | ---- | M] (GEMTEKS) -- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/12/09 23:03:03 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\OTL.exe
    MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Running] -- C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe WMP54Gv4.exe -- (WMP54Gv4SVC)
    SRV - File not found [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -d -f %ProgramFiles%\WinPcap\rpcapd.ini -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
    SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
    SRV - File not found [Auto | Stopped] -- C:\WINDOWS\TEMP\022723~1.EXE -- (0227231291940928mcinstcleanup) McAfee Application Installer Cleanup (0227231291940928)
    SRV - [2010/10/13 21:28:54 | 000,188,136 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire)
    SRV - [2010/10/13 21:28:54 | 000,141,792 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe -- (mfevtp)
    SRV - [2010/10/07 20:34:28 | 000,364,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
    SRV - [2010/08/24 13:57:38 | 000,171,168 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
    SRV - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/03/10 09:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
    SRV - [2010/03/10 09:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
    SRV - [2010/03/10 09:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
    SRV - [2010/03/10 09:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
    SRV - [2010/03/10 09:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
    SRV - [2007/08/10 00:03:36 | 000,423,280 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService)
    SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
    SRV - [2007/01/31 14:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
    SRV - [2004/03/23 12:15:40 | 000,073,852 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe -- (IAANTMon)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\vaxscsi.sys -- (vaxscsi)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\VERIZO~1\QUICKL~1\SMNDIS5.SYS -- (SMNDIS5)
    DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\PfModNT.sys -- (PfModNT)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\Pcouffin.sys -- (Pcouffin)
    DRV - File not found [File_System | Boot | Stopped] -- C:\WINDOWS\System32\DRIVERS\Lbd.sys -- (Lbd)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\ctpdusb.sys -- (Jukebox3)
    DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\Aldebaran.sys -- (Aldebaran)
    DRV - [2010/10/13 21:28:54 | 000,386,840 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
    DRV - [2010/10/13 21:28:54 | 000,313,288 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfefirek.sys -- (mfefirek)
    DRV - [2010/10/13 21:28:54 | 000,152,960 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys -- (mfeavfk)
    DRV - [2010/10/13 21:28:54 | 000,095,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfeapfk.sys -- (mfeapfk)
    DRV - [2010/10/13 21:28:54 | 000,088,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfendisk.sys -- (mfendiskmp)
    DRV - [2010/10/13 21:28:54 | 000,088,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfendisk.sys -- (mfendisk)
    DRV - [2010/10/13 21:28:54 | 000,084,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mferkdet.sys -- (mferkdet)
    DRV - [2010/10/13 21:28:54 | 000,084,072 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfetdi2k.sys -- (mfetdi2k)
    DRV - [2010/10/13 21:28:54 | 000,055,840 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\cfwids.sys -- (cfwids)
    DRV - [2010/10/13 21:28:54 | 000,052,104 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys -- (mfebopk)
    DRV - [2009/09/16 09:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys -- (mfesmfk)
    DRV - [2009/09/16 09:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys -- (mferkdk)
    DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)
    DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)
    DRV - [2007/08/09 23:47:54 | 000,023,552 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dsNcAdpt.sys -- (dsNcAdpt)
    DRV - [2007/03/29 23:41:37 | 000,646,392 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
    DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys -- (dsunidrv)
    DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
    DRV - [2005/10/27 14:06:30 | 000,356,096 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\rt61.sys -- (RT61) Linksys Wireless-G PCI Adapter Driver(RT61)
    DRV - [2004/06/09 12:16:00 | 000,840,960 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\P17.sys -- (P17)
    DRV - [2004/05/29 17:41:54 | 000,186,112 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\b57xp32.sys -- (b57w2k)
    DRV - [2004/05/25 23:19:00 | 000,729,600 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys -- (ati2mtag)
    DRV - [2004/03/23 12:13:58 | 000,467,200 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor)
    DRV - [2004/03/15 01:04:00 | 000,100,597 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys -- (tfsnudfa)
    DRV - [2004/03/15 01:04:00 | 000,098,580 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys -- (tfsnudf)
    DRV - [2004/03/15 01:04:00 | 000,085,972 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys -- (tfsnifs)
    DRV - [2004/03/15 01:04:00 | 000,034,837 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys -- (tfsncofs)
    DRV - [2004/03/15 01:04:00 | 000,025,685 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys -- (tfsnboio)
    DRV - [2004/03/15 01:04:00 | 000,014,229 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys -- (tfsnopio)
    DRV - [2004/03/15 01:04:00 | 000,006,357 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys -- (tfsnpool)
    DRV - [2004/03/15 01:04:00 | 000,004,117 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys -- (tfsndrct)
    DRV - [2004/03/15 01:04:00 | 000,002,233 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndres.sys -- (tfsndres)
    DRV - [2004/03/05 22:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys -- (IntelC52)
    DRV - [2004/03/05 22:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys -- (IntelC51)
    DRV - [2004/03/05 22:13:52 | 000,060,949 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys -- (IntelC53)
    DRV - [2004/03/05 22:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys -- (mohfilt)
    DRV - [2004/02/27 02:56:00 | 000,040,480 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys -- (drvnddm)
    DRV - [2004/02/13 03:21:00 | 000,086,160 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
    DRV - [2004/01/14 19:18:16 | 000,005,621 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys -- (sscdbhk5)
    DRV - [2004/01/14 19:18:04 | 000,023,219 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys -- (ssrtln)
    DRV - [2003/09/22 08:48:00 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctsfm2k.sys -- (ctsfm2k)
    DRV - [2003/09/22 08:47:00 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctoss2k.sys -- (ossrv)
    DRV - [2002/11/08 13:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
    DRV - [2002/08/29 11:14:48 | 000,039,552 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ser2pl.sys -- (Ser2pl)
    DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow)
    DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3)
    DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi)
    DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx)
    DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810)
    DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra)
    DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160)
    DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080)
    DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280)
    DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k)
    DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x)
    DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc)
    DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550)
    DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde)
    DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
    IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
    FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
    FF - prefs.js..browser.search.selectedEngine: "Google"
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7
    FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.3
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
    FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
    FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="


    FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/04/09 10:23:26 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\flashcatch@flashcatch.com: C:\Program Files\FlashCatch\firefox [2009/07/02 19:11:37 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/04 16:25:47 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/09 22:19:46 | 000,000,000 | ---D | M]

    [2008/08/29 19:04:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Mozilla\Extensions
    [2010/12/09 22:03:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions
    [2010/02/16 18:27:03 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
    [2010/10/27 17:24:35 | 000,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
    [2010/03/23 18:46:28 | 000,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}(2)
    [2010/04/27 16:37:12 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2009/03/19 06:06:44 | 000,000,000 | ---D | M] (Bookmark Duplicate Detector) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{ba243cb0-b824-4a26-9418-73ee795d9b9d}
    [2007/06/20 21:37:40 | 000,000,000 | ---D | M] (Yahoo! Photos Easy Upload Tool) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{DD99D76F-5129-4fd3-A2DC-AB41D6FBCF98}
    [2010/11/16 22:18:36 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
    [2008/09/06 23:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\refspoof@mozdev.org
    [2010/07/21 18:56:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\extensions\support@ancestry.com
    [2008/06/07 10:08:47 | 000,001,769 | ---- | M] () -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\searchplugins\aim-search.xml
    [2008/02/18 12:10:22 | 000,000,998 | ---- | M] () -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\searchplugins\aolsearch.gif
    [2008/02/18 12:10:22 | 000,000,293 | ---- | M] () -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\searchplugins\aolsearch.src
    [2007/12/26 12:19:56 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\searchplugins\aolsearch.xml
    [2010/02/16 20:33:23 | 000,001,201 | ---- | M] () -- C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\69bh29k8.Default User\searchplugins\winamp-search.xml
    [2010/12/09 22:03:15 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/04/15 20:58:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/08/17 21:47:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    [2010/10/19 16:45:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2010/10/13 21:28:54 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Mozilla Firefox\components\Scriptff.dll
    [2010/09/15 03:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    [2005/12/05 21:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
    [2010/07/12 11:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

    O1 HOSTS File: ([2010/12/09 22:39:06 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - No CLSID value found.
    O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
    O2 - BHO: (no name) - {69D72956-317C-44bd-B369-8E44D4EF9801} - No CLSID value found.
    O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20101103172236.dll (McAfee, Inc.)
    O2 - BHO: (FlashCatchBHO Class) - {88618A96-6D8A-42E7-B932-9073D5B2080F} - C:\Program Files\FlashCatch\flashcatch.dll (Level 9 Technology, Inc.)
    O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (FlashCatch) - {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - C:\Program Files\FlashCatch\flashcatch.dll (Level 9 Technology, Inc.)
    O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (AIM Search) - {40D41A8B-D79B-43D7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll File not found
    O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
    O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\IAAnotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
    O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
    O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
    O4 - HKCU..\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks)
    O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - Startup: C:\Documents and Settings\TOM\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BackupNoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1
    O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
    O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
    O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
    O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - File not found
    O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409 (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.)
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab (McAfee.com Operating System Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab (DwnldGroupMgr Class)
    O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} http://fdl.msn.com/zone/datafiles/heartbeat.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.250.0.12
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\vtUopmMC: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
    O24 - Desktop WallPaper: C:\Documents and Settings\TOM\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\TOM\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O29 - HKLM SecurityProviders - (zwebauth.dll) - C:\WINDOWS\System32\ZWebAuth.dll ()
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/03/20 12:58:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O35 - HKCU\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKCU\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
    Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks)
    Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivXNetworks)
    Drivers32: wave1 - C:\WINDOWS\System32\SERWVDRV.DLL (Microsoft Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (16902109354000384)
     
