BlazinGhost
Posts: 90 +1
Having problems with a trojan/virus Remind_xp.exe
Will appreciate some help from an expert, thanks.
Malwarebytes:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 5199
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
11/27/2010 3:06:02 PM
mbam-log-2010-11-27 (15-06-02).txt
Scan type: Quick scan
Objects scanned: 150847
Time elapsed: 6 minute(s), 38 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
GMER:
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-11-27 15:11:12
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 ST3250824A rev.3.AAE
Running: s4glttdc.exe; Driver: C:\DOCUME~1\OWNER~1.YOU\LOCALS~1\Temp\kwayiaog.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 37: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 60: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 61: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 488396912 (+255): rootkit-like behavior;
---- System - GMER 1.0.15 ----
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xEB41EBAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xEB41E9D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xEB41EB0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort4 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort5 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-16 868BF3B2
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \FileSystem\Ntfs \Ntfs naiavf5x.sys (Anti-Virus File System Filter Driver/McAfee Inc.)
Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \FileSystem\Fastfat \Fat naiavf5x.sys (Anti-Virus File System Filter Driver/McAfee Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Ip ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Tcp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Udp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\RawIp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250824A______________________________3.AAE___#5&6da396e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- EOF - GMER 1.0.15 ----
DDS:
DDS (Ver_10-11-27.01) - NTFSx86
Run by Owner at 15:17:44.79 on Sat 11/27/2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.548 [GMT -8:00]
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\WINDOWS\zHotkey.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\COMMON~1\AOL\129082~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\129082~1\EE\AOLServiceHost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner.YOUR-A5747C8268\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://www.gateway.com/g/sidepanel.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McAfee Anti-Phishing Filter: {41d68ed8-4cff-4115-88a6-6ebb8af19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Power2GoExpress] NA
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [readericon] c:\program files\digital media reader\readericon45G.exe
mRun: [CHotkey] zHotkey.exe
mRun: [HostManager] c:\program files\common files\aol\1290829611\ee\AOLHostManager.exe
mRun: [AOL Spyware Protection] "c:\progra~1\common~1\aol\aolspy~1\AOLSP Scheduler.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Reminder] %WINDIR%\Creator\Remind_XP.exe
mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\McUpdate.exe
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MSKDetct.exe /startup
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [VirusScan Online] c:\progra~1\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bigfix.lnk - c:\program files\bigfix\bigfix.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner~1.you\applic~1\mozilla\firefox\profiles\i1ag7lk2.default\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
============= SERVICES / DRIVERS ===============
P2 McShield;McAfee.com McShield;c:\progra~1\mcafee.com\vso\mcshield.exe [2010-11-26 221184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-11-26 165584]
R1 MPFIREWL;MPFIREWL;c:\windows\system32\drivers\MpFirewall.sys [2010-11-26 80640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-11-26 17744]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-26 40384]
R2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\Mcdetect.exe [2010-11-26 126976]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McTskshd.exe;McAfee Task Scheduler;c:\progra~1\mcafee.com\agent\mctskshd.exe [2010-11-26 122368]
