Solved Can't load and run AV software for first step of guidelines..

Klyonh2010 · Jul 27, 2011

High, as a new user I am trying to follow all guidelines, and my computer doesn't seem to be helping. I am hoping that all the excellent expertise on here can help me with these problems.

System Specs First
Dell Dimension 3000 Desktop Computer
Intel Pentium 4 (R) 2.80GHz
512 Ram
XP Home Edition - 5.1.2600 Service Pack 3
74.5G Samsung HD
Intel on board Graphics Controller with 96M Ram
Intel (R) PRO/100 VE Network Connection
Netgear RangeMax WPN 824 v2 (Direct wire connection to computer)

Problem Description(s) with Actions Taken Thus Far
1. Started with IE and then Mozilla Firefox not opening up most web pages. Started just after updating to IE 8, but I did nothing then because this computer was not needed. So, maybe even over a year ago it began.
2. Daughter now needs a computer and I have no money, so I am trying to get this going for her.
3. From advise at other sites I have already performed the following leading me to discover some other (perhaps more serious) problems and this I hope is not too long but I am trying to give as much detail as possible:
-Checked all wiring, and tried computer at other locations where other computers are working fine within my house (wireless with dongle and wired in my son's room) - Same problems
-Allowed lowest security levels (allowing all cookies, etc.)
-Disabled all AV software (McAfee at time), and eventually removed it all together.
-Followed mutliple opinions to insure system wasn't blocking anything.
-Reset MTU's via Microsoft Forum advice to 1472 after checking (generated multiple reports from pinging after doing so but person didn't get back to me, so I have these reports for someone to perhaps help me analyze them?)
-Reset Winsock & TCP/IP stack to installation defaults as well from CMD prompt using following commands, entering after each, and then rebooting: "netsh winsock reset catalog" <enter> "netsh int ip reset reset.log" <enter>
-Downloaded CleanMyPc-Registry Cleaner on another computer and ran on this one. Was needed, but didn't solve problems.
-Was told to defrag hard drive, computer wouldn't do it. Tried from CMD and still woudn't and wouln't even do 'CHKDSK'. Here is text copy of all of that nonsense that was entirely unexpected by me, at this point I was wondering where the dominoes would stop falling:

*************************************************
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Family>cd c:\

C:\>chkdsk c
The drive, the path, or the file name is not valid.

C:\>chkdsk c:\
The drive, the path, or the file name is not valid.

C:\>chkdsk c:
The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
CHKDSK is verifying indexes (stage 2 of 3)...
Deleting index entry SYA010~1.TXT in index $I30 of file 2819.
Deleting index entry system@findsproportal1[10].txt in index $I30 of file 2819.
Index verification completed.

Errors found. CHKDSK cannot continue in read-only mode.

C:\>defrag c:
Windows Disk Defragmenter
Copyright (c) 2001 Microsoft Corp. and Executive Software International, Inc.

Disk Defragmenter has detected that Chkdsk is scheduled to run on the volume: (C
.

Please run Chkdsk /f.

C:\>chkdsk /f
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.
*******************************************************************************************************

-But then when I restart computer and try again it does the same thing. Still wouldn't do defrag or proper chkdsk.

-Did do "Disk Clean Up", which took a while but did not solve either

-My computer guys at work suggested I try "Combofix", but since I couldn't access the website, I downloaded it at work on disk and it won't even start on this computer.

-So here I am now, trying to install AVG, downloaded from another computer to do the first step of the directions given at the beginning of this forum and it gives me an error because it won't connect.

Here are the guidance and reports from the pinging after I changed the MTU settings that the guys from the Microsoft Forum never responded to me about (perhaps someone can tell me what they were trying to attain from them):

-Here is what I was told to do at CMD and then paste results into the forum:
1. IPCONFIG /ALL
2. ping <computer ip address>: 192.168.1.7
3. ping <default_gateway_address>: 192.168.1.1
4. ping <dns_servers>: 192.168.1.1
5. ping 8.8.8.8
6. ping yahoo.com

-And here are the results of those pings:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Family>cd c:
C:\Documents and Settings\Family

C:\Documents and Settings\Family>cd c:\

C:\>IPCOFIG /ALL
'IPCOFIG' is not recognized as an internal or external command,
operable program or batch file.

C:\>IPCONFIG /ALL

Windows IP Configuration

Host Name . . . . . . . . . . . . : FAMILY
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connecti
on
Physical Address. . . . . . . . . : 00-13-20-0A-88-CA
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.7
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
Lease Obtained. . . . . . . . . . : Wednesday, July 27, 2011 6:58:03 PM
Lease Expires . . . . . . . . . . : Thursday, July 28, 2011 6:54:25 PM

C:\>PING 192.168.1.7

Pinging 192.168.1.7 with 32 bytes of data:

Reply from 192.168.1.7: bytes=32 time<1ms TTL=128
Reply from 192.168.1.7: bytes=32 time<1ms TTL=128
Reply from 192.168.1.7: bytes=32 time<1ms TTL=128
Reply from 192.168.1.7: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.7:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\>PING 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
Reply from 192.168.1.1: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\>PING 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:

Reply from 8.8.8.8: bytes=32 time=37ms TTL=50
Reply from 8.8.8.8: bytes=32 time=49ms TTL=50
Reply from 8.8.8.8: bytes=32 time=42ms TTL=50
Reply from 8.8.8.8: bytes=32 time=56ms TTL=50

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 37ms, Maximum = 56ms, Average = 46ms

C:\>PING YAHOO.COM

Pinging yahoo.com [209.191.122.70] with 32 bytes of data:

Reply from 209.191.122.70: bytes=32 time=56ms TTL=48
Reply from 209.191.122.70: bytes=32 time=53ms TTL=48
Reply from 209.191.122.70: bytes=32 time=55ms TTL=48
Reply from 209.191.122.70: bytes=32 time=53ms TTL=48

Ping statistics for 209.191.122.70:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 53ms, Maximum = 56ms, Average = 54ms

C:\>

I hope I did not go too long with this, but I was trying to be as detailed as possible in describing where I am at this point.

Thank you very much to anyone who might be able to help me through this.

Broni · Jul 27, 2011

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=====================================================================

Your internet connection is fine ("ping" works no problem), so you must have some other issues.

Using another working computer and USB flash drive transfer following programs to "sick" computer....

Please, download DDS from one of the 2 mirrors and save it to your desktop.

Mirror 1
Mirror 2

* Disable any script blocking protection (if present)
* Double click the dds icon to run the tool.
* When done, DDS will open two logs:
1. DDS.txt
2. Attach.txt
* Save both reports to your desktop by clicking File>Save As in each log.

Include the contents of both logs in your new topic. The scan will instruct you to post Attach.txt as an attachment. No need for that though ..... just post it's contents as you would any other log.

====================================================================

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

Klyonh2010 · Jul 28, 2011

Here are Reports you asked for (3 posts)

Wow, I had no idea the "gmer" would take so long. I was up till 1:45 a.m. getting it and am now at work at 6:30 a.m. FYI-Computer still acting the same as before, but didn't have time to test everything out last night.