  11. nismo400r

    nismo400r TS Rookie Topic Starter

    ========== Files - Modified Within 30 Days ==========

    [2010/12/09 23:03:03 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\OTL.exe
    [2010/12/09 22:39:06 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
    [2010/12/09 22:38:20 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
    [2010/12/09 22:38:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
    [2010/12/09 22:38:03 | 1071,812,608 | -HS- | M] () -- C:\hiberfil.sys
    [2010/12/09 22:21:05 | 003,987,287 | R--- | M] () -- C:\Documents and Settings\TOM\Desktop\ComboFix.exe
    [2010/12/09 18:02:20 | 003,987,287 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\tom_gray.exe
    [2010/12/09 17:30:57 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\MBRCheck.exe
    [2010/12/08 21:26:19 | 000,002,185 | ---- | M] () -- C:\WINDOWS\wininit.ini
    [2010/12/08 18:09:05 | 007,622,112 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\TOM\Desktop\mbam-setup-1.50.0.0.exe
    [2010/12/08 18:00:53 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\TFC.exe
    [2010/12/08 17:54:50 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\8wr2lx9o.exe
    [2010/12/08 17:33:21 | 000,624,128 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\dds.scr
    [2010/12/08 07:04:46 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\ef5y5kyy.exe
    [2010/12/07 23:38:07 | 009,852,776 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\TOM\Desktop\SUPERAntiSpyware.exe
    [2010/12/07 19:56:47 | 002,015,550 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\bookmarks-2010-12-07.json
    [2010/12/03 00:21:10 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/12/03 00:06:13 | 005,292,054 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\prevx3.bmp
    [2010/12/02 23:55:25 | 000,945,272 | ---- | M] (Prevx) -- C:\Documents and Settings\TOM\Desktop\prevxcsifree.exe
    [2010/12/02 23:21:37 | 000,000,767 | ---- | M] () -- C:\Documents and Settings\TOM\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2010/12/02 23:21:24 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\ERUNT.lnk
    [2010/12/02 22:21:11 | 003,983,920 | R--- | M] () -- C:\Documents and Settings\TOM\Desktop\Combo-Fix.exe
    [2010/12/02 19:03:12 | 001,529,241 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\SDFix.exe
    [2010/12/02 18:56:27 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\HiJackThis.lnk
    [2010/12/01 22:06:21 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
    [2010/11/30 22:01:03 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/11/30 18:51:01 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\OTM.exe
    [2010/11/30 18:33:47 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
    [2010/11/30 18:13:12 | 133,432,520 | ---- | M] (Lavasoft ) -- C:\Documents and Settings\TOM\Desktop\AdwareInstall.exe
    [2010/11/30 17:27:17 | 000,000,054 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
    [2010/11/30 17:27:17 | 000,000,039 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
    [2010/11/29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/11/29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/11/26 13:51:15 | 000,206,848 | ---- | M] () -- C:\Documents and Settings\TOM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/11/26 13:45:25 | 005,292,054 | ---- | M] () -- C:\Documents and Settings\TOM\My Documents\posters.bmp
    [2010/11/17 23:04:39 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\TOM\My Documents\Book1.xls
    [2010/11/11 01:12:42 | 000,035,840 | ---- | M] () -- C:\Documents and Settings\TOM\My Documents\pstars.xls
    [2010/11/11 00:34:12 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