R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2010-11-26 114464]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-26 136176]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-26 40384]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-26 40384]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2010-11-26 245760]
=============== Created Last 30 ================
2010-11-27 20:30:16 -------- d-----w- c:\docume~1\owner~1.you\applic~1\McAfee.com Personal Firewall
2010-11-27 19:29:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-27 19:29:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-27 18:54:01 -------- d-----w- c:\docume~1\owner~1.you\applic~1\Malwarebytes
2010-11-27 18:53:46 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-27 18:53:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-11-27 18:42:24 -------- d-----w- c:\program files\CCleaner
2010-11-27 05:35:17 -------- d-----w- c:\program files\AIM
2010-11-27 05:35:15 -------- d-----w- c:\program files\HLDJ
2010-11-27 05:35:11 -------- d-----w- c:\program files\GoldWave
2010-11-27 05:35:09 -------- d-----w- c:\program files\Illustrate
2010-11-27 05:31:47 -------- d-----w- c:\windows\system32\LogFiles
2010-11-27 05:21:57 -------- d-----w- c:\windows\system32\AGEIA
2010-11-27 05:20:57 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2010-11-27 05:20:27 453152 ----a-w- c:\windows\system32\nvudisp.exe
2010-11-27 05:20:27 -------- d-----w- c:\windows\nview
2010-11-27 05:18:35 -------- d-----w- C:\NVIDIA
2010-11-27 04:53:14 -------- d-----w- c:\docume~1\owner~1.you\locals~1\applic~1\Mozilla
2010-11-27 04:34:25 -------- d-----w- c:\program files\Steam
2010-11-27 04:27:18 -------- d-----w- c:\docume~1\owner~1.you\locals~1\applic~1\Temp
2010-11-27 04:27:13 -------- d-----w- c:\docume~1\owner~1.you\locals~1\applic~1\Google
2010-11-27 04:26:56 38848 ----a-w- c:\windows\avastSS.scr
2010-11-27 04:26:50 -------- d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
2010-11-27 04:26:03 553696 ----a-w- c:\program files\mozilla firefox\uninstall\helper.exe
2010-11-27 04:26:02 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll
2010-11-27 04:26:02 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2010-11-27 04:26:01 66520 ----a-w- c:\program files\mozilla firefox\plugins\npnul32.dll
2010-11-27 04:17:17 49152 ----a-r- c:\docume~1\owner~1.you\applic~1\microsoft\installer\{15377c3e-9655-400f-b441-e69f0a6beafe}\NewShortcut3_15377C3E9655400FB441E69F0A6BEAFE.EXE
2010-11-27 04:00:40 -------- d-----w- c:\windows\system32\Lang
2010-11-27 03:55:58 332800 -c--a-w- c:\windows\system32\dllcache\srv.sys
2010-11-27 03:55:33 94720 -c--a-w- c:\windows\system32\dllcache\iphlpapi.dll
2010-11-27 03:55:33 148480 -c--a-w- c:\windows\system32\dllcache\dnsapi.dll
2010-11-27 03:55:33 111616 -c--a-w- c:\windows\system32\dllcache\dhcpcsvc.dll
2010-11-27 03:55:20 181248 -c--a-w- c:\windows\system32\dllcache\rasmans.dll
2010-11-27 03:54:01 -------- d-----w- c:\program files\McAfee
2010-11-27 03:53:56 9216 ----a-w- c:\windows\system32\MpfApi.dll
2010-11-27 03:53:56 80640 ----a-w- c:\windows\system32\drivers\MpFirewall.sys
2010-11-27 03:53:51 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee.com Personal Firewall
2010-11-27 03:53:37 114464 ----a-w- c:\windows\system32\drivers\naiavf5x.sys
2010-11-27 03:53:25 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee.com
2010-11-27 03:52:56 349760 ----a-w- c:\windows\system32\mcinsctl.dll
2010-11-27 03:52:56 288320 ----a-w- c:\windows\system32\mcgdmgr.dll
2010-11-27 03:52:56 -------- d-----w- c:\program files\McAfee.com
2010-11-27 03:51:24 23552 ----a-w- c:\windows\system32\jesterss.dll
2010-11-27 03:51:24 1239209 ----a-w- c:\windows\system32\gtw_logo.scr
2010-11-27 03:51:24 -------- d-----w- c:\program files\gtw_logo
2010-11-27 03:51:20 741376 ----a-w- c:\windows\system32\BigFixSuppress.exe
2010-11-27 03:51:20 741376 ----a-w- c:\windows\system32\BigFixShortcutInStartup.exe
2010-11-27 03:51:18 67072 ----a-w- c:\windows\POWERCFG.EXE
2010-11-27 03:51:18 -------- d-----w- c:\program files\AMD Live!