-Here is the DDS.text file first

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Family at 0:18:14 on 2011-07-28
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.275 [GMT -4:00]
.
AV: McAfee VirusScan *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [Registry Cleaner Scheduler] "c:\program files\cleanmypc\registry cleaner\RCHelper.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRunOnce: [OSCD_Creator] c:\dell\PreODM.EXE /delete
dRunOnce: [RunNarrator] Narrator.exe
dRunOnce: [RealUpgradeHelper] "c:\program files\common files\real\update_ob\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0"
StartupFolder: c:\docume~1\family\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: microsoft.com\windowsupdate
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{3B29CD35-1247-4E4E-9AD5-62F51894583F} : DhcpNameServer = 192.168.1.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxdev.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\family\application data\mozilla\firefox\profiles\oolann1c.default\
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2011-07-28 03:34:48 -------- d-----w- C:\Temp
2011-07-28 01:30:01 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-28 01:29:57 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-28 01:29:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-27 23:52:08 -------- d--h--w- c:\documents and settings\all users\application data\Common Files
2011-07-27 23:51:03 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2011-07-27 21:23:30 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-07-27 18:29:42 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2011-07-27 18:29:42 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2011-07-25 03:56:29 -------- d-----w- c:\program files\CleanMyPC
2011-07-24 22:46:23 -------- d-sh--w- c:\documents and settings\family\IECompatCache
2011-07-24 21:29:03 -------- d-----w- c:\windows\SxsCaPendDel
.
==================== Find3M ====================
.
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\SET19.tmp
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2004-08-10 03:30:22 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2008-10-26 20:58:30 73728 -csh--w- c:\windows\temp\~rnsetu0\cont3260.dll
2008-10-26 20:58:30 98304 -csha-w- c:\windows\temp\~rnsetu0\rpshellextension.dll
2008-10-26 20:58:31 159744 --sh-tr- c:\windows\temp\~rnsetu0\rvrender.dll
2008-10-26 20:58:30 81920 --sh-tw- c:\windows\temp\~rnsetu0\twebbrowse.dll
2008-10-26 20:58:31 237568 --sh-tr- c:\windows\temp\~rnsetu0\cdinfo\tcdinfo.dll
2008-10-26 20:58:29 65602 -csh--w- c:\windows\temp\~rnsetu0\ecodecs\cook.dll
2008-10-26 20:58:30 86110 -csh--w- c:\windows\temp\~rnsetu0\eproducertools\rmsessionformat.dll
2008-10-26 20:58:30 77824 -csha-w- c:\windows\temp\~rnsetu0\gemsetup\gema3201.dll
2008-10-26 20:58:31 126976 -csh--r- c:\windows\temp\~rnsetu0\h263\h263render.dll
2008-10-26 20:58:33 319488 -csh--r- c:\windows\temp\~rnsetu0\msgroot\rnms3270.dll
2008-10-26 20:58:39 58952 --shatw- c:\windows\temp\~rnsetu0\msgroot\rnxproc.exe
2008-10-26 20:58:39 214560 --shatr- c:\windows\temp\~rnsetu0\player\realplay.exe
2008-10-26 20:58:38 2117632 --sh-tw- c:\windows\temp\~rnsetu0\playerplugins\rjbdll.dll
2008-10-26 20:58:30 110592 --sh-tw- c:\windows\temp\~rnsetu0\playerplugins\rjbxfade.dll
2008-10-26 20:58:37 610304 -csha-r- c:\windows\temp\~rnsetu0\playerplugins\rput3260.dll
2008-10-26 20:58:35 528384 -csha-r- c:\windows\temp\~rnsetu0\playerplugins\tmde3210.dll
2008-10-26 20:58:34 376832 -csh--w- c:\windows\temp\~rnsetu0\plins\vidsite.dll
2008-10-26 20:58:31 139264 -csha-r- c:\windows\temp\~rnsetu0\racodecs\sipr.dll
2008-10-26 20:58:35 462848 -csh--w- c:\windows\temp\~rnsetu0\rjmpmed\mpamedia.dll
2008-10-26 20:58:33 286720 -csh--r- c:\windows\temp\~rnsetu0\rvcodecs\drvc.dll
2008-10-26 20:58:31 184320 -csha-r- c:\windows\temp\~rnsetu0\vmpg\mpgrender.dll
2008-10-26 20:58:31 172032 -csha-r- c:\windows\temp\~rnsetu0\wmcomp\wm9fformat.dll
2007-09-13 10:35:17 52288 --shatr- c:\windows\temp\~rnsetup\gtapi.dll
2007-09-13 10:35:19 274432 --sh-tr- c:\windows\temp\~rnsetup\rpds3260.dll
2007-09-13 10:35:18 124480 -csha-w- c:\windows\temp\~rnsetup\rpelevation.dll
2007-09-13 10:35:18 81920 -csha-r- c:\windows\temp\~rnsetup\twebbrowse.dll
2007-09-13 10:35:17 69632 -csh--w- c:\windows\temp\~rnsetup\aacff\aacff.dll
2007-09-13 10:35:17 49152 --sh-tr- c:\windows\temp\~rnsetup\cdextract\mmcdda32.dll
2007-09-13 10:35:17 53328 -csh--r- c:\windows\temp\~rnsetup\eproducertools\packetsource.dll
2007-09-13 10:35:18 86110 -csha-r- c:\windows\temp\~rnsetup\eproducertools\rmsessionformat.dll
2007-09-13 10:35:19 233472 --sh-tw- c:\windows\temp\~rnsetup\fpsechnddir\fpsechnd.dll
2007-09-13 10:35:19 155648 --sh-tr- c:\windows\temp\~rnsetup\gemsetup\gct23201.dll
2007-09-13 10:35:19 307200 --shatr- c:\windows\temp\~rnsetup\pdgenwmdm\pdwmdm.dll
2007-09-13 10:35:18 110592 -csha-w- c:\windows\temp\~rnsetup\playerplugins\rjbs3260.dll
2007-09-13 10:35:17 57344 --shatr- c:\windows\temp\~rnsetup\plins\smmrender.dll
2007-09-13 10:35:18 73728 -csh--w- c:\windows\temp\~rnsetup\rmxpln\rjrmxpln.dll
2007-09-13 10:35:19 180224 --shatw- c:\windows\temp\~rnsetup\wmcomp\wmsechnd.dll
2007-09-13 10:35:17 61440 --shatr- c:\windows\temp\~rnsetup\wmplyr\rjwmapln.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SAMSUNG_SP0802N rev.TK100-28 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe >>UNKNOWN [0xEE8EFEAB]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x14; MOV EAX, [ECX+0x8]; PUSH EBX; PUSH ESI; PUSH EDI; MOV EDI, EDX; MOV ESI, [EDI+0x60]; SUB ESI, 0x24; CMP EAX, [0xee8fc074]; MOV [EBP-0x4], ECX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x82B38450]
\Driver\Disk[0x82B56E18] -> IRP_MJ_CREATE -> 0x82BD2EB0
kernel: MBR read successfully
_asm { CLI ; MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; STI ; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62f; }
detected disk devices:
detected hooks:
\Driver\Disk -> 0x82bd2eb0
user & kernel MBR OK
Warning: possible MBR rootkit infection !
.
============= FINISH: 0:20:05.53 ===============

-Sorry - Here is the actual Attach.txt file

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 5/5/2005 9:33:46 PM
System Uptime: 7/28/2011 5:35:46 PM (0 hours ago)
.
Motherboard: Dell Computer Corp. | | 0R8060
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 71 GiB total, 50.597 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP872: 7/24/2011 6:03:39 PM - System Checkpoint
.
==== Installed Programs ======================
.
3D Groove Playback Engine
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player 11
Adobe Stock Photos 1.0
CleanMyPC - Registry Cleaner
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell System Restore
DVD Solution
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) 537EP V9x DF PCI Modem
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet for Wired Connections
Internet Explorer Default Page
LightScribe 1.8.13.1
LightScribe Applications
Macromedia Flash Player
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
MicroStaff WINASPI
Modem Event Monitor
Mozilla Firefox 5.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB973688)
Pinnacle Instant DVD Recorder
PowerDirector Express
PowerDVD
PowerProducer
QuickTime
RealPlayer
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Sonic RecordNow!
SpongeBob SquarePants Obstacle Odyssey 2
SureThing CD Labeler 4 SE
TurboTax ItsDeductible 2005
TurboTax ItsDeductible 2006
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB982664)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
.
==== Event Viewer Messages From Past Week ========
.
7/28/2011 12:25:52 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
7/24/2011 10:29:56 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
7/24/2011 10:24:16 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/24/2011 10:09:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {9B1F122C-2982-4E91-AA8B-E071D54F2A4D}
7/24/2011 10:07:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm PCLEPCI
.
==== End Of File ===========================

-and Here is the never ending gmer.log file (next 2 posts also)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-07-28 03:54:15
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_SP0802N rev.TK100-28
Running: x8irh4vc.exe; Driver: C:\DOCUME~1\Family\LOCALS~1\Temp\pxtdypod.sys

---- System - GMER 1.0.15 ----

SSDT sptd.sys ZwCreateKey [0xF848BC04]
SSDT sptd.sys ZwEnumerateKey [0xF848BD48]
SSDT sptd.sys ZwEnumerateValueKey [0xF848C0C0]
SSDT sptd.sys ZwOpenKey [0xF848BAE2]
SSDT sptd.sys ZwQueryKey [0xF848C18A]
SSDT sptd.sys ZwQueryValueKey [0xF848C022]
SSDT sptd.sys ZwSetValueKey [0xF848C212]

Code E1A45458 ZwFlushInstructionCache
Code EE8EFEAB pIofCallDriver
Code EE8F0853 pIofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntoskrnl.exe!ZwFlushInstructionCache 8056E68E 5 Bytes JMP E1A4545C
? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
? C:\WINDOWS\System32\Drivers\SPTD3085.SYS The process cannot access the file because it is being used by another process.
init C:\WINDOWS\system32\DRIVERS\mohfilt.sys entry point in "init" section [0xF8923760]
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF7A14F80]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F79474D0 16 Bytes [FB, 7E, 9B, 03, 7D, 2E, 32, ...] {STI ; JLE 0xffffffffffffff9e; ADD EDI, [EBP+0x2e]; XOR CL, [EDI-0x546485d7]; PUSH SS; DAS ; INC ESP; CDQ }
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 F79474E1 31 Bytes [60, 94, F7, AD, 2D, 82, B2, ...]
? C:\WINDOWS\System32\Drivers\dtscsi.sys The process cannot access the file because it is being used by another process.
? C:\DOCUME~1\Family\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[1364] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00C2000A
.text C:\WINDOWS\Explorer.EXE[1364] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[1364] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00C3000A

Klyonh2010 · Jul 28, 2011

gmer report (part 2)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F8494F52] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84AB658] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F8495550] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F8495454] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F8495620] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84AAF6C] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F849510E] sptd.sys
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F8473068] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F84730A4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cpqarray.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F84AABB0] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F8494FA6] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8487A32] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F8487B6E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F8487AF6] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F84886CC] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F84885A2] sptd.sys
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F8473068] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aha154x.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78xx.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dac960nt.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql10wnt.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetSrb] [F8472F9E] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F84730A4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F8473068] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT amsint.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT i2omp.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiDebugPrint] [F8472F98] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortGetSrb] [F8472F9E] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F84730A4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ini910u.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ql1240.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT aic78u2.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortValidateRange] [F84730A4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT ABP480N5.SYS[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F84730A4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT asc3350p.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiDebugPrint] [F8472F98] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cd20xrnt.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetLogicalUnit] [F8472DE2] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT adpu160m.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetVirtualAddress] [F8473068] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortValidateRange] [F84730A4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortSetBusDataByOffset] [F846ECF4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT dpti2o.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT perc2hib.sys[ntoskrnl.exe!IofCompleteRequest] [F84AABB0] sptd.sys
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetPhysicalAddress] [F8472FE4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetBusData] [F846F416] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortGetUncachedExtension] [F846F508] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT hpn.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortMoveMemory] [F8472F4C] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortStallExecution] [F84730D4] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortLogError] [F8472ECC] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortNotification] [F84730E6] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortFreeDeviceBase] [F846EC28] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortConvertUlongToPhysicalAddress] [F84730AE] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortGetDeviceBase] [F846EAFA] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortCompleteRequest] [F847346A] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT cbidf2k.sys[SCSIPORT.SYS!ScsiPortInitialize] [F8479F74] \WINDOWS\System32\Drivers\SPTD3085.SYS
IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84AB79E] sptd.sys
IAT \WINDOWS\system32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F849A1BA] sptd.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F84AABB0] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F84AABBC] sptd.sys
IAT \SystemRoot\system32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F84AB79E] sptd.sys
IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F8487020] sptd.sys
IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F8487020] sptd.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 82BD2BF8
Device \FileSystem\Fastfat \FatCdrom 82A84BB0
Device \Driver\Ftdisk \Device\HarddiskVolume1 82BD5C78
Device \Driver\Ftdisk \Device\HarddiskVolume2 82BD5C78
Device \Driver\Cdrom \Device\CdRom0 82A5A728
Device \FileSystem\Rdbss \Device\FsWrap 8268B9A8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 [F83E9B40] atapi.sys[unknown section] {MOV EAX, 0x82bd5728; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf849c684; RET }
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F83E9B40] atapi.sys[unknown section] {MOV EAX, 0x82bd5728; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf849c684; RET }
Device \Driver\atapi \Device\Ide\IdePort0 [F83E9B40] atapi.sys[unknown section] {MOV EAX, 0x82bd5728; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf849c684; RET }
Device \Driver\atapi \Device\Ide\IdePort1 [F83E9B40] atapi.sys[unknown section] {MOV EAX, 0x82bd5728; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf849c684; RET }
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f [F83E9B40] atapi.sys[unknown section] {MOV EAX, 0x82bd5728; XCHG [ESP], EAX; PUSH EAX; PUSH 0xf849c684; RET }
Device \Driver\Cdrom \Device\CdRom1 82A5A728
Device \Driver\Ftdisk \Device\HarddiskVolume3 82BD5C78
Device \Driver\Cdrom \Device\CdRom2 82A5A728
Device \Driver\NetBT \Device\NetBt_Wins_Export 820448A8
Device \Driver\NetBT \Device\NetbiosSmb 820448A8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3B29CD35-1247-4E4E-9AD5-62F51894583F} 820448A8
Device \Driver\Disk \Device\Harddisk0\DR0 82BD2EB0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8268D708
Device \Driver\00000050 \Device\0000006e sptd.sys
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8268D708
Device \FileSystem\Npfs \Device\NamedPipe 82A4ACA0
Device \Driver\Ftdisk \Device\FtControl 82BD5C78
Device \FileSystem\Msfs \Device\Mailslot 820370E8
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 826F30E8
Device \Driver\dtscsi \Device\Scsi\dtscsi1 826F30E8
Device \FileSystem\Fastfat \Fat 82A84BB0