    ========== Files Created - No Company Name ==========

    [2010/12/09 18:43:01 | 1071,812,608 | -HS- | C] () -- C:\hiberfil.sys
    [2010/12/09 18:02:20 | 003,987,287 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\tom_gray.exe
    [2010/12/09 17:41:17 | 003,987,287 | R--- | C] () -- C:\Documents and Settings\TOM\Desktop\ComboFix.exe
    [2010/12/09 17:30:56 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\MBRCheck.exe
    [2010/12/08 17:54:50 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\8wr2lx9o.exe
    [2010/12/08 17:33:21 | 000,624,128 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\dds.scr
    [2010/12/08 07:04:44 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\ef5y5kyy.exe
    [2010/12/07 19:56:41 | 002,015,550 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\bookmarks-2010-12-07.json
    [2010/12/03 00:06:13 | 005,292,054 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\prevx3.bmp
    [2010/12/02 23:21:37 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\TOM\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2010/12/02 23:21:24 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\ERUNT.lnk
    [2010/12/02 22:20:23 | 003,983,920 | R--- | C] () -- C:\Documents and Settings\TOM\Desktop\Combo-Fix.exe
    [2010/12/02 19:03:12 | 001,529,241 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\SDFix.exe
    [2010/12/02 18:56:13 | 000,002,443 | ---- | C] () -- C:\Documents and Settings\TOM\Desktop\HiJackThis.lnk
    [2010/12/01 21:52:45 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/11/26 13:45:24 | 005,292,054 | ---- | C] () -- C:\Documents and Settings\TOM\My Documents\posters.bmp
    [2010/11/17 23:04:39 | 000,013,824 | ---- | C] () -- C:\Documents and Settings\TOM\My Documents\Book1.xls
    [2010/11/10 21:09:22 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
    [2010/11/10 21:09:22 | 000,000,039 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
    [2009/12/29 19:46:48 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
    [2009/08/13 16:03:18 | 000,002,188 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
    [2008/12/25 22:29:52 | 000,029,184 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/12/13 14:28:22 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
    [2008/12/13 14:28:22 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
    [2007/08/25 10:16:05 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll
    [2007/08/25 10:15:51 | 000,000,890 | ---- | C] () -- C:\WINDOWS\System32\WLAN.INI
    [2007/04/17 14:42:30 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2007/04/13 19:37:50 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
    [2007/02/09 14:58:05 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
    [2006/11/18 17:05:08 | 000,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
    [2006/10/11 22:56:46 | 000,000,329 | ---- | C] () -- C:\WINDOWS\httpweazel.ini
    [2006/10/10 20:49:23 | 000,000,122 | ---- | C] () -- C:\WINDOWS\webserv.ini
    [2006/09/23 20:25:05 | 000,646,392 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
    [2006/01/12 21:22:45 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\CtSACKey.sys
    [2005/11/28 13:27:17 | 000,000,026 | ---- | C] () -- C:\WINDOWS\UpdaterDVW58E.INI
    [2005/09/11 14:50:16 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
    [2005/09/11 14:50:16 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
    [2005/09/11 14:50:16 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
    [2005/09/11 14:50:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
    [2005/09/11 14:50:15 | 000,000,342 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
    [2005/08/31 17:40:50 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2005/04/27 23:22:38 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
    [2005/04/27 23:22:34 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
    [2005/04/27 23:22:34 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
    [2004/12/22 20:25:05 | 000,001,876 | ---- | C] () -- C:\WINDOWS\CA533A.INI
    [2004/10/04 17:39:46 | 000,001,125 | ---- | C] () -- C:\WINDOWS\winamp.ini
    [2004/09/25 19:51:47 | 000,053,121 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
    [2004/09/22 21:53:31 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2004/09/12 16:35:26 | 000,016,973 | ---- | C] () -- C:\WINDOWS\System32\ZWebAuth.dll
    [2004/09/11 19:04:05 | 000,206,848 | ---- | C] () -- C:\Documents and Settings\TOM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2004/09/11 12:08:37 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\TOM\Application Data\PFP120JPR.{PB
    [2004/09/11 12:08:37 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\TOM\Application Data\PFP120JCM.{PB
    [2004/09/11 11:36:35 | 000,000,375 | ---- | C] () -- C:\WINDOWS\dellstat.ini
    [2004/09/09 00:32:54 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2004/09/09 00:24:47 | 000,002,185 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2004/09/09 00:22:59 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI
    [2004/09/09 00:22:53 | 000,060,928 | ---- | C] () -- C:\WINDOWS\System32\P17.dll
    [2004/09/09 00:22:53 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\P17CPI.dll
    [2004/09/09 00:22:53 | 000,003,278 | ---- | C] () -- C:\WINDOWS\System32\LudaP17.ini
    [2004/09/09 00:22:53 | 000,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
    [2004/09/09 00:22:47 | 000,000,072 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
    [2004/09/09 00:10:34 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2004/09/08 23:53:36 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2004/08/13 17:24:57 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
    [2004/03/26 16:59:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2004/03/20 13:21:34 | 000,000,791 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
    [2004/03/20 12:58:20 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/03/19 17:37:28 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
    [2004/02/10 14:08:00 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
    [2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
    [2002/11/13 14:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll
    [2002/03/16 19:00:00 | 000,007,420 | ---- | C] () -- C:\WINDOWS\UA000022.DLL
    [1997/06/13 19:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
    [1980/01/01 00:00:00 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll

    ========== LOP Check ==========

    [2008/11/17 17:33:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
    [2010/05/18 18:46:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
    [2008/10/02 21:31:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AnyCapture
    [2010/07/20 23:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OrbNetworks
    [2009/07/08 20:47:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2006/10/11 22:56:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems
    [2010/12/09 22:19:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
    [2010/03/30 21:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2009/11/11 17:06:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2005/04/24 20:21:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\.BitTornado
    [2007/05/05 11:35:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\acccore
    [2009/06/27 21:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Aim
    [2005/08/22 13:38:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\DeepBurner
    [2010/08/25 18:06:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\FreeFLVConverter
    [2006/10/10 02:17:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\HTML Executable
    [2007/09/04 14:55:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Juniper Networks
    [2006/02/27 22:29:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\last.fm
    [2004/09/11 20:31:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Leadertech
    [2009/07/08 20:39:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Moyea
    [2008/03/01 18:17:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Music Label
    [2007/05/02 14:50:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\MusicIP
    [2008/11/30 20:50:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\MyPublisher
    [2004/09/19 20:22:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Neo-Modus.com
    [2006/10/28 00:09:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Opera
    [2005/12/10 00:02:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Seven Zip
    [2008/02/12 14:23:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\SmartDraw
    [2006/09/10 17:48:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\Ulead Systems
    [2006/11/17 19:19:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\VSO_HWE
    [2004/09/12 20:53:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TOM\Application Data\WeatherBug