2010-11-27 03:49:59 171776 -c--a-w- c:\windows\system32\dllcache\kmixer.sys
2010-11-27 03:48:08 -------- d-----w- c:\program files\MSN Encarta Plus
2010-11-27 03:46:49 -------- d-----w- c:\program files\common files\aolshare
2010-11-27 03:45:26 -------- d-----w- c:\program files\Microsoft Digital Image 2006
2010-11-27 03:45:21 89088 ----a-r- c:\windows\system32\atl71.dll
2010-11-27 03:45:21 57344 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2010-11-27 03:43:40 -------- d-----w- c:\docume~1\alluse~1\applic~1\WildTangent
2010-11-27 03:43:36 -------- d-----w- c:\windows\wt
2010-11-27 03:43:35 -------- d-----w- c:\program files\WildTangent
2010-11-27 03:43:30 -------- d-----w- c:\program files\Gateway Games
2010-11-27 03:43:16 20480 ----a-w- c:\windows\system32\Marker32.exe
2010-11-27 03:43:06 49265 ----a-w- c:\windows\system32\jpicpl32.cpl
2010-11-27 03:42:38 94208 ----a-w- c:\windows\system32\bae.dll
2010-11-27 03:42:31 13352 ----a-w- c:\windows\BigFixClientOverride.dll
2010-11-27 03:42:31 -------- d-----w- c:\program files\BigFix
2010-11-27 03:41:37 -------- d-----w- c:\program files\Digital Media Reader
2010-11-27 03:41:30 -------- d-----w- c:\windows\Downloaded Installations
2010-11-27 03:40:32 25840 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
2010-11-27 03:40:32 24816 ----a-w- c:\windows\system32\mdimon.dll
2010-11-27 03:40:07 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-11-27 03:39:51 -------- d-----w- c:\windows\SHELLNEW
2010-11-27 03:38:25 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2010-11-27 03:38:25 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2010-11-27 03:38:25 225280 ----a-w- c:\program files\common files\installshield\iscript\iscript.dll
2010-11-27 03:38:25 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2010-11-27 03:38:23 614532 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2010-11-27 03:36:42 -------- d-----w- c:\windows\system32\ReinstallBackups
2010-11-27 03:35:57 -------- d-----w- c:\program files\CONEXANT
2010-11-27 03:35:36 17024 ----a-w- c:\windows\system32\drivers\usbohci.sys
2010-11-27 03:24:44 -------- d-----w- c:\windows\creator
2010-11-27 03:22:58 102457 ----a-w- c:\windows\system32\usrv42a.dll
2010-11-27 03:21:56 35328 ----a-w- c:\windows\system32\pid.dll
2010-11-27 03:20:59 12032 ----a-w- c:\windows\system32\drivers\nikedrv.sys
2010-11-27 00:01:40 -------- d-----w- C:\My Backup -- 10-11-26 0501PM
2010-11-26 05:51:24 -------- d-----w- C:\My Backup -- 10-11-25 1051PM
2010-11-26 01:05:45 -------- d-----w- C:\My Backup -- 10-11-25 0605PM
==================== Find3M ====================
2010-11-27 03:47:30 24576 ----a-w- c:\windows\system32\prefscpl.cpl
=================== ROOTKIT ====================
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3250824A rev.3.AAE -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x868C0566]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x868c6624]; MOV EAX, [0x868c66a0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Harddisk0\DR0[0x86930030]
3 CLASSPNP[0xF763005B] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\000000a9[0x8691DF18]
5 ACPI[0xF7426620] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> [0x86930940]
\Driver\atapi[0x86953BA8] -> IRP_MJ_CREATE -> 0x868C0566
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x137; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250824A______________________________3.AAE___#5&6da396e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x868C03B2
user != kernel MBR !!!
sectors 488397166 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
============= FINISH: 15:18:19.43 ===============
DDS Attach Log:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-11-27.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/26/2010 8:17:02 PM
System Uptime: 11/27/2010 3:15:15 PM (0 hours ago)
Motherboard: C51PVGM-GB | | C51PVGM-GB
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2009/201mhz
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2009/201mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 228 GiB total, 210.925 GiB free.