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 82967E18

---- Modules - GMER 1.0.15 ----

Module \systemroot\system32\drivers\TDSSmvpt.sys (*** hidden *** ) EE8EE000-EE900000 (73728 bytes)

---- Threads - GMER 1.0.15 ----

Thread System [4:352] EE8F0D66

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\drivers\TDSSmvpt.sys (*** hidden *** ) [SYSTEM] TDSSserv.sys <-- ROOTKIT !!!

Klyonh2010 · Jul 28, 2011

gmer report (part 3) - let me know what's next. Thank you so much.

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -1667540974
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -207814599
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -2008092029
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDB 0xD9 0x36 0x34 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB2 0x75 0x83 0x62 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x91 0x8B 0xEC 0xC3 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@imagepath \systemroot\system32\drivers\TDSSmvpt.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@TDSSserv \systemroot\system32\drivers\TDSSmvpt.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@TDSSl \systemroot\system32\TDSSotub.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdssservers \systemroot\system32\TDSSwryl.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdssmain \systemroot\system32\TDSScrrx.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdsslog \systemroot\system32\TDSSbvqo.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdssadw \systemroot\system32\TDSSjnst.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdssinit \systemroot\system32\TDSSublj.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdssurls \systemroot\system32\TDSSnmxh.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdsspanels \systemroot\system32\TDSSckhc.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@tdsserrors \systemroot\system32\TDSSwhkc.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules@TDSSproc \systemroot\system32\TDSSbjvu.log
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDB 0xD9 0x36 0x34 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB2 0x75 0x83 0x62 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x91 0x8B 0xEC 0xC3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@imagepath \systemroot\system32\drivers\TDSSmvpt.sys
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@TDSSserv \systemroot\system32\drivers\TDSSmvpt.sys
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@TDSSl \systemroot\system32\TDSSotub.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssservers \systemroot\system32\TDSSwryl.dat
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssmain \systemroot\system32\TDSScrrx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdsslog \systemroot\system32\TDSSbvqo.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssadw \systemroot\system32\TDSSjnst.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssinit \systemroot\system32\TDSSublj.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdssurls \systemroot\system32\TDSSnmxh.log
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdsspanels \systemroot\system32\TDSSckhc.dll
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@tdsserrors \systemroot\system32\TDSSwhkc.log
Reg HKLM\SYSTEM\ControlSet002\Services\TDSSserv.sys\modules@TDSSproc \systemroot\system32\TDSSbjvu.log
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDB 0xD9 0x36 0x34 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB2 0x75 0x83 0x62 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x91 0x8B 0xEC 0xC3 ...
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@imagepath \systemroot\system32\drivers\TDSSmvpt.sys
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSserv \systemroot\system32\drivers\TDSSmvpt.sys
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSl \systemroot\system32\TDSSotub.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssservers \systemroot\system32\TDSSwryl.dat
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssmain \systemroot\system32\TDSScrrx.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsslog \systemroot\system32\TDSSbvqo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssadw \systemroot\system32\TDSSjnst.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssinit \systemroot\system32\TDSSublj.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssurls \systemroot\system32\TDSSnmxh.log
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsspanels \systemroot\system32\TDSSckhc.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsserrors \systemroot\system32\TDSSwhkc.log
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSproc \systemroot\system32\TDSSbjvu.log
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@affid 20
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@subid v300
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@control 0x18 0x15 0x13 0x44 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@prov 10010
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@googleadserver pagead2.googlesyndication.com
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@flagged 1
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0xAA 0x52 0xC6 0x00 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x05 0x73 0x21 0xDD ...

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Family\Local Settings\Temp\TDSS2054.tmp 163840 bytes executable
File C:\Documents and Settings\Family\Local Settings\Temp\TDSS8f2e.tmp 118784 bytes executable
File C:\Documents and Settings\Family\Local Settings\Temp\TDSS8f3d.tmp 616960 bytes executable
File C:\Documents and Settings\Family\Local Settings\Temp\TDSSf82b.tmp 180224 bytes executable
File C:\WINDOWS\SYSTEM32\DRIVERS\TDSSmvpt.sys 60416 bytes executable <-- ROOTKIT !!!
File C:\WINDOWS\SYSTEM32\TDSSbjvu.log 20609 bytes
File C:\WINDOWS\SYSTEM32\TDSSbvqo.dll 31232 bytes executable
File C:\WINDOWS\SYSTEM32\TDSScrrx.dll 29696 bytes executable
File C:\WINDOWS\SYSTEM32\TDSSjnst.dll 61440 bytes executable
File C:\WINDOWS\SYSTEM32\TDSSotub.dll 35840 bytes executable
File C:\WINDOWS\SYSTEM32\TDSSublj.dll 3712 bytes
File C:\WINDOWS\SYSTEM32\TDSSwryl.dat 441 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[6].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[7].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[8].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[9].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[10].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[11].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[1].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[2].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[3].txt 79 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[4].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[5].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[6].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[7].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[2].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[5].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[8].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[3].txt 79 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[4].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[5].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[6].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[7].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[8].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[9].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[10].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[11].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[1].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[2].txt 79 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[3].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findxproportal1[4].txt 81 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findzproportal1[9].txt 80 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[10].txt 105 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[11].txt 104 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[1].txt 103 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[2].txt 105 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[3].txt 104 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[4].txt 104 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[5].txt 105 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[6].txt 105 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[7].txt 105 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[8].txt 105 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclick2[9].txt 101 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@stableclickz1[1].txt 78 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@updateguard.comweb5inst[1].txt 113 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@wisenum[2].txt 192 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@wisenum[3].txt 194 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@www.bing[1].txt 109 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@youblognews[1].txt 98 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@youtube[1].txt 91 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@youtube[2].txt 90 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@youtube[3].txt 87 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findreggi[7].txt 73 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findreggi[8].txt 75 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findreggi[9].txt 74 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[10].txt 0 bytes
File C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\system@findsproportal1[1].txt 81 bytes
File C:\WINDOWS\Temp\TDSSbe2.tmp 73728 bytes executable
File C:\WINDOWS\Temp\TDSS1d0.tmp 35840 bytes executable
File C:\WINDOWS\Temp\TDSS3d3.tmp 29696 bytes executable
File C:\WINDOWS\Temp\TDSS606.tmp 73728 bytes executable
File C:\WINDOWS\Temp\TDSS829.tmp 31232 bytes executable
File C:\WINDOWS\Temp\TDSSe917.tmp 527 bytes
File C:\WINDOWS\Temp\TDSSeed4.tmp 60416 bytes executable
File C:\WINDOWS\Temp\TDSSf2cc.tmp 35840 bytes executable
File C:\WINDOWS\Temp\TDSSf695.tmp 29696 bytes executable
File C:\WINDOWS\Temp\TDSSf712.tmp 527 bytes
File C:\WINDOWS\Temp\TDSSfc80.tmp 31232 bytes executable
File C:\WINDOWS\Temp\TDSSfd4b.tmp 60416 bytes executable

---- EOF - GMER 1.0.15 ----

Broni · Jul 28, 2011

You posted DDS.txt twice, so I'll still need Attach.txt to be posted.

Then....

Download TDSSKiller and save it to your desktop.

Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

Klyonh2010 · Jul 28, 2011

Sorry, correction made, don't know how I made that mistake. It was late

Real Attach file now pasted straight from open notepad document.

Working on TDS now. Will have to download from another computer. Won't open the page from the link you
sent on this computer.

Ok, got it, and here is the log from TDSKiller. Wanted to let you know though that upon reboot it performed a chkdsk
and went through a process of deleting "SYA010~1.txt in index $I30 of file 2819" and "index entry system@findsproportal1[10].txt". Don't know if this helps, but I wanted to let you know anyway.

Here is the log from TDSKiller. Let me know what next. Thank you again.