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2010/11/30 18:35:13 | 000,064,697 | ---- | M] () -- C:\aaw7boot.log
    [2004/09/16 00:02:19 | 016,706,160 | ---- | M] (Netopsystems AG) -- C:\AdbeRdr60_enu_full.exe
    [2004/03/20 12:58:32 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2009/08/13 19:09:33 | 000,000,281 | ---- | M] () -- C:\Boot.bak
    [2010/12/01 22:06:21 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/12/09 22:45:00 | 000,021,246 | ---- | M] () -- C:\ComboFix.txt
    [2004/03/20 12:58:32 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2004/09/09 00:01:36 | 000,005,857 | RH-- | M] () -- C:\DELL.SDR
    [2005/01/04 19:46:54 | 000,000,061 | ---- | M] () -- C:\DVDPATH.TXT
    [2005/01/27 00:00:42 | 001,624,169 | ---- | M] () -- C:\EasyShareInstall.log
    [2004/09/15 18:38:33 | 004,742,005 | ---- | M] (Mozilla) -- C:\FireFox.exe
    [2010/12/09 22:38:03 | 1071,812,608 | -HS- | M] () -- C:\hiberfil.sys
    [2004/03/20 12:58:32 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
    [2010/05/18 18:46:33 | 000,002,529 | -H-- | M] () -- C:\IPH.PH
    [2010/11/30 19:34:03 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
    [2004/03/20 12:58:32 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
    [2004/09/25 15:05:43 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/08/21 16:53:00 | 000,250,048 | RHS- | M] () -- C:\NTLDR
    [2009/06/15 05:59:41 | 000,000,000 | ---- | M] () -- C:\OrbPVR.db
    [2010/12/09 22:38:02 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
    [2004/09/15 23:44:02 | 006,811,656 | ---- | M] (Adobe Systems, Inc. ) -- C:\psa201se_us.exe
    [2004/09/09 00:25:57 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
    [2009/02/14 18:56:19 | 000,000,162 | ---- | M] () -- C:\YServer.txt

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/03/20 12:58:06 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\DESKTOP.INI

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2003/07/29 08:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\DLBCPP5C.DLL
    [2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\filterpipelineprintproc.dll
    [2003/06/18 16:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\mdippr.dll
    [2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/03/20 12:49:04 | 000,094,208 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
    [2004/03/20 12:49:04 | 000,626,688 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
    [2004/03/20 12:49:02 | 000,421,888 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2008/08/21 16:58:38 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2008/08/21 17:25:13 | 000,000,198 | -HS- | M] () -- C:\Documents and Settings\TOM\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
    [2004/09/10 19:04:12 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\TOM\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/12/08 17:54:50 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\8wr2lx9o.exe
    [2010/11/30 18:13:12 | 133,432,520 | ---- | M] (Lavasoft ) -- C:\Documents and Settings\TOM\Desktop\AdwareInstall.exe
    [2010/12/02 22:21:11 | 003,983,920 | R--- | M] () -- C:\Documents and Settings\TOM\Desktop\Combo-Fix.exe
    [2010/12/09 22:21:05 | 003,987,287 | R--- | M] () -- C:\Documents and Settings\TOM\Desktop\ComboFix.exe
    [2010/12/08 07:04:46 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\ef5y5kyy.exe
    [2009/11/11 16:50:42 | 093,226,280 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\TOM\Desktop\iTunesSetup.exe
    [2010/12/08 18:09:05 | 007,622,112 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\TOM\Desktop\mbam-setup-1.50.0.0.exe
    [2010/12/09 17:30:57 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\MBRCheck.exe
    [2010/12/09 23:03:03 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\OTL.exe
    [2010/11/30 18:51:01 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\OTM.exe
    [2010/12/02 23:55:25 | 000,945,272 | ---- | M] (Prevx) -- C:\Documents and Settings\TOM\Desktop\prevxcsifree.exe
    [2010/12/02 19:03:12 | 001,529,241 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\SDFix.exe
    [2010/12/07 23:38:07 | 009,852,776 | ---- | M] (SUPERAntiSpyware.com) -- C:\Documents and Settings\TOM\Desktop\SUPERAntiSpyware.exe
    [2010/12/08 18:00:53 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\TOM\Desktop\TFC.exe
    [2010/12/09 18:02:20 | 003,987,287 | ---- | M] () -- C:\Documents and Settings\TOM\Desktop\tom_gray.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >
    [2010/07/21 18:53:37 | 000,055,088 | ---- | M] () -- C:\Documents and Settings\TOM\My Documents\MFInstall.exe

    < %USERPROFILE%\*.exe >
    [2006/06/09 13:45:18 | 000,389,120 | ---- | M] (Citrix Online) -- C:\Documents and Settings\TOM\remote.exe

    < %systemroot%\ADDINS\*.* >
    [2004/03/19 17:37:26 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\FXSEXT.ECF

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2008/08/21 17:25:13 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\TOM\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/12/09 23:05:04 | 000,081,920 | ---- | M] () -- C:\Documents and Settings\TOM\Cookies\INDEX.DAT

