Hi everyone and thanks in advance. I have been trying for days to remove this damn redirect virus all to no avail. I have Avira antivir running and tried Hitman pro 3.5 plus the symantec removal tool. None of them seem to have worked. I tried a handful of other steps I read bout also but nothing helped. I followed your instruction I found in the forum and am posting the logs below. Any help would be GREATLY appreciated.
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7683
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
9/9/2011 10:20:05 AM
mbam-log-2011-09-09 (10-20-05).txt
Scan type: Quick scan
Objects scanned: 186472
Time elapsed: 9 minute(s), 55 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\system32\wscui32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-09-09 14:17:54
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 HDT722525DLA380 rev.V44OA80A
Running: sz1ubk35.exe; Driver: C:\DOCUME~1\Ian\LOCALS~1\Temp\kwdcraog.sys
---- System - GMER 1.0.15 ----
SSDT B8747646 ZwCreateKey
SSDT B874763C ZwCreateThread
SSDT B874764B ZwDeleteKey
SSDT B8747655 ZwDeleteValueKey
SSDT B874765A ZwLoadKey
SSDT B8747628 ZwOpenProcess
SSDT B874762D ZwOpenThread
SSDT B8747664 ZwReplaceKey
SSDT B874765F ZwRestoreKey
SSDT B8747650 ZwSetValueKey
---- Kernel code sections - GMER 1.0.15 ----
? minlyh.sys The system cannot find the file specified. !
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xB6C213A0, 0x59FFE5, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
IAT C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
IAT C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Ian at 14:22:49 on 2011-09-09
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1182 [GMT -4:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe
C:\WINDOWS\system32\hpzipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\Common Files\SupportSoft\bin\bcont.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Documents and Settings\Ian\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local;<local>
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [cdloader] "c:\documents and settings\ian\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\ian\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Desktop Software] "c:\program files\common files\supportsoft\bin\bcont.exe" /ini "c:\program files\comcastui\desktop software\uinstaller.ini" /fromrun /starthidden
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [StatusClient 2.6] c:\program files\hewlett-packard\toolbox\statusclient\StatusClient.exe /auto
mRun: [TomcatStartup 2.5] c:\program files\hewlett-packard\toolbox\hpbpsttp.exe
mRun: [OrderReminder] c:\program files\hewlett-packard\orderreminder\orderreminder\OrderReminder.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 10.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe"
mRun: [HitmanPro35] "c:\program files\hitman pro 3.5\HitmanPro35.exe" /scan:boot
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\docume~1\ian\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\ian\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\webmee~1.lnk - c:\program files\dimdim\plugin\application\Dimdim.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1283992675031
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{74BFB2E9-0A7B-4989-B487-43BDA4217BD3} : DhcpNameServer = 192.168.0.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-9-9 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-9-9 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-9-9 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-9-9 66616]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-9 366640]
R2 NeatReceipts Database Controller;NeatReceipts Database Controller;c:\program files\common files\neatreceipts\db controller\NeatReceiptsDBController.exe [2008-2-5 228480]
R2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w --> C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2009-3-28 31896]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-9 22712]
S3 B-Service;B-Service;c:\documents and settings\ian\application data\mikogo\B-Service.exe [2010-9-9 185640]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-9-9 41272]
S3 MSSQL$NR2007;SQL Server (NR2007);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
.
=============== Created Last 30 ================
.
2011-09-09 13:54:34 -------- d-----w- c:\documents and settings\ian\application data\Malwarebytes
2011-09-09 13:53:58 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-09 13:53:55 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-09-09 13:53:49 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-09 13:53:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-08 16:30:55 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-09-08 16:30:54 -------- d-----w- c:\program files\Hitman Pro 3.5
2011-09-08 16:29:41 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2011-09-08 15:59:23 87608 ----a-w- c:\documents and settings\ian\application data\inst.exe
2011-09-08 15:59:23 47360 ----a-w- c:\documents and settings\ian\application data\pcouffin.sys
2011-09-08 15:57:30 -------- d-----w- c:\windows\system32\appmgmt
2011-09-03 10:17:37 599040 -c----w- c:\windows\system32\dllcache\crypt32.dll
2011-08-25 00:36:39 -------- d-----w- C:\OutputFolder
2011-08-25 00:32:37 -------- d-----w- c:\program files\Ultra MKV Converter
2011-08-11 17:27:32 -------- d-----w- c:\documents and settings\ian\local settings\application data\Identities
2011-08-11 04:13:23 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 04:13:10 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
.
==================== Find3M ====================
.
2011-09-03 10:17:37 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-08-15 17:13:12 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-28 21:16:24 0 ---ha-w- c:\documents and settings\ian\tdivnxjqnt.tmp
2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 13:37:17 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-07-12 13:37:17 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-28 17:10:47 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll
.