2011/07/28 18:09:38.0437 1540 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/28 18:09:39.0406 1540 ================================================================================
2011/07/28 18:09:39.0406 1540 SystemInfo:
2011/07/28 18:09:39.0406 1540
2011/07/28 18:09:39.0406 1540 OS Version: 5.1.2600 ServicePack: 3.0
2011/07/28 18:09:39.0406 1540 Product type: Workstation
2011/07/28 18:09:39.0406 1540 ComputerName: FAMILY
2011/07/28 18:09:39.0406 1540 UserName: Family
2011/07/28 18:09:39.0406 1540 Windows directory: C:\WINDOWS
2011/07/28 18:09:39.0406 1540 System windows directory: C:\WINDOWS
2011/07/28 18:09:39.0406 1540 Processor architecture: Intel x86
2011/07/28 18:09:39.0406 1540 Number of processors: 1
2011/07/28 18:09:39.0406 1540 Page size: 0x1000
2011/07/28 18:09:39.0406 1540 Boot type: Normal boot
2011/07/28 18:09:39.0406 1540 ================================================================================
2011/07/28 18:09:43.0812 1540 Initialize success
2011/07/28 18:09:55.0390 3452 ================================================================================
2011/07/28 18:09:55.0390 3452 Scan started
2011/07/28 18:09:55.0390 3452 Mode: Manual;
2011/07/28 18:09:55.0390 3452 ================================================================================
2011/07/28 18:09:57.0812 3452 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/07/28 18:09:58.0359 3452 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/28 18:09:58.0843 3452 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/07/28 18:09:59.0421 3452 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/07/28 18:09:59.0937 3452 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/07/28 18:10:00.0406 3452 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/07/28 18:10:00.0906 3452 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/07/28 18:10:01.0453 3452 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/07/28 18:10:02.0000 3452 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/07/28 18:10:02.0515 3452 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/07/28 18:10:03.0031 3452 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/07/28 18:10:03.0562 3452 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/07/28 18:10:04.0062 3452 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/07/28 18:10:04.0546 3452 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/07/28 18:10:05.0046 3452 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/07/28 18:10:06.0046 3452 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/07/28 18:10:06.0562 3452 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/07/28 18:10:07.0093 3452 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/07/28 18:10:07.0609 3452 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/28 18:10:08.0109 3452 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/28 18:10:09.0062 3452 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/28 18:10:09.0578 3452 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/28 18:10:10.0093 3452 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/07/28 18:10:10.0625 3452 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/07/28 18:10:11.0125 3452 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/28 18:10:11.0656 3452 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/07/28 18:10:12.0125 3452 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/28 18:10:12.0640 3452 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/28 18:10:13.0140 3452 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/28 18:10:14.0109 3452 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/07/28 18:10:14.0671 3452 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/07/28 18:10:15.0187 3452 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/07/28 18:10:15.0703 3452 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/07/28 18:10:16.0218 3452 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/28 18:10:16.0750 3452 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/07/28 18:10:17.0265 3452 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/07/28 18:10:17.0750 3452 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/07/28 18:10:18.0250 3452 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/07/28 18:10:18.0781 3452 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/07/28 18:10:19.0328 3452 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/28 18:10:19.0921 3452 dtscsi (12aca694b50ea53563c1e7c99e7bb27d) C:\WINDOWS\System32\Drivers\dtscsi.sys
2011/07/28 18:10:19.0921 3452 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\dtscsi.sys. md5: 12aca694b50ea53563c1e7c99e7bb27d
2011/07/28 18:10:19.0937 3452 dtscsi - detected LockedFile.Multi.Generic (1)
2011/07/28 18:10:20.0453 3452 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2011/07/28 18:10:21.0093 3452 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/28 18:10:21.0593 3452 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/07/28 18:10:22.0078 3452 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/07/28 18:10:22.0578 3452 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/07/28 18:10:23.0062 3452 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/07/28 18:10:23.0515 3452 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/28 18:10:24.0031 3452 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/28 18:10:24.0531 3452 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/28 18:10:25.0031 3452 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/28 18:10:25.0609 3452 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/07/28 18:10:26.0125 3452 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/28 18:10:26.0625 3452 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/07/28 18:10:27.0156 3452 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/07/28 18:10:27.0656 3452 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/07/28 18:10:28.0203 3452 ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/07/28 18:10:28.0781 3452 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/28 18:10:29.0328 3452 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/07/28 18:10:29.0906 3452 IntelC51 (7509c548400f4c9e0211e3f6e66abbe6) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
2011/07/28 18:10:30.0453 3452 IntelC52 (9584ffdd41d37f2c239681d0dac2513e) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
2011/07/28 18:10:30.0953 3452 IntelC53 (cf0b937710cec6ef39416edecd803cbb) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
2011/07/28 18:10:31.0468 3452 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/07/28 18:10:31.0953 3452 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/07/28 18:10:32.0453 3452 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/07/28 18:10:32.0953 3452 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/28 18:10:33.0468 3452 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/28 18:10:33.0968 3452 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/28 18:10:34.0453 3452 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/28 18:10:34.0953 3452 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/28 18:10:35.0468 3452 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/28 18:10:36.0015 3452 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/28 18:10:36.0531 3452 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/07/28 18:10:37.0031 3452 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/07/28 18:10:37.0531 3452 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/28 18:10:38.0546 3452 MarvinBus (269c14d512b74cc28d2812ff7d1eb066) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
2011/07/28 18:10:39.0078 3452 MASPINT (a2ae666cee860babe7fa6f1662b71737) C:\WINDOWS\system32\drivers\MASPINT.sys
2011/07/28 18:10:39.0593 3452 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/28 18:10:40.0109 3452 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/07/28 18:10:40.0609 3452 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2011/07/28 18:10:41.0125 3452 mohfilt (59b8b11ff70728eec60e72131c58b716) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
2011/07/28 18:10:41.0609 3452 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/28 18:10:42.0125 3452 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/28 18:10:42.0640 3452 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/28 18:10:43.0125 3452 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/07/28 18:10:43.0640 3452 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/28 18:10:44.0156 3452 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/28 18:10:44.0671 3452 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/07/28 18:10:45.0156 3452 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/28 18:10:45.0687 3452 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/28 18:10:46.0156 3452 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/28 18:10:46.0640 3452 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/28 18:10:47.0125 3452 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/07/28 18:10:47.0609 3452 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/07/28 18:10:48.0125 3452 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/28 18:10:48.0625 3452 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/28 18:10:49.0093 3452 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/28 18:10:49.0593 3452 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/28 18:10:50.0078 3452 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/28 18:10:50.0562 3452 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/28 18:10:51.0140 3452 nm (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
2011/07/28 18:10:51.0609 3452 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/07/28 18:10:52.0125 3452 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/28 18:10:52.0671 3452 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/07/28 18:10:53.0234 3452 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/07/28 18:10:53.0781 3452 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/28 18:10:54.0281 3452 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/28 18:10:54.0765 3452 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/28 18:10:55.0234 3452 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/28 18:10:55.0765 3452 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/28 18:10:56.0265 3452 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/28 18:10:57.0218 3452 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/28 18:10:57.0718 3452 PCLEPCI (1bebe7de8508a02650cdce45c664c2a2) C:\WINDOWS\system32\drivers\pclepci.sys
2011/07/28 18:10:58.0218 3452 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/07/28 18:11:00.0531 3452 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/07/28 18:11:01.0046 3452 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/07/28 18:11:01.0609 3452 pfc (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys
2011/07/28 18:11:02.0109 3452 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/28 18:11:02.0625 3452 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/28 18:11:03.0093 3452 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/28 18:11:03.0609 3452 PxHelp20 (db3b30c3a4cdcf07e164c14584d9d0f2) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/07/28 18:11:04.0125 3452 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/07/28 18:11:04.0656 3452 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/07/28 18:11:05.0171 3452 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/07/28 18:11:05.0687 3452 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/07/28 18:11:06.0203 3452 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/07/28 18:11:06.0718 3452 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/28 18:11:07.0234 3452 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/28 18:11:07.0734 3452 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/28 18:11:08.0187 3452 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/28 18:11:08.0687 3452 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/28 18:11:09.0187 3452 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/28 18:11:09.0671 3452 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/07/28 18:11:10.0203 3452 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/28 18:11:10.0781 3452 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/28 18:11:11.0312 3452 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2011/07/28 18:11:11.0843 3452 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/28 18:11:12.0390 3452 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
2011/07/28 18:11:12.0937 3452 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/07/28 18:11:13.0421 3452 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/07/28 18:11:13.0906 3452 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/28 18:11:14.0875 3452 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/07/28 18:11:15.0390 3452 smwdm (c6d9959e493682f872a639b6ec1b4a08) C:\WINDOWS\system32\drivers\smwdm.sys
2011/07/28 18:11:15.0921 3452 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2011/07/28 18:11:16.0468 3452 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/07/28 18:11:16.0968 3452 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/07/28 18:11:17.0578 3452 sptd (43be59f11d3b6cbf7d4ac7f77114fed9) C:\WINDOWS\system32\Drivers\sptd.sys
2011/07/28 18:11:17.0578 3452 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 43be59f11d3b6cbf7d4ac7f77114fed9
2011/07/28 18:11:17.0609 3452 sptd - detected LockedFile.Multi.Generic (1)
2011/07/28 18:11:18.0093 3452 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/28 18:11:18.0609 3452 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/28 18:11:19.0140 3452 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/28 18:11:19.0609 3452 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/07/28 18:11:20.0125 3452 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/07/28 18:11:20.0656 3452 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/07/28 18:11:21.0171 3452 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/07/28 18:11:21.0687 3452 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/07/28 18:11:22.0187 3452 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/28 18:11:22.0703 3452 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/28 18:11:23.0203 3452 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/28 18:11:23.0250 3452 Suspicious service (Hidden): TDSSserv.sys
2011/07/28 18:11:23.0765 3452 TDSSserv.sys (9679cbb6fb2104010efb44910e08a563) C:\WINDOWS\system32\drivers\TDSSmvpt.sys
2011/07/28 18:11:23.0765 3452 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\TDSSmvpt.sys. md5: 9679cbb6fb2104010efb44910e08a563
2011/07/28 18:11:23.0765 3452 Suspicious file (Hidden): C:\WINDOWS\system32\drivers\TDSSmvpt.sys. md5: 9679cbb6fb2104010efb44910e08a563
2011/07/28 18:11:23.0765 3452 TDSSserv.sys - detected Rootkit.Win32.TDSS.tdl2 (0)
2011/07/28 18:11:24.0265 3452 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/28 18:11:24.0750 3452 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/28 18:11:25.0312 3452 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/07/28 18:11:29.0578 3452 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/07/28 18:11:30.0078 3452 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/07/28 18:11:30.0593 3452 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/07/28 18:11:31.0562 3452 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/28 18:11:32.0046 3452 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/28 18:11:32.0531 3452 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/28 18:11:33.0031 3452 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/07/28 18:11:33.0515 3452 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/07/28 18:11:33.0984 3452 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/28 18:11:34.0468 3452 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/07/28 18:11:34.0953 3452 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/07/28 18:11:35.0453 3452 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/07/28 18:11:35.0921 3452 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/07/28 18:11:36.0421 3452 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/28 18:11:36.0937 3452 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/28 18:11:38.0328 3452 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/28 18:11:38.0468 3452 MBR (0x1B8) (a03e065717cb65f3034ad33ad58b6bba) \Device\Harddisk0\DR0
2011/07/28 18:11:38.0484 3452 MBR (0x1B8) (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk1\DR6
2011/07/28 18:11:38.0531 3452 Boot (0x1200) (7f96fda05cd2f4071562b9c1d25bf5b2) \Device\Harddisk0\DR0\Partition0
2011/07/28 18:11:38.0546 3452 Boot (0x1200) (e7f37ee4ee5b6a51e0adafa53e3747d1) \Device\Harddisk1\DR6\Partition0
2011/07/28 18:11:38.0562 3452 ================================================================================
2011/07/28 18:11:38.0562 3452 Scan finished
2011/07/28 18:11:38.0562 3452 ================================================================================
2011/07/28 18:11:38.0562 3388 Detected object count: 3
2011/07/28 18:11:38.0562 3388 Actual detected object count: 3
2011/07/28 18:12:33.0218 3388 LockedFile.Multi.Generic(dtscsi) - User select action: Skip
2011/07/28 18:12:33.0218 3388 LockedFile.Multi.Generic(sptd) - User select action: Skip
2011/07/28 18:12:33.0265 3388 C:\WINDOWS\system32\drivers\TDSSmvpt.sys - will be deleted after reboot
2011/07/28 18:12:33.0265 3388 C:\WINDOWS\system32\TDSSotub.dll - will be deleted after reboot
2011/07/28 18:12:33.0265 3388 C:\WINDOWS\system32\TDSSwryl.dat - will be deleted after reboot
2011/07/28 18:12:33.0265 3388 C:\WINDOWS\system32\TDSScrrx.dll - will be deleted after reboot
2011/07/28 18:12:33.0265 3388 C:\WINDOWS\system32\TDSSbvqo.dll - will be deleted after reboot
2011/07/28 18:12:33.0265 3388 C:\WINDOWS\system32\TDSSjnst.dll - will be deleted after reboot
2011/07/28 18:12:33.0281 3388 C:\WINDOWS\system32\TDSSublj.dll - will be deleted after reboot
2011/07/28 18:12:33.0281 3388 C:\WINDOWS\system32\TDSSnmxh.log - will be deleted after reboot
2011/07/28 18:12:33.0281 3388 C:\WINDOWS\system32\TDSSckhc.dll - will be deleted after reboot
2011/07/28 18:12:33.0281 3388 C:\WINDOWS\system32\TDSSwhkc.log - will be deleted after reboot
2011/07/28 18:12:33.0281 3388 C:\WINDOWS\system32\TDSSbjvu.log - will be deleted after reboot
2011/07/28 18:12:33.0281 3388 HKLM\SYSTEM\ControlSet001\services\TDSSserv.sys - will be deleted after reboot
2011/07/28 18:12:33.0312 3388 HKLM\SYSTEM\ControlSet002\services\TDSSserv.sys - will be deleted after reboot
2011/07/28 18:12:33.0328 3388 HKLM\SYSTEM\ControlSet003\services\TDSSserv.sys - will be deleted after reboot
2011/07/28 18:12:33.0343 3388 C:\WINDOWS\system32\drivers\TDSSmvpt.sys - will be deleted after reboot
2011/07/28 18:12:33.0343 3388 Rootkit.Win32.TDSS.tdl2(TDSSserv.sys) - User select action: Delete
2011/07/28 18:13:10.0703 1616 Deinitialize success