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\INF\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2002/12/17 10:23:28 | 000,015,692 | ---- | M] () -- C:\Program Files\Messenger\license.txt
    [2002/12/17 10:23:22 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2002/12/17 10:23:22 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2002/12/17 10:23:28 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
    [2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2002/08/20 15:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\MSMSGSIN.EXE
    [2002/12/17 10:23:18 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2002/12/17 10:23:18 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2002/12/17 10:23:18 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2006/11/27 20:17:54 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
    [2002/12/17 10:23:24 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/07/17 13:41:04 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F7B65412

    < End of report >


    OTL Extras logfile created on: 12/9/2010 11:03:56 PM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\TOM\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1,022.00 Mb Total Physical Memory | 574.00 Mb Available Physical Memory | 56.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 145.49 Gb Total Space | 15.72 Gb Free Space | 10.80% Space Free | Partition Type: NTFS
    Drive D: | 3.89 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

    Computer Name: D4SQSM51 | User Name: TOM | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22002
    "6881:TCP" = 6881:TCP:*:Enabled:bit
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "1043:TCP" = 1043:TCP:*:Enabled:Akamai NetSession Interface
    "5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
    "C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer -- (RealNetworks, Inc.)
    "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
    "C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)
    "C:\Program Files\AIM7\aim.exe" = C:\Program Files\AIM7\aim.exe:*:Enabled:AIM -- (AOL Inc.)
    "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host -- (McAfee, Inc.)
    "C:\Program Files\Winamp Remote\bin\Orb.exe" = C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb -- (Orb Networks, Inc.)
    "C:\Program Files\Winamp Remote\bin\OrbTray.exe" = C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray -- (Orb Networks)
    "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe" = C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- (Orb Networks)
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
    "{04410044-9149-45C6-A806-F2BF9CFCE762}" = Microsoft Encarta Encyclopedia Standard 2004
    "{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
    "{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
    "{11B569C2-4BF6-4ED0-9D17-A4273943CB24}" = Adobe Photoshop Album 2.0 Starter Edition
    "{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center
    "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
    "{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
    "{1ADE23D7-7A1E-4AEC-BA5D-EB8A01BED943}" = DeepBurner v1.5.1.192
    "{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari
    "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD
    "{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
    "{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
    "{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 22
    "{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
    "{2E086814-7392-4E0F-ADB8-54A81E47406C}" = Broadcom Advanced Control Suite 2
    "{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
    "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
    "{4734A5FD-DF4B-4F6E-B58D-DED6273AEE62}" = ViviCam 3345
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4DDC3BED-CC68-44AA-B435-D727B620CA5B}" = Linksys Wireless-G PCI Adapter
    "{5A2043B1-38DE-4109-BCD7-7656ADFE17AC}_is1" = Power RM AVI MPG VCD WMV Converter 6.0
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.1
    "{68D60342-7686-45C9-B8EB-40EF843D0460}" = Dell Networking Guide
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
    "{7585478E9D9B42108671C12F8714CEFE}" = DivX Converter
    "{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
    "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
    "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
    "{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition
    "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
    "{8C2690CF-5B74-4F93-8139-7B5644CD6A3B}" = MobileMe Control Panel
    "{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Application Accelerator
    "{90D55A3F-1D99-4C94-A77E-46DC14F0BF08}" = Help and Support Customization
    "{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
    "{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9B2CFE3B-7F55-4786-A20D-BB244914F6D8}" = EarthLink Setup Files
    "{A0AB2980-1FDD-4b6c-940C-FC87C84F05B7}_is1" = FlashCatch
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
    "{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
    "{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
    "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
    "{BC467935-A9A5-4D0F-BD89-94F36CDF0524}" = Adobe Stock Photos 1.0
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C2788D0D-B02E-46E5-9ABE-67E1F4B73382}_is1" = VideoThumber 1.0
    "{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
    "{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{CEB481CC-F57C-4397-81A0-DADD22257047}" = Sound Blaster Live! 24-bit
    "{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
    "{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
    "{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
    "{FB11BC46-7504-4877-87E4-4034D4133A2C}" = SPSS 13.0 for Windows Student Version
    "{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
    "{FC4ED75D-916C-4A8C-BB67-3C6F6E06D62B}" = Banctec Service Agreement
    "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "AIM_7" = AIM 7
    "AOL Instant Messenger" = AOL Instant Messenger
    "ATI Display Driver" = ATI Display Driver
    "AviSynth" = AviSynth 2.5
    "ca_musiclabel_is1" = Music Label 2009 v15.0.3
    "CAL" = Canon Camera Access Library
    "CameraWindowDC" = Canon Utilities CameraWindow DC
    "CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    "CameraWindowLauncher" = Canon Utilities CameraWindow
    "Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
    "CSCLIB" = Canon Camera Support Core Library
    "Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
    "Dell Photo Printer 720" = Dell Photo Printer 720
    "EOS Utility" = Canon Utilities EOS Utility
    "ERUNT_is1" = ERUNT 1.1j
    "ESET Online Scanner" = ESET Online Scanner v3
    "Free FLV Converter_is1" = Free FLV Converter V 6.92.0
    "GenoPro" = GenoPro 2.0.1.4
    "HTMLExecutableIERuntimeSetup44" = HTML Executable IERuntime
    "InstallShield_{2E086814-7392-4E0F-ADB8-54A81E47406C}" = Broadcom Advanced Control Suite 2
    "Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem
    "Juniper Network Connect 6.0.0" = Juniper Networks Network Connect 6.0.0
    "KLiteCodecPack_is1" = K-Lite Codec Pack 5.1.0 (Basic)
    "LG USB Drivers" = LG USB Drivers
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
    "Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
    "MSC" = McAfee SecurityCenter
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "MVApplication1" = SureThing CD Labeler SE - Sonic
    "MyCamera" = Canon Utilities MyCamera
    "MyCameraDC" = Canon Utilities MyCamera DC
    "NeroVision!UninstallKey" = Nero Digital
    "Orb" = Winamp Remote
    "PhotoStitch" = Canon Utilities PhotoStitch
    "RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
    "RealPlayer 6.0" = RealPlayer
    "RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
    "Shockwave" = Shockwave
    "SoftwareUpdUtility" = Download Updater (AOL LLC)
    "StreetPlugin" = Learn2 Player (Uninstall Only)
    "Winamp" = Winamp
    "Winamp Toolbar" = Winamp Toolbar
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WinRAR archiver" = WinRAR archiver
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Yahoo! Internet Mail" = Yahoo! Internet Mail
    "ZC Video Converter_is1" = ZC Video Converter 1.8.4
    "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
    "ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Move Media Player" = Move Media Player
    "Winamp Detect" = Winamp Detector Plug-in
     