D: is Removable
E: is Removable
F: is Removable
G: is Removable
H: is FIXED (FAT32) - 5 GiB total, 2.108 GiB free.
I: is CDROM ()
J: is Removable
==== Disabled Device Manager Items =============
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\AWY0001\2&DABA3FF&0
Manufacturer:
Name:
PNP Device ID: ACPI\AWY0001\2&DABA3FF&0
Service:
==== System Restore Points ===================
RP1: 11/26/2010 8:17:06 PM - System Checkpoint
==== Installed Programs ======================
Adobe Reader 7.0
America Online (Choose which version to remove)
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Connectivity Services
AOL Spyware Protection
AOL You've Got Pictures Screensaver
avast! Free Antivirus
Bejeweled 2 Deluxe
BigFix
Blackhawk Striker 2
Blasterball 2 Revolution
Browser Address Error Redirector
CCleaner
Counter-Strike: Source
Digital Media Reader
Diner Dash
DVD Solution
FATE
Gateway Game Console
Google Chrome
Google Update Helper
gtw_logo
High Definition Audio Driver Package - KB888111
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB893357)
Hotfix for Windows XP (KB895953)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB909095)
Hotfix for Windows XP (KB910728)
Hotfix for Windows XP (KB912024)
Hotfix for Windows XP (KB914906)
J2SE Runtime Environment 5.0 Update 2
Malwarebytes' Anti-Malware
McAfee Uninstall Wizard
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Starter Edition 2006
Microsoft Digital Image Starter Edition 2006 Editor
Microsoft Digital Image Starter Edition 2006 Library
Microsoft Money 2006
Microsoft Office Standard Edition 2003
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox (3.6.12)
Multimedia Keyboard Driver
Napster
Napster Burn Engine
NVIDIA Drivers
NVIDIA PhysX
Penguins!
Polar Bowler
Polar Golfer
Power2Go 4.0
PowerDVD
Pure Networks Port Magic
QuickTime
RealPlayer Basic
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
Recovery Software Suite Gateway
SCRABBLE
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917537)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Soft Data Fax Modem with SmartCP
Sonic Encoders
Steam
Tradewinds
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
WebFldrs XP
WildTangent Web Driver
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Media Center Edition 2005 KB914548
==== Event Viewer Messages From Past Week ========
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The PrismXL service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The McAfee WSC Integration service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The McAfee Task Scheduler service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The McAfee SpamKiller Server service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7031] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Run the configured recovery program.
11/27/2010 2:49:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AOL TopSpeed Monitor service to connect.
11/27/2010 2:46:54 PM, error: Service Control Manager [7031] - The AOL TopSpeed Monitor service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
11/27/2010 2:46:53 PM, error: Service Control Manager [7034] - The AOL Connectivity Service service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 12:55:59 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
11/27/2010 12:28:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/27/2010 11:32:34 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 aswSP aswTdi Fips Processor
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Workstation service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Windows Time service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Telephony service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The System Restore Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The System Event Notification service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Server service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Security Center service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Secondary Logon service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Remote Access Connection Manager service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Network Location Awareness (NLA) service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Network Connections service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Automatic Updates service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/26/2010 8:26:43 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/26/2010 8:26:43 PM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Logical Disk Manager service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The HID Input Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Fast User Switching Compatibility service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Error Reporting Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
11/26/2010 8:26:42 PM, error: Service Control Manager [7005] - The LoadUserProfile call failed with the following error: The device is not ready.
==== End Of File ===========================
Will appreciate some help from an expert, thanks.