Broni · Jul 28, 2011

Very good

Let's double check...

Please download Rootkit Unhooker from one of the following links and save it to your desktop.

Link 1 (.exe file)
Link 2 (zipped file)
Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can download, install and use the free 7-zip utility.

Double-click on RKUnhookerLE.exe to start the program.
Vista/Windows 7 users right-click and select Run As Administrator.
Click the Report tab, then click Scan.
Check Drivers, Stealth, and uncheck the rest.
Click OK.
Wait until it's finished and then go to File > Save Report.
Save the report to your Desktop.
Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

Klyonh2010 · Jul 28, 2011

Here it is:

-Note: amazingly this one was able to download and run straight from this computer. First one so far. And fast too. Whatever your doing it seems to be working. Thank you.

Here is the report this time:

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #1
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2192768 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2192768 bytes
0x804D7000 RAW 2192768 bytes
0x804D7000 WMIxWDM 2192768 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF7FF7000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1302528 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xF7E75000 C:\WINDOWS\system32\DRIVERS\IntelC51.sys 1208320 bytes (Intel Corporation, Modem DSP Driver)
0xBF077000 C:\WINDOWS\System32\ialmdd5.DLL 925696 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0xF8486000 00000050 856064 bytes
0xF8486000 sptd.sys 856064 bytes
0xF7C8F000 C:\WINDOWS\system32\drivers\senfilt.sys 733184 bytes (Creative Technology Ltd., Creative WDM Audio Driver)
0xF7DE0000 C:\WINDOWS\system32\DRIVERS\IntelC52.sys 610304 bytes (Intel Corporation, Modem CP Driver)
0xF82C5000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xEEA3A000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF79ED000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xEEB1F000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xEE15C000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xF7C45000 C:\WINDOWS\System32\Drivers\dtscsi.sys 303104 bytes
0xEDD0B000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF7D66000 C:\WINDOWS\system32\drivers\smwdm.sys 262144 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
0xBF042000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver)
0xF8440000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xF7997000 C:\WINDOWS\system32\DRIVERS\MarvinBus.sys 188416 bytes (Pinnacle Systems GmbH, Pinnacle Marvin Discrete Bus Enumerator)
0xEE27C000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF8298000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF839B000 dac2w2k.sys 180224 bytes (Mylex Corporation, Mylex Disk Array Controller Driver)
0xEDA0D000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xEEAAA000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xEEAF7000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF7DBA000 C:\WINDOWS\system32\DRIVERS\e100b325.sys 155648 bytes (Intel Corporation, Intel(R) PRO/100 Adapter NDIS 5.1 driver)
0xEE974000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xEE82C000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xF7D42000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF7FBF000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF7F9C000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xEEAD5000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0x806EF000 ACPI_HAL 131840 bytes
0x806EF000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF837B000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF8410000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF827E000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF83C7000 adpu160m.sys 102400 bytes (Microsoft Corporation, Adaptec Ultra160 SCSI miniport)
0xF83E0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xEE814000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF83F8000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xF846E000 C:\WINDOWS\System32\Drivers\SPTD3085.SYS 98304 bytes
0xF8352000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF7AFC000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xEE48F000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF7DA6000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF7FE3000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xEEB78000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF8369000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF842F000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF7A4B000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xEE9CA000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF8155000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF8175000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF8135000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF8195000 C:\WINDOWS\system32\DRIVERS\IntelC53.sys 61440 bytes (Intel Corporation, Modem AFE Driver)
0xF8145000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xEE624000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF8748000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF85D8000 aic78u2.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra2 SCSI miniport)
0xF85A8000 aic78xx.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra SCSI miniport)
0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF8638000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF8185000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF86C8000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF8598000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF8618000 ql12160.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF8608000 ql1280.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF86E8000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF8668000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xF8698000 agpCPQ.sys 45056 bytes (Microsoft Corporation, CompatNT AGP Filter)
0xF8678000 alim1541.sys 45056 bytes (Microsoft Corporation, ALi M1541 NT AGP Filter)
0xF8688000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter)
0xF8778000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF8165000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF8588000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF86D8000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF8658000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter)
0xF8578000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF8728000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF85F8000 ql1080.sys 40960 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF85C8000 ql1240.sys 40960 bytes (Microsoft Corporation, QLogic ISP PCI Adapters)
0xEE2C9000 C:\WINDOWS\system32\DRIVERS\secdrv.sys 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0xF8648000 sisagp.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter)
0xF8708000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xEDBBB000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xF8628000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF81A5000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF86F8000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF8768000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF85B8000 ql10wnt.sys 36864 bytes (Microsoft Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF85E8000 ultra.sys 36864 bytes (Promise Technology, Inc., Promise Ultra66 Miniport Driver)
0xF8788000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF8948000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xF88D0000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF8828000 symc8xx.sys 32768 bytes (LSI Logic, Symbios 8XX SCSI Miniport Driver)
0xF8838000 sym_u3.sys 32768 bytes (LSI Logic, Symbios Ultra3 SCSI Miniport Driver)
0xF8938000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF8810000 asc.sys 28672 bytes (Advanced System Products, Inc., AdvanSys SCSI Controller Driver)
0xF8950000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xF88B8000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF8860000 hpn.sys 28672 bytes (Microsoft Corporation, NetRAID-4M Miniport Driver)
0xF87F8000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF8858000 perc2.sys 28672 bytes (Microsoft Corporation, PERC 2 Miniport Driver)
0xF8830000 sym_hi.sys 28672 bytes (LSI Logic, Symbios Hi-Perf SCSI Miniport Driver)
0xF88E0000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xF8840000 ABP480N5.SYS 24576 bytes (Microsoft Corporation, AdvanSys SCSI Controller Driver)
0xF8848000 asc3350p.sys 24576 bytes (Microsoft Corporation, AdvanSys SCSI Card Driver)
0xF8958000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF8940000 C:\WINDOWS\system32\DRIVERS\mohfilt.sys 24576 bytes (Intel Corporation, Filter Driver to Support Modem-on-Hold)
0xF8960000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF8930000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF88C0000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF8850000 dpti2o.sys 20480 bytes (Microsoft Corporation, DPT SmartRAID miniport)
0xF8820000 i2omp.sys 20480 bytes (Microsoft Corporation, I2O Miniport Driver)
0xF8818000 mraid35x.sys 20480 bytes (American Megatrends Inc., MegaRAID RAID Controller Driver for Windows Whistler 32)
0xF88C8000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF8800000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF8980000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF8868000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF8880000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF8808000 sparrow.sys 20480 bytes (Adaptec, Inc., Adaptec AIC-6x60 series SCSI miniport)
0xF8968000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xEF8AF000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF8990000 aha154x.sys 16384 bytes (Microsoft Corporation, Adaptec AHA-154x series SCSI miniport)
0xF89A0000 asc3550.sys 16384 bytes (Advanced System Products, Inc., AdvanSys Ultra-Wide PCI SCSI Driver)
0xF89A8000 cbidf2k.sys 16384 bytes (Microsoft Corporation, CardBus/PCMCIA IDE Miniport Driver)
0xF898C000 cpqarray.sys 16384 bytes (Microsoft Corporation, Compaq Drive Array Controllers SCSI Miniport Driver)
0xF8998000 dac960nt.sys 16384 bytes (Microsoft Corporation, Mylex Disk Array Controller Driver)
0xF89A4000 ini910u.sys 16384 bytes (Microsoft Corporation, INITIO ini910u SCSI miniport)
0xF8A60000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)
0xF8215000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xEE7A0000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF79E1000 C:\WINDOWS\system32\drivers\pclepci.sys 16384 bytes (Pinnacle Systems GmbH, PCLEPCI)
0xF8246000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF8994000 symc810.sys 16384 bytes (Symbios Logic Inc., Symbios Logic Inc. SCSI Miniport Driver)
0xF899C000 amsint.sys 12288 bytes (Microsoft Corporation, AMD SCSI/NET Controller)
0xF8988000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xEF913000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF8A70000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xF8236000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF8242000 C:\WINDOWS\system32\drivers\pfc.sys 12288 bytes (Padus, Inc., Padus(R) ASPI Shell)
0xF825A000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF8A7C000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver)
0xF8AAA000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF8A86000 cd20xrnt.sys 8192 bytes (Microsoft Corporation, IBM Portable CD-ROM Drive Miniport)
0xF8A7E000 cmdide.sys 8192 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver)
0xF8B32000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF8AA8000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF8A84000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF8A78000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF8AD6000 C:\WINDOWS\System32\Drivers\MASPINT.SYS 8192 bytes (MicroStaff Co.,Ltd., Aspi32 Driver)
0xF8AAC000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF8A88000 perc2hib.sys 8192 bytes (Microsoft Corporation, PERC 2 Hibernate Driver)
0xF8AAE000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF8AA4000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF8A80000 toside.sys 8192 bytes (Microsoft Corporation, Toshiba PCI IDE Controller)
0xF8AA6000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF8A82000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xF8A7A000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF8BD9000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF8C8E000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF8C82000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF8B40000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x82B6A0E8 unknown_irp_handler 3864 bytes
0x826CF0E8 unknown_irp_handler 3864 bytes
0x82BD40E8 unknown_irp_handler 3864 bytes
0x82BD30E8 unknown_irp_handler 3864 bytes
0x82B880E8 unknown_irp_handler 3864 bytes
0x82B870E8 unknown_irp_handler 3864 bytes
0x82B890E8 unknown_irp_handler 3864 bytes
0x82B480E8 unknown_irp_handler 3864 bytes
0x82BD33D0 unknown_irp_handler 3120 bytes
0x82B88450 unknown_irp_handler 2992 bytes
0x82B89550 unknown_irp_handler 2736 bytes
0x82BD55D0 unknown_irp_handler 2608 bytes
0x82B87608 unknown_irp_handler 2552 bytes
0x829EF630 unknown_irp_handler 2512 bytes
0x820336A8 unknown_irp_handler 2392 bytes
0x82BD4788 unknown_irp_handler 2168 bytes
0x82B89808 unknown_irp_handler 2040 bytes
0x820118A8 unknown_irp_handler 1880 bytes
0x826989C0 unknown_irp_handler 1600 bytes
0x829F2B78 unknown_irp_handler 1160 bytes
0x82664B80 unknown_irp_handler 1152 bytes
0x82BD2BF8 unknown_irp_handler 1032 bytes
0x82BD5C78 unknown_irp_handler 904 bytes
0x82B87E30 unknown_irp_handler 464 bytes
0x828B6EB0 unknown_irp_handler 336 bytes
==============================================
>Stealth
==============================================
WARNING: File locked for read access [C:\WINDOWS\system32\drivers\dtscsi.sys]
WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]
WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd3085.sys]