  12. nismo400r

    nismo400r TS Rookie Topic Starter

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 12/9/2010 6:42:12 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application grep.exe, version 0.0.0.0, faulting module grep.exe,
    version 0.0.0.0, fault address 0x00009216.

    Error - 12/9/2010 6:55:55 PM | Computer Name = D4SQSM51 | Source = McLogEvent | ID = 5022
    Description = MCSCAN32 Engine Initialisation failed. Engine returned error : 8

    Error - 12/9/2010 7:21:24 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application grep.cfxxe, version 0.0.0.0, faulting module
    grep.cfxxe, version 0.0.0.0, fault address 0x0000956a.

    Error - 12/9/2010 7:39:22 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application grep.cfxxe, version 0.0.0.0, faulting module
    grep.cfxxe, version 0.0.0.0, fault address 0x00009216.

    Error - 12/9/2010 7:39:29 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application sed.cfxxe, version 0.0.0.0, faulting module sed.cfxxe,
    version 0.0.0.0, fault address 0x0000d7f0.

    Error - 12/9/2010 7:39:54 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application pev.cfxxe, version 0.0.0.0, faulting module pev.cfxxe,
    version 0.0.0.0, fault address 0x000ce040.

    Error - 12/9/2010 7:40:06 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application grep.cfxxe, version 0.0.0.0, faulting module
    grep.cfxxe, version 0.0.0.0, fault address 0x00009216.

    Error - 12/9/2010 7:44:24 PM | Computer Name = D4SQSM51 | Source = McLogEvent | ID = 5022
    Description = MCSCAN32 Engine Initialisation failed. Engine returned error : 8

    Error - 12/9/2010 11:34:15 PM | Computer Name = D4SQSM51 | Source = Application Error | ID = 1000
    Description = Faulting application pev.cfxxe, version 0.0.0.0, faulting module unknown,
    version 0.0.0.0, fault address 0x00341271.

    Error - 12/9/2010 11:38:41 PM | Computer Name = D4SQSM51 | Source = McLogEvent | ID = 5022
    Description = MCSCAN32 Engine Initialisation failed. Engine returned error : 8

    [ System Events ]
    Error - 12/9/2010 7:11:05 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service McNaiAnn with
    arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

    Error - 12/9/2010 7:11:05 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service McNaiAnn with
    arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

    Error - 12/9/2010 7:11:05 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service McNaiAnn with
    arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

    Error - 12/9/2010 7:40:25 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service netman with
    arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

    Error - 12/9/2010 7:42:13 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service EventSystem
    with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

    Error - 12/9/2010 8:54:54 PM | Computer Name = D4SQSM51 | Source = MRxSmb | ID = 8003
    Description = The master browser has received a server announcement from the computer
    D39BSD21 that believes that it is the master browser for the domain on transport
    NetBT_Tcpip_{5F6E4E6E-3911-49BB-. The master browser is stopping or an election
    is being forced.

    Error - 12/9/2010 11:23:10 PM | Computer Name = D4SQSM51 | Source = WMPNetworkSvc | ID = 866312
    Description = A new media server was not initialized because WMCreateDeviceRegistration()
    encountered error '0xc00d2711'. The Windows Media DRM components on your computer
    might be corrupted. Verify that protected files play correctly in Windows Media
    Player, and then restart the WMPNetworkSvc service.

    Error - 12/9/2010 11:23:11 PM | Computer Name = D4SQSM51 | Source = WMPNetworkSvc | ID = 866312
    Description = A new media server was not initialized because WMCreateDeviceRegistration()
    encountered error '0xc00d2711'. The Windows Media DRM components on your computer
    might be corrupted. Verify that protected files play correctly in Windows Media
    Player, and then restart the WMPNetworkSvc service.