Malwarebytes:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 5199
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
11/27/2010 3:06:02 PM
mbam-log-2010-11-27 (15-06-02).txt
Scan type: Quick scan
Objects scanned: 150847
Time elapsed: 6 minute(s), 38 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
GMER:
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-11-27 15:11:12
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 ST3250824A rev.3.AAE
Running: s4glttdc.exe; Driver: C:\DOCUME~1\OWNER~1.YOU\LOCALS~1\Temp\kwayiaog.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 37: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 60: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 61: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 488396912 (+255): rootkit-like behavior;
---- System - GMER 1.0.15 ----
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xEB41EBAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xEB41E9D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xEB41EB0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort4 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort5 868BF3B2
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-16 868BF3B2
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \FileSystem\Ntfs \Ntfs naiavf5x.sys (Anti-Virus File System Filter Driver/McAfee Inc.)
Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \FileSystem\Fastfat \Fat naiavf5x.sys (Anti-Virus File System Filter Driver/McAfee Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Ip ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Tcp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Udp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\RawIp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250824A______________________________3.AAE___#5&6da396e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- EOF - GMER 1.0.15 ----
DDS:
DDS (Ver_10-11-27.01) - NTFSx86
Run by Owner at 15:17:44.79 on Sat 11/27/2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.548 [GMT -8:00]
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\WINDOWS\zHotkey.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\COMMON~1\AOL\129082~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\129082~1\EE\AOLServiceHost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner.YOUR-A5747C8268\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://www.gateway.com/g/sidepanel.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=nofound&Br=nofound&Loc=nofound&Sys=nofound&M=GT5220
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McAfee Anti-Phishing Filter: {41d68ed8-4cff-4115-88a6-6ebb8af19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Power2GoExpress] NA
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [readericon] c:\program files\digital media reader\readericon45G.exe
mRun: [CHotkey] zHotkey.exe
mRun: [HostManager] c:\program files\common files\aol\1290829611\ee\AOLHostManager.exe
mRun: [AOL Spyware Protection] "c:\progra~1\common~1\aol\aolspy~1\AOLSP Scheduler.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Reminder] %WINDIR%\Creator\Remind_XP.exe
mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\McUpdate.exe
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MSKDetct.exe /startup
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [VirusScan Online] c:\progra~1\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bigfix.lnk - c:\program files\bigfix\bigfix.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner~1.you\applic~1\mozilla\firefox\profiles\i1ag7lk2.default\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre1.5.0_02\bin\NPJPI150_02.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
============= SERVICES / DRIVERS ===============
P2 McShield;McAfee.com McShield;c:\progra~1\mcafee.com\vso\mcshield.exe [2010-11-26 221184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-11-26 165584]
R1 MPFIREWL;MPFIREWL;c:\windows\system32\drivers\MpFirewall.sys [2010-11-26 80640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-11-26 17744]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-26 40384]