Broni · Jul 28, 2011

Very well

BTW...

Downloaded CleanMyPc-Registry Cleaner

I suggest you uninstall it right away.
Registry cleaners/optimizers are not recommended for several reasons:

Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".

Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

==================================================================

Now....

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Klyonh2010 · Jul 28, 2011

Malwarebytes report you asked for.

-Here it is. Computer appears to be running much better for sure.

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7312

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/28/2011 7:48:44 PM
mbam-log-2011-07-28 (19-48-44).txt

Scan type: Quick scan
Objects scanned: 162443
Time elapsed: 17 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 13
Files Infected: 78

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TDSSserv.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
c:\documents and settings\Family\application data\spywarebot (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08 (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10003.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10012.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10016.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10022.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10024.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10025.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10026.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\registry backups (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings (Rogue.SpywareBot) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\Family\local settings\Temp\TDSS8f3d.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSbe2.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSS1d0.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSS3d3.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSS606.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSS829.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSeed4.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSf2cc.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSf695.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSfc80.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSfd4b.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\documents and settings\Family\local settings\Temp\TDSS2054.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\Family\local settings\Temp\TDSS8f2e.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\Family\local settings\Temp\TDSSf82b.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSe917.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\TDSSf712.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\rs.dat (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 02_25_27 pm_265.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 02_25_28 pm_187.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 02_25_28 pm_546.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 02_25_28 pm_609.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 04_27_31 pm_359.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 04_27_31 pm_531.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 04_27_32 pm_437.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Log\2009 may 23 - 04_27_32 pm_968.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10009.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10000.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10000.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10001.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10001.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10002.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10002.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10003.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10004.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10004.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10005.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10005.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10006.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10006.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10007.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10007.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10008.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10008.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10009.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10010.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10010.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10011.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10011.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10012.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10013.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10013.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10014.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10014.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10015.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10015.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10016.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10017.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10017.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10018.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10018.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10019.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10019.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10020.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10020.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10021.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10021.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10022.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10023.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10023.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10024.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10025.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\quarantine\08-12-2008-17-12-08\10026.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings\customscan.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings\ignorelist.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings\ScanInfo.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings\scanresults.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings\selectedfolders.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\Family\application data\spywarebot\Settings\Settings.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully.

Broni · Jul 28, 2011

Good

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Klyonh2010 · Jul 28, 2011

Combofix Log Requested

-Here it is.

ComboFix 11-07-28.06 - Family 07/28/2011 21:24:07.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.209 [GMT -4:00]
Running from: c:\documents and settings\Family\Desktop\ComboFix.exe
AV: McAfee VirusScan *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Family\Recent\Thumbs.db
c:\documents and settings\Family\WINDOWS
C:\DSC00728.JPG
C:\DSCN3268.JPG
C:\Thumbs.db
c:\windows\desktop
c:\windows\Readme.txt
c:\windows\system32\stu2.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Legacy_TDSSSERV.SYS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-28 to 2011-07-29 )))))))))))))))))))))))))))))))
.
.
2011-07-28 23:25 . 2011-07-28 23:25 -------- d-----w- c:\documents and settings\Family\Application Data\Malwarebytes
2011-07-28 03:34 . 2011-07-28 03:37 -------- d-----w- C:\Temp
2011-07-28 01:30 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-28 01:29 . 2011-07-28 01:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-28 01:29 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-27 23:52 . 2011-07-27 23:52 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-07-27 23:51 . 2011-07-27 23:51 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-07-27 21:23 . 2011-07-27 21:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-07-27 18:29 . 2001-08-18 02:36 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2011-07-27 18:29 . 2001-08-18 02:36 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2011-07-25 03:56 . 2011-07-28 23:23 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-07-25 03:56 . 2011-07-25 03:56 -------- d-----w- c:\program files\CleanMyPC
2011-07-25 02:10 . 2011-07-25 02:10 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-07-25 02:07 . 2011-07-25 02:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-07-25 02:07 . 2011-07-25 02:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-07-24 22:46 . 2011-07-24 22:46 -------- d-sh--w- c:\documents and settings\Family\IECompatCache
2011-07-24 21:29 . 2011-07-24 21:29 -------- d-----w- c:\windows\SxsCaPendDel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-02 14:02 . 2004-08-04 10:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31 . 2004-08-04 10:00 692736 ----a-w- c:\windows\system32\inetcomm.dll
2004-08-10 03:30 . 2006-04-04 01:04 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2011-07-08 07:16 . 2011-07-25 01:53 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-26 185896]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-06-29 32768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-10 385024]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-10-26 136768]
.
c:\documents and settings\Family\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MpfService"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"gusvc"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
.
R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [8/8/2006 10:06 AM 643072]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [7/27/2011 9:30 PM 366640]
R3 MBAMProtector;MBAMProtector;c:\windows\SYSTEM32\DRIVERS\mbam.sys [7/27/2011 9:29 PM 22712]
S0 46728264;46728264;c:\windows\system32\drivers\34903153.sys --> c:\windows\system32\drivers\34903153.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys [7/27/2011 9:30 PM 41272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 16:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: microsoft.com\windowsupdate
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Family\Application Data\Mozilla\Firefox\Profiles\oolann1c.default\
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-46728264.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-28 21:34
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-858501603-3356223048-2641331676-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2892)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2011-07-28 21:40:54 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-29 01:40
.
Pre-Run: 54,202,413,056 bytes free
Post-Run: 54,424,084,480 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - DD14E861B2BFE1377B07274346649DE4

Broni · Jul 28, 2011

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box
Click OK

Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\windows\system32\drivers\34903153.sys


Folder::

Driver::
46728264

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000000

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

Klyonh2010 · Jul 28, 2011

Here it is.