    Error - 12/9/2010 11:41:01 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10010
    Description = The server {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A} did not register
    with DCOM within the required timeout.

    Error - 12/9/2010 11:41:37 PM | Computer Name = D4SQSM51 | Source = DCOM | ID = 10010
    Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register
    with DCOM within the required timeout.


    < End of report >
     
  13. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    You didn't say:
     
  14. nismo400r

    nismo400r TS Rookie Topic Starter

    was doing ok, then spoke to soon, minute or two ago shut itself down to prevent damage, wrote down some of the info don't know if it is useful. AV still disabled.
     
  15. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
      O2 - BHO: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - No CLSID value found.
      O2 - BHO: (no name) - {69D72956-317C-44bd-B369-8E44D4EF9801} - No CLSID value found.
      O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
      O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
      O3 - HKCU\..\Toolbar\WebBrowser: (AIM Search) - {40D41A8B-D79B-43D7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll File not found
      O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
      O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
      O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
      O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - File not found
      O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...1F/wmvadvd.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
      O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} http://fdl.msn.com/zone/datafiles/heartbeat.cab (Reg Error: Key error.)
      O20 - Winlogon\Notify\vtUopmMC: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
      [2010/12/09 22:19:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
      @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F7B65412
      
      
      :Services
      
      :Reg
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
      "DisableMonitoring" =-
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
      "DisableMonitoring" =-
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ========================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  16. nismo400r

    nismo400r TS Rookie Topic Starter

    All processes killed
    ========== OTL ==========
    Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69D72956-317C-44bd-B369-8E44D4EF9801}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69D72956-317C-44bd-B369-8E44D4EF9801}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{40D41A8B-D79B-43D7-99A7-9EE0F344C385} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40D41A8B-D79B-43D7-99A7-9EE0F344C385}\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UpdReg deleted successfully.
    C:\WINDOWS\Updreg.EXE moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{d81ca86b-ef63-42af-bee3-4502d9a03c2d}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d81ca86b-ef63-42af-bee3-4502d9a03c2d}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ deleted successfully.
    Starting removal of ActiveX control {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
    Starting removal of ActiveX control {41564D57-9980-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\wmvadvd.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{41564D57-9980-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41564D57-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{41564D57-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41564D57-9980-0010-8000-00AA00389B71}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {E5D419D6-A846-4514-9FAD-97E826C84822}
    C:\WINDOWS\Downloaded Program Files\heartbeat.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E5D419D6-A846-4514-9FAD-97E826C84822}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5D419D6-A846-4514-9FAD-97E826C84822}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E5D419D6-A846-4514-9FAD-97E826C84822}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5D419D6-A846-4514-9FAD-97E826C84822}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtUopmMC\ deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:F7B65412 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\\DisableMonitoring deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 65716 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: TOM
    ->Temp folder emptied: 2233 bytes
    ->Temporary Internet Files folder emptied: 173951 bytes
    ->Java cache emptied: 24659 bytes
    ->FireFox cache emptied: 46571238 bytes
    ->Flash cache emptied: 6799 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 34694 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 45.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: TOM
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.3 log created on 12102010_000316

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...



    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 3
    Internet Explorer 6 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Disabled!
    ESET Online Scanner v3
    McAfee SecurityCenter
    Antivirus up to date! (On Access scanning disabled!)
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 22
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 7.1.0
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.6.6) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    ````````````````````````````````
    DNS Vulnerability Check:

    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````
     
  17. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Follow my last instructions please.
     
  18. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Update Internet Explorer to at least version 7. Version 6 is obsolete and thus dangerous.

    Update Firefox to the latest 3.6.12 version.

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button
     
  19. nismo400r

    nismo400r TS Rookie Topic Starter

    No threats found by ESET...time for sleep for me tonight. Thanks for your help, let me know if I should just say screw it and try and re-install windows or something similar.
     
  20. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    No reason for reinstall whatsoever.

    Follow steps from my previous reply and when you're done....

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
  21. nismo400r

    nismo400r TS Rookie Topic Starter

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 56502 bytes

    User: LocalService
    ->Temp folder emptied: 65984 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: TOM
    ->Temp folder emptied: 4121430 bytes
    ->Temporary Internet Files folder emptied: 550520 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 63934704 bytes
    ->Flash cache emptied: 343 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 364658 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 66.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: TOM
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.17.3 log created on 12102010_101146

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
  22. nismo400r

    nismo400r TS Rookie Topic Starter

    Computer is alright. AV is still disabled though, McAfee, what should I do about that? Currently working with Secunia PSI, updating all those holes.


    *Edit* After the install of some windows updates, had a forced reboot and CHKDSk ran again, next thing I see is "the computer shut down to prevent damage."
     
  23. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Uninstall McAfee, using this tool: http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml
    Reinstall.

    As for the other problem, you may have some hardware issue.
    In this forum, we make sure, your computer is free of malware and your computer is clean :)
    Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
    You'll get more attention.
     
  24. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    The issue seems to be resolved.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...