R2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\Mcdetect.exe [2010-11-26 126976]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McTskshd.exe;McAfee Task Scheduler;c:\progra~1\mcafee.com\agent\mctskshd.exe [2010-11-26 122368]
R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2010-11-26 114464]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-26 136176]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-26 40384]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-26 40384]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2010-11-26 245760]
=============== Created Last 30 ================
2010-11-27 20:30:16 -------- d-----w- c:\docume~1\owner~1.you\applic~1\McAfee.com Personal Firewall
2010-11-27 19:29:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-27 19:29:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-27 18:54:01 -------- d-----w- c:\docume~1\owner~1.you\applic~1\Malwarebytes
2010-11-27 18:53:46 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-27 18:53:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-11-27 18:42:24 -------- d-----w- c:\program files\CCleaner
2010-11-27 05:35:17 -------- d-----w- c:\program files\AIM
2010-11-27 05:35:15 -------- d-----w- c:\program files\HLDJ
2010-11-27 05:35:11 -------- d-----w- c:\program files\GoldWave
2010-11-27 05:35:09 -------- d-----w- c:\program files\Illustrate
2010-11-27 05:31:47 -------- d-----w- c:\windows\system32\LogFiles
2010-11-27 05:21:57 -------- d-----w- c:\windows\system32\AGEIA
2010-11-27 05:20:57 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2010-11-27 05:20:27 453152 ----a-w- c:\windows\system32\nvudisp.exe
2010-11-27 05:20:27 -------- d-----w- c:\windows\nview
2010-11-27 05:18:35 -------- d-----w- C:\NVIDIA
2010-11-27 04:53:14 -------- d-----w- c:\docume~1\owner~1.you\locals~1\applic~1\Mozilla
2010-11-27 04:34:25 -------- d-----w- c:\program files\Steam
2010-11-27 04:27:18 -------- d-----w- c:\docume~1\owner~1.you\locals~1\applic~1\Temp
2010-11-27 04:27:13 -------- d-----w- c:\docume~1\owner~1.you\locals~1\applic~1\Google
2010-11-27 04:26:56 38848 ----a-w- c:\windows\avastSS.scr
2010-11-27 04:26:50 -------- d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
2010-11-27 04:26:03 553696 ----a-w- c:\program files\mozilla firefox\uninstall\helper.exe
2010-11-27 04:26:02 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll
2010-11-27 04:26:02 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2010-11-27 04:26:01 66520 ----a-w- c:\program files\mozilla firefox\plugins\npnul32.dll
2010-11-27 04:17:17 49152 ----a-r- c:\docume~1\owner~1.you\applic~1\microsoft\installer\{15377c3e-9655-400f-b441-e69f0a6beafe}\NewShortcut3_15377C3E9655400FB441E69F0A6BEAFE.EXE
2010-11-27 04:00:40 -------- d-----w- c:\windows\system32\Lang
2010-11-27 03:55:58 332800 -c--a-w- c:\windows\system32\dllcache\srv.sys
2010-11-27 03:55:33 94720 -c--a-w- c:\windows\system32\dllcache\iphlpapi.dll
2010-11-27 03:55:33 148480 -c--a-w- c:\windows\system32\dllcache\dnsapi.dll
2010-11-27 03:55:33 111616 -c--a-w- c:\windows\system32\dllcache\dhcpcsvc.dll
2010-11-27 03:55:20 181248 -c--a-w- c:\windows\system32\dllcache\rasmans.dll
2010-11-27 03:54:01 -------- d-----w- c:\program files\McAfee
2010-11-27 03:53:56 9216 ----a-w- c:\windows\system32\MpfApi.dll
2010-11-27 03:53:56 80640 ----a-w- c:\windows\system32\drivers\MpFirewall.sys
2010-11-27 03:53:51 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee.com Personal Firewall
2010-11-27 03:53:37 114464 ----a-w- c:\windows\system32\drivers\naiavf5x.sys
2010-11-27 03:53:25 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee.com
2010-11-27 03:52:56 349760 ----a-w- c:\windows\system32\mcinsctl.dll
2010-11-27 03:52:56 288320 ----a-w- c:\windows\system32\mcgdmgr.dll
2010-11-27 03:52:56 -------- d-----w- c:\program files\McAfee.com
2010-11-27 03:51:24 23552 ----a-w- c:\windows\system32\jesterss.dll
2010-11-27 03:51:24 1239209 ----a-w- c:\windows\system32\gtw_logo.scr
2010-11-27 03:51:24 -------- d-----w- c:\program files\gtw_logo
2010-11-27 03:51:20 741376 ----a-w- c:\windows\system32\BigFixSuppress.exe
2010-11-27 03:51:20 741376 ----a-w- c:\windows\system32\BigFixShortcutInStartup.exe
2010-11-27 03:51:18 67072 ----a-w- c:\windows\POWERCFG.EXE
2010-11-27 03:51:18 -------- d-----w- c:\program files\AMD Live!