-Here is the latest:

ComboFix 11-07-28.07 - Family 07/28/2011 22:04:29.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.187 [GMT -4:00]
Running from: c:\documents and settings\Family\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Family\Desktop\CFScript.txt
AV: McAfee VirusScan *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
FILE ::
"c:\windows\system32\drivers\34903153.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_46728264
.
.
((((((((((((((((((((((((( Files Created from 2011-06-28 to 2011-07-29 )))))))))))))))))))))))))))))))
.
.
2011-07-28 23:25 . 2011-07-28 23:25 -------- d-----w- c:\documents and settings\Family\Application Data\Malwarebytes
2011-07-28 03:34 . 2011-07-28 03:37 -------- d-----w- C:\Temp
2011-07-28 01:30 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-28 01:29 . 2011-07-28 01:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-28 01:29 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-27 23:52 . 2011-07-27 23:52 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-07-27 23:51 . 2011-07-27 23:51 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-07-27 21:23 . 2011-07-27 21:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-07-27 18:29 . 2001-08-18 02:36 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2011-07-27 18:29 . 2001-08-18 02:36 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2011-07-25 03:56 . 2011-07-28 23:23 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-07-25 03:56 . 2011-07-25 03:56 -------- d-----w- c:\program files\CleanMyPC
2011-07-25 02:10 . 2011-07-25 02:10 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-07-25 02:07 . 2011-07-25 02:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-07-25 02:07 . 2011-07-25 02:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-07-24 22:46 . 2011-07-24 22:46 -------- d-sh--w- c:\documents and settings\Family\IECompatCache
2011-07-24 21:29 . 2011-07-24 21:29 -------- d-----w- c:\windows\SxsCaPendDel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-02 14:02 . 2004-08-04 10:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31 . 2004-08-04 10:00 692736 ----a-w- c:\windows\system32\inetcomm.dll
2004-08-10 03:30 . 2006-04-04 01:04 40960 ----a-w- c:\program files\Uninstall_CDS.exe
2011-07-08 07:16 . 2011-07-25 01:53 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-29_01.33.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-29 02:14 . 2011-07-29 02:14 16384 c:\windows\Temp\Perflib_Perfdata_770.dat
+ 2005-04-29 04:50 . 2011-07-29 02:18 53436 c:\windows\SYSTEM32\PERFC009.DAT
- 2005-04-29 04:50 . 2011-07-29 01:38 53436 c:\windows\SYSTEM32\PERFC009.DAT
+ 2005-04-29 04:50 . 2011-07-29 02:18 381692 c:\windows\SYSTEM32\PERFH009.DAT
- 2005-04-29 04:50 . 2011-07-29 01:38 381692 c:\windows\SYSTEM32\PERFH009.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-26 185896]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-06-29 32768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-10 385024]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-10-26 136768]
.
c:\documents and settings\Family\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MpfService"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"gusvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
.
R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [8/8/2006 10:06 AM 643072]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [7/27/2011 9:30 PM 366640]
R3 MBAMProtector;MBAMProtector;c:\windows\SYSTEM32\DRIVERS\mbam.sys [7/27/2011 9:29 PM 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys [7/27/2011 9:30 PM 41272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 16:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: microsoft.com\windowsupdate
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Family\Application Data\Mozilla\Firefox\Profiles\oolann1c.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-28 22:15
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-858501603-3356223048-2641331676-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2868)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-07-28 22:20:45 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-29 02:20
ComboFix2.txt 2011-07-29 01:40
.
Pre-Run: 54,421,839,872 bytes free
Post-Run: 54,408,327,168 bytes free
.
- - End Of File - - B0DE8A0D2A736C81183E9DC46DC9C99D

Broni · Jul 28, 2011

Looks good

How is computer doing?

Is McAfee your current security program, or I just see some leftovers?

Klyonh2010 · Jul 28, 2011

Thought I Removed McAfee.

I thought I had removed McAfee from this computer. I use it on all my others and it seems to work well, but this computer I let fall off the program.

How do I get rid of those leftovers and what do you suggest? I usurp to a god when it comes to expertise on computers. You are amazing. Thank You.

I plan to keep Malwarebytes and probably go ahead and get the paid for version (if you suggest it that is).

It is running good, haven't tried much yet, but what I have has been great. I've pretty much been concentrating on what you tell me to do to get through this.

Please advise, what should I do for protecting all my computers? We have 2 other laptops and another desktop. Laptops run Vista and other Desktop is just like this one. After this incredible display of knowledge, I will gladly take any advice you might have to offer. I'm sure they could all use a good cleaning, can I use this thread to do this for all my comptures? Or did you have to do a lot behind the scenes during this process? Or should I just ask, what do you use for protection?

Thank you so much.

PS- How do you get paid for all this? Where does the money come from for this incredibly awesome service?

Oh, and by the way, I don't have anything on here right now other than Malwarebytes that I know of. Was hoping to get suggestion
from you. And then I will probably go ahead and switch all of them over to whatever you suggest. Thanks for any additional info you would be willing to offer, I know you've done enough already.

Broni · Jul 28, 2011

How do you get paid for all this?

By people saying "Thank you"

Our service is free

We're not totally done, but I wanted to see some update on your computer condition.

As for McAfee, run this tool to remove leftovers: http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml

Then, install one of these:
- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
- Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html
Update, run full scan, report on any findings.

When done....

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Klyonh2010 · Jul 29, 2011

First One from OLT

-Downloaded and Ran Avast prior to this. Full Scan produced two Trojan-exe files that I chose delete option for, but I was unable to produce a report from it. So I ran it again and then it came up with nothing.

OTL logfile created on: 7/29/2011 12:43:47 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Family\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

509.98 Mb Total Physical Memory | 202.06 Mb Available Physical Memory | 39.62% Memory free
1.22 Gb Paging File | 0.89 Gb Available in Paging File | 72.91% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.94 Gb Total Space | 50.41 Gb Free Space | 71.05% Space Free | Partition Type: NTFS

Computer Name: FAMILY | User Name: Family | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/29 00:39:35 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Family\Desktop\OTL.exe
PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/07/04 07:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/06/28 21:29:42 | 000,032,768 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

========== Modules (SafeList) ==========

MOD - [2011/07/29 00:39:35 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Family\Desktop\OTL.exe
MOD - [2011/07/04 07:43:51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/07/04 07:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)

========== Driver Services (SafeList) ==========

DRV - [2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys -- (MBAMProtector)
DRV - [2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nmnt.sys -- (nm)
DRV - [2006/08/08 10:09:09 | 000,223,128 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\dtscsi.sys -- (dtscsi)
DRV - [2006/08/08 10:06:57 | 000,643,072 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2005/06/02 19:28:38 | 000,171,008 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\MarvinBus.sys -- (MarvinBus)
DRV - [2005/02/09 12:59:00 | 000,014,165 | ---- | M] (Pinnacle Systems GmbH) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Pclepci.sys -- (PCLEPCI)
DRV - [2004/09/17 10:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys -- (senfilt)
DRV - [2004/06/15 23:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC53.sys -- (IntelC53)
DRV - [2004/03/05 23:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC52.sys -- (IntelC52)
DRV - [2004/03/05 23:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\IntelC51.sys -- (IntelC51)
DRV - [2004/03/05 23:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\mohfilt.sys -- (mohfilt)
DRV - [2003/12/05 14:46:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys -- (pfc)
DRV - [2000/03/29 17:11:20 | 000,008,096 | ---- | M] (MicroStaff Co.,Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\MASPINT.SYS -- (MASPINT)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C BF E0 58 74 4A CC 01 [binary data]
IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.46: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKCU\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/10/26 16:59:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/07/28 23:21:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/24 21:53:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/24 18:04:33 | 000,000,000 | ---D | M]