============= FINISH: 14:23:38.70 ===============
.
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7683
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
9/9/2011 10:20:05 AM
mbam-log-2011-09-09 (10-20-05).txt
Scan type: Quick scan
Objects scanned: 186472
Time elapsed: 9 minute(s), 55 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0590E3EF-95F7-46EC-93D0-C365FB43E7B4} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\system32\wscui32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-09-09 14:17:54
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 HDT722525DLA380 rev.V44OA80A
Running: sz1ubk35.exe; Driver: C:\DOCUME~1\Ian\LOCALS~1\Temp\kwdcraog.sys
---- System - GMER 1.0.15 ----
SSDT B8747646 ZwCreateKey
SSDT B874763C ZwCreateThread
SSDT B874764B ZwDeleteKey
SSDT B8747655 ZwDeleteValueKey
SSDT B874765A ZwLoadKey
SSDT B8747628 ZwOpenProcess
SSDT B874762D ZwOpenThread
SSDT B8747664 ZwReplaceKey
SSDT B874765F ZwRestoreKey
SSDT B8747650 ZwSetValueKey
---- Kernel code sections - GMER 1.0.15 ----
? minlyh.sys The system cannot find the file specified. !
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xB6C213A0, 0x59FFE5, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[428] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
IAT C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1980] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
IAT C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3992] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Ian at 14:22:49 on 2011-09-09
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1182 [GMT -4:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe
C:\WINDOWS\system32\hpzipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\Common Files\SupportSoft\bin\bcont.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Documents and Settings\Ian\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Ian\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local;<local>
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [cdloader] "c:\documents and settings\ian\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\ian\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Desktop Software] "c:\program files\common files\supportsoft\bin\bcont.exe" /ini "c:\program files\comcastui\desktop software\uinstaller.ini" /fromrun /starthidden
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [StatusClient 2.6] c:\program files\hewlett-packard\toolbox\statusclient\StatusClient.exe /auto
mRun: [TomcatStartup 2.5] c:\program files\hewlett-packard\toolbox\hpbpsttp.exe
mRun: [OrderReminder] c:\program files\hewlett-packard\orderreminder\orderreminder\OrderReminder.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 10.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe"
mRun: [HitmanPro35] "c:\program files\hitman pro 3.5\HitmanPro35.exe" /scan:boot
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\docume~1\ian\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\ian\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\webmee~1.lnk - c:\program files\dimdim\plugin\application\Dimdim.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1283992675031
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{74BFB2E9-0A7B-4989-B487-43BDA4217BD3} : DhcpNameServer = 192.168.0.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-9-9 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-9-9 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-9-9 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-9-9 66616]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-9 366640]
R2 NeatReceipts Database Controller;NeatReceipts Database Controller;c:\program files\common files\neatreceipts\db controller\NeatReceiptsDBController.exe [2008-2-5 228480]
R2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w --> C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2009-3-28 31896]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-9 22712]
S3 B-Service;B-Service;c:\documents and settings\ian\application data\mikogo\B-Service.exe [2010-9-9 185640]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-9-9 41272]
S3 MSSQL$NR2007;SQL Server (NR2007);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
.
=============== Created Last 30 ================
.
2011-09-09 13:54:34 -------- d-----w- c:\documents and settings\ian\application data\Malwarebytes
2011-09-09 13:53:58 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-09 13:53:55 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-09-09 13:53:49 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-09 13:53:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-08 16:30:55 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-09-08 16:30:54 -------- d-----w- c:\program files\Hitman Pro 3.5
2011-09-08 16:29:41 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2011-09-08 15:59:23 87608 ----a-w- c:\documents and settings\ian\application data\inst.exe
2011-09-08 15:59:23 47360 ----a-w- c:\documents and settings\ian\application data\pcouffin.sys
2011-09-08 15:57:30 -------- d-----w- c:\windows\system32\appmgmt
2011-09-03 10:17:37 599040 -c----w- c:\windows\system32\dllcache\crypt32.dll
2011-08-25 00:36:39 -------- d-----w- C:\OutputFolder
2011-08-25 00:32:37 -------- d-----w- c:\program files\Ultra MKV Converter
2011-08-11 17:27:32 -------- d-----w- c:\documents and settings\ian\local settings\application data\Identities
2011-08-11 04:13:23 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 04:13:10 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
.
==================== Find3M ====================
.
2011-09-03 10:17:37 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-08-15 17:13:12 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-28 21:16:24 0 ---ha-w- c:\documents and settings\ian\tdivnxjqnt.tmp
2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-12 13:37:17 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-07-12 13:37:17 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-28 17:10:47 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll
.
============= FINISH: 14:23:38.70 ===============
.