2010-11-27 03:49:59 171776 -c--a-w- c:\windows\system32\dllcache\kmixer.sys
2010-11-27 03:48:08 -------- d-----w- c:\program files\MSN Encarta Plus
2010-11-27 03:46:49 -------- d-----w- c:\program files\common files\aolshare
2010-11-27 03:45:26 -------- d-----w- c:\program files\Microsoft Digital Image 2006
2010-11-27 03:45:21 89088 ----a-r- c:\windows\system32\atl71.dll
2010-11-27 03:45:21 57344 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2010-11-27 03:43:40 -------- d-----w- c:\docume~1\alluse~1\applic~1\WildTangent
2010-11-27 03:43:36 -------- d-----w- c:\windows\wt
2010-11-27 03:43:35 -------- d-----w- c:\program files\WildTangent
2010-11-27 03:43:30 -------- d-----w- c:\program files\Gateway Games
2010-11-27 03:43:16 20480 ----a-w- c:\windows\system32\Marker32.exe
2010-11-27 03:43:06 49265 ----a-w- c:\windows\system32\jpicpl32.cpl
2010-11-27 03:42:38 94208 ----a-w- c:\windows\system32\bae.dll
2010-11-27 03:42:31 13352 ----a-w- c:\windows\BigFixClientOverride.dll
2010-11-27 03:42:31 -------- d-----w- c:\program files\BigFix
2010-11-27 03:41:37 -------- d-----w- c:\program files\Digital Media Reader
2010-11-27 03:41:30 -------- d-----w- c:\windows\Downloaded Installations
2010-11-27 03:40:32 25840 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
2010-11-27 03:40:32 24816 ----a-w- c:\windows\system32\mdimon.dll
2010-11-27 03:40:07 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-11-27 03:39:51 -------- d-----w- c:\windows\SHELLNEW
2010-11-27 03:38:25 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2010-11-27 03:38:25 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2010-11-27 03:38:25 225280 ----a-w- c:\program files\common files\installshield\iscript\iscript.dll
2010-11-27 03:38:25 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2010-11-27 03:38:23 614532 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2010-11-27 03:36:42 -------- d-----w- c:\windows\system32\ReinstallBackups
2010-11-27 03:35:57 -------- d-----w- c:\program files\CONEXANT
2010-11-27 03:35:36 17024 ----a-w- c:\windows\system32\drivers\usbohci.sys
2010-11-27 03:24:44 -------- d-----w- c:\windows\creator
2010-11-27 03:22:58 102457 ----a-w- c:\windows\system32\usrv42a.dll
2010-11-27 03:21:56 35328 ----a-w- c:\windows\system32\pid.dll
2010-11-27 03:20:59 12032 ----a-w- c:\windows\system32\drivers\nikedrv.sys
2010-11-27 00:01:40 -------- d-----w- C:\My Backup -- 10-11-26 0501PM
2010-11-26 05:51:24 -------- d-----w- C:\My Backup -- 10-11-25 1051PM
2010-11-26 01:05:45 -------- d-----w- C:\My Backup -- 10-11-25 0605PM
==================== Find3M ====================
2010-11-27 03:47:30 24576 ----a-w- c:\windows\system32\prefscpl.cpl
=================== ROOTKIT ====================
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3250824A rev.3.AAE -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x868C0566]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x868c6624]; MOV EAX, [0x868c66a0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\Harddisk0\DR0[0x86930030]
3 CLASSPNP[0xF763005B] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> \Device\000000a9[0x8691DF18]
5 ACPI[0xF7426620] -> ntkrnlpa!IofCallDriver[0x804EEF9C] -> [0x86930940]
\Driver\atapi[0x86953BA8] -> IRP_MJ_CREATE -> 0x868C0566
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x137; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250824A______________________________3.AAE___#5&6da396e&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x868C03B2
user != kernel MBR !!!
sectors 488397166 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
============= FINISH: 15:18:19.43 ===============
DDS Attach Log:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-11-27.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/26/2010 8:17:02 PM
System Uptime: 11/27/2010 3:15:15 PM (0 hours ago)
Motherboard: C51PVGM-GB | | C51PVGM-GB
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2009/201mhz
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2009/201mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 228 GiB total, 210.925 GiB free.
D: is Removable
E: is Removable
F: is Removable
G: is Removable
H: is FIXED (FAT32) - 5 GiB total, 2.108 GiB free.
I: is CDROM ()
J: is Removable
==== Disabled Device Manager Items =============
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\AWY0001\2&DABA3FF&0
Manufacturer:
Name:
PNP Device ID: ACPI\AWY0001\2&DABA3FF&0
Service:
==== System Restore Points ===================
RP1: 11/26/2010 8:17:06 PM - System Checkpoint
==== Installed Programs ======================
Adobe Reader 7.0
America Online (Choose which version to remove)
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Connectivity Services
AOL Spyware Protection
AOL You've Got Pictures Screensaver
avast! Free Antivirus
Bejeweled 2 Deluxe
BigFix
Blackhawk Striker 2
Blasterball 2 Revolution
Browser Address Error Redirector
CCleaner
Counter-Strike: Source
Digital Media Reader
Diner Dash
DVD Solution
FATE
Gateway Game Console
Google Chrome
Google Update Helper
gtw_logo
High Definition Audio Driver Package - KB888111
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB893357)
Hotfix for Windows XP (KB895953)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB909095)
Hotfix for Windows XP (KB910728)
Hotfix for Windows XP (KB912024)
Hotfix for Windows XP (KB914906)
J2SE Runtime Environment 5.0 Update 2
Malwarebytes' Anti-Malware
McAfee Uninstall Wizard
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Starter Edition 2006
Microsoft Digital Image Starter Edition 2006 Editor
Microsoft Digital Image Starter Edition 2006 Library
Microsoft Money 2006
Microsoft Office Standard Edition 2003
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox (3.6.12)
Multimedia Keyboard Driver
Napster
Napster Burn Engine
NVIDIA Drivers
NVIDIA PhysX
Penguins!
Polar Bowler
Polar Golfer
Power2Go 4.0
PowerDVD
Pure Networks Port Magic
QuickTime
RealPlayer Basic
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
Recovery Software Suite Gateway
SCRABBLE
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917537)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Soft Data Fax Modem with SmartCP
Sonic Encoders
Steam
Tradewinds
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
WebFldrs XP
WildTangent Web Driver
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Media Center Edition 2005 KB914548
==== Event Viewer Messages From Past Week ========
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The PrismXL service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The McAfee WSC Integration service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The McAfee Task Scheduler service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7034] - The McAfee SpamKiller Server service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 2:49:56 PM, error: Service Control Manager [7031] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Run the configured recovery program.
11/27/2010 2:49:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AOL TopSpeed Monitor service to connect.
11/27/2010 2:46:54 PM, error: Service Control Manager [7031] - The AOL TopSpeed Monitor service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
11/27/2010 2:46:53 PM, error: Service Control Manager [7034] - The AOL Connectivity Service service terminated unexpectedly. It has done this 1 time(s).
11/27/2010 12:55:59 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
11/27/2010 12:28:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/27/2010 11:32:34 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 aswSP aswTdi Fips Processor
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Workstation service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Windows Time service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Telephony service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The System Restore Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The System Event Notification service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Server service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Security Center service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Secondary Logon service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Remote Access Connection Manager service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Network Location Awareness (NLA) service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Network Connections service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7034] - The Automatic Updates service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:43 PM, error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/26/2010 8:26:43 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/26/2010 8:26:43 PM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Logical Disk Manager service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The HID Input Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Fast User Switching Compatibility service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Error Reporting Service service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 1 time(s).
11/26/2010 8:26:42 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
11/26/2010 8:26:42 PM, error: Service Control Manager [7005] - The LoadUserProfile call failed with the following error: The device is not ready.
==== End Of File ===========================