[2011/07/24 21:54:05 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Family\Application Data\Mozilla\Extensions
[2011/07/24 21:53:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/07/08 03:16:28 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2006/08/07 14:30:19 | 002,078,344 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NPSWF32.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/07/28 22:14:35 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [RealUpgradeHelper] C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [RealUpgradeHelper] C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-18..\RunOnce: [RunNarrator] C:\WINDOWS\System32\narrator.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Family\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKU\S-1-5-21-858501603-3356223048-2641331676-1006\..Trusted Domains: microsoft.com ([windowsupdate] http in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/common/groove/gx/GrooveAX27.cab (Groove Control)
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://a532.g.akamai.net/f/532/6712....akamai.com/6712/player/install/installer.exe (Virtools WebPlayer Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Family\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Family\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/04/06 20:17:39 | 000,000,095 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - File not found
O34 - HKLM BootExecute: (aswBoot.exe /A:"*" /L:"1033" /KBD:2 /dir:"C:\Program Files\AVAST Software\Avast") - C:\WINDOWS\System32\aswBoot.exe (AVAST Software)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\IR41_32.DLL ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\IYVU9_32.DLL ()
Drivers32: wave - C:\WINDOWS\System32\SERWVDRV.DLL (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/29 00:39:25 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Family\Desktop\OTL.exe
[2011/07/28 23:22:01 | 000,019,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/07/28 23:22:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2011/07/28 23:22:00 | 000,309,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/07/28 23:21:56 | 000,025,432 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/07/28 23:21:55 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/07/28 23:21:55 | 000,043,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/07/28 23:21:53 | 000,102,616 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/07/28 23:21:53 | 000,096,344 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/07/28 23:21:53 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/07/28 23:21:29 | 000,040,112 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/07/28 23:21:28 | 000,199,304 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/07/28 23:21:13 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011/07/28 23:21:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/07/28 23:08:43 | 001,832,544 | ---- | C] (McAfee, Inc.) -- C:\Documents and Settings\Family\Desktop\MCPR.exe
[2011/07/28 21:22:05 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/07/28 20:24:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/07/28 20:24:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/07/28 20:24:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/07/28 20:24:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/07/28 20:24:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/07/28 20:24:26 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/07/28 20:20:58 | 006,615,552 | ---- | C] (OPSWAT, Inc.) -- C:\Documents and Settings\Family\Desktop\AppRemover.exe
[2011/07/28 19:59:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2011/07/28 19:25:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Family\Application Data\Malwarebytes
[2011/07/28 17:59:18 | 001,436,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Family\Desktop\tdsskiller.exe
[2011/07/28 00:18:14 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Family\Start Menu\Programs\Administrative Tools
[2011/07/28 00:17:11 | 000,607,017 | R--- | C] (Swearware) -- C:\Documents and Settings\Family\Desktop\dds.scr
[2011/07/27 23:34:48 | 000,000,000 | ---D | C] -- C:\Temp
[2011/07/27 21:30:01 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/27 21:30:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/07/27 21:29:57 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/07/27 21:29:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/07/27 19:52:08 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/07/27 19:51:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/07/27 17:23:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/07/27 16:00:28 | 004,157,170 | R--- | C] (Swearware) -- C:\Documents and Settings\Family\Desktop\ComboFix.exe
[2011/07/27 15:59:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Family\Desktop\AVG
[2011/07/27 15:58:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Family\Desktop\Malwarebytes
[2011/07/24 23:56:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/07/24 23:56:29 | 000,000,000 | ---D | C] -- C:\Program Files\CleanMyPC
[2011/07/24 21:53:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Family\Application Data\Mozilla
[2011/07/24 18:46:23 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Family\IECompatCache
[2011/07/24 17:29:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/29 00:39:35 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Family\Desktop\OTL.exe
[2011/07/28 23:22:02 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/07/28 23:21:54 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/07/28 23:16:33 | 000,381,692 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/07/28 23:16:33 | 000,053,436 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2011/07/28 23:12:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/07/28 23:12:14 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/28 23:08:55 | 001,832,544 | ---- | M] (McAfee, Inc.) -- C:\Documents and Settings\Family\Desktop\MCPR.exe
[2011/07/28 22:14:35 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/07/28 22:02:58 | 004,157,170 | R--- | M] (Swearware) -- C:\Documents and Settings\Family\Desktop\ComboFix.exe
[2011/07/28 21:22:12 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2011/07/28 20:21:06 | 006,615,552 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Family\Desktop\AppRemover.exe
[2011/07/28 19:59:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/07/28 18:48:43 | 000,002,501 | ---- | M] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2011/07/28 18:35:56 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Family\Desktop\RKUnhookerLE.EXE
[2011/07/28 18:09:05 | 000,000,281 | ---- | M] () -- C:\Documents and Settings\Family\Desktop\Shortcut to tdsskiller.lnk
[2011/07/28 17:57:14 | 001,436,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Family\Desktop\tdsskiller.exe
[2011/07/28 00:15:18 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Family\Desktop\x8irh4vc.exe
[2011/07/28 00:06:34 | 000,607,017 | R--- | M] (Swearware) -- C:\Documents and Settings\Family\Desktop\dds.scr
[2011/07/27 21:30:01 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/07/27 21:30:01 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/27 18:42:09 | 000,001,475 | ---- | M] () -- C:\Documents and Settings\Family\Desktop\Windows Explorer.lnk
[2011/07/24 23:58:24 | 007,538,161 | ---- | M] () -- C:\Documents and Settings\Family\My Documents\Registry Backup.cab
[2011/07/24 21:53:45 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/07/24 21:53:45 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/07/24 21:07:50 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/07/24 17:21:49 | 000,114,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/07/04 07:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2011/07/04 07:43:51 | 000,199,304 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2011/07/04 07:36:43 | 000,441,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/07/04 07:36:32 | 000,309,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2011/07/04 07:35:23 | 000,043,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2011/07/04 07:35:12 | 000,102,616 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2011/07/04 07:35:09 | 000,096,344 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2011/07/04 07:32:32 | 000,025,432 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2011/07/04 07:32:13 | 000,030,808 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2011/07/04 07:32:12 | 000,019,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/28 23:22:02 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2011/07/28 21:22:12 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/07/28 21:22:10 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/07/28 20:24:41 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/07/28 20:24:41 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/07/28 20:24:41 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/07/28 20:24:41 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/07/28 20:24:41 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/07/28 18:35:56 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\Family\Desktop\RKUnhookerLE.EXE
[2011/07/28 18:09:05 | 000,000,281 | ---- | C] () -- C:\Documents and Settings\Family\Desktop\Shortcut to tdsskiller.lnk
[2011/07/28 00:17:14 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Family\Desktop\x8irh4vc.exe
[2011/07/27 21:30:01 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/07/27 21:30:01 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/24 23:58:24 | 007,538,161 | ---- | C] () -- C:\Documents and Settings\Family\My Documents\Registry Backup.cab
[2011/07/24 22:25:03 | 534,827,008 | -HS- | C] () -- C:\hiberfil.sys
[2011/07/24 21:53:45 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/07/24 21:53:45 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/07/24 21:53:44 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2008/11/10 16:16:25 | 000,000,027 | ---- | C] () -- C:\WINDOWS\rkeeper.ini
[2008/11/10 16:09:59 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\IYVU9_32.DLL
[2008/11/10 16:09:58 | 001,413,958 | ---- | C] () -- C:\WINDOWS\System32\IR41_32.DLL
[2007/11/25 08:44:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
[2006/08/08 10:09:09 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2006/08/08 10:06:57 | 000,096,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd3085.sys
[2006/08/06 00:58:00 | 000,003,047 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/04/06 20:17:39 | 000,001,182 | ---- | C] () -- C:\WINDOWS\VFO.INI
[2006/04/03 21:04:33 | 000,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe
[2006/01/22 15:51:32 | 000,001,783 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/12/18 20:24:55 | 000,004,581 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005/11/19 00:20:06 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/06/12 09:46:59 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\Family\Application Data\PFP120JPR.{PB
[2005/06/12 09:46:59 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Family\Application Data\PFP120JCM.{PB
[2005/05/31 12:00:28 | 003,166,720 | ---- | C] () -- C:\WINDOWS\rct.exe
[2005/05/14 09:32:37 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL
[2005/05/14 09:32:37 | 000,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini
[2005/05/07 00:48:16 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\Family\Local Settings\Application Data\fusioncache.dat
[2005/05/07 00:01:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/05/06 17:33:13 | 000,023,552 | ---- | C] () -- C:\Documents and Settings\Family\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/05/05 22:12:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/05/05 22:04:41 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/05/05 21:36:16 | 000,001,053 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2005/04/29 01:15:51 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/04/29 01:13:36 | 000,000,298 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/04/29 01:09:40 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/04/29 00:52:18 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2005/04/29 00:50:38 | 000,381,692 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2005/04/29 00:50:38 | 000,053,436 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2005/04/29 00:35:44 | 000,000,370 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/03/28 17:45:46 | 000,000,430 | ---- | C] () -- C:\WINDOWS\System32\DLBTPLC.INI
[2005/01/28 09:08:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/12/20 18:24:03 | 001,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2004/08/10 14:13:12 | 000,000,780 | ---- | C] () -- C:\WINDOWS\ORUN32.INI
[2004/08/10 14:08:08 | 000,114,176 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 14:03:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 14:02:16 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 11:08:26 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/10 11:08:26 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/04 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2004/08/04 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2004/08/04 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2004/08/04 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2004/08/04 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2004/08/04 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\SECUPD.DAT
[2004/08/04 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\FXSPERF.INI
[2004/08/04 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2004/07/19 17:01:02 | 000,045,056 | ---- | C] () -- C:\WINDOWS\SETPWRCG.EXE
[1980/01/01 01:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2011/07/28 23:21:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/07/27 19:52:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2007/07/24 13:34:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2011/07/27 19:51:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2006/04/07 21:35:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2006/04/06 20:14:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
[2011/07/24 17:32:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2011/07/28 19:23:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/07/24 17:38:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VTech
[2007/08/05 08:00:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\Aim
[2006/11/24 12:23:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\Azureus
[2005/05/15 21:47:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\FUJIFILM
[2005/05/31 12:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\Leadertech
[2005/05/20 22:50:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\MSNInstaller
[2011/07/24 17:59:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\Musicmatch
[2005/11/29 15:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\Opera
[2011/06/05 09:33:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Family\Application Data\SBTT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2007/08/16 15:33:13 | 001,240,461 | ---- | M] () -- C:\1.5 inch Snap Lock Specifications.pdf
[2005/07/31 19:40:54 | 002,785,626 | ---- | M] () -- C:\AMDdrvpk_130.exe
[2006/04/06 20:17:39 | 000,000,095 | ---- | M] () -- C:\AUTOEXEC.BAT
[2005/07/31 20:10:47 | 003,839,488 | ---- | M] (Microsoft Corporation) -- C:\Belkin Drivers.exe
[2009/06/10 05:39:01 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/07/28 21:22:12 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2005/11/06 12:57:34 | 009,382,948 | ---- | M] () -- C:\CALENDAR TEMPLATE.cab
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/07/28 22:20:46 | 000,008,807 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/08/13 19:24:48 | 001,236,908 | R--- | M] () -- C:\Copy of DSCN3224.JPG
[2006/04/25 21:42:26 | 000,091,648 | ---- | M] () -- C:\Crowther Initial Presentation.ppt
[2005/04/29 00:39:56 | 000,004,991 | RH-- | M] () -- C:\DELL.SDR
[2011/07/27 14:29:42 | 000,000,202 | ---- | M] () -- C:\dlbt.log
[2006/08/17 03:38:17 | 000,000,068 | ---- | M] () -- C:\DVDPATH.TXT
[2011/07/28 23:12:14 | 534,827,008 | -HS- | M] () -- C:\hiberfil.sys
[2004/08/10 14:14:36 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2004/08/10 14:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2005/04/29 01:11:25 | 000,000,808 | -H-- | M] () -- C:\IPH.PH
[2007/09/21 10:08:46 | 000,041,472 | ---- | M] () -- C:\Kentucky Pass Through Laws.doc
[2004/08/10 14:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2007/07/24 15:13:11 | 002,350,970 | ---- | M] () -- C:\mvstcdxx.lst
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/12/08 17:25:14 | 000,250,048 | RHS- | M] () -- C:\NTLDR
[2011/07/28 23:12:13 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2007/11/09 21:46:06 | 000,030,344 | ---- | M] () -- C:\peanutlog.jpg
[2011/07/26 22:46:56 | 000,003,546 | ---- | M] () -- C:\reset.log
[2005/04/29 01:11:36 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
[2011/07/28 18:13:10 | 000,052,812 | ---- | M] () -- C:\TDSSKiller.2.5.11.0_28.07.2011_18.09.38_log.txt
[1 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 14:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/07/04 07:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2004/08/09 23:30:22 | 000,040,960 | ---- | M] () -- C:\Program Files\Uninstall_CDS.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 13:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\DEFAULT.SAV
[2004/08/10 13:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\System32\config\SOFTWARE.SAV
[2004/08/10 13:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/12/08 17:31:03 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/05/05 21:35:11 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2004/08/10 14:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Family\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/07/28 20:21:06 | 006,615,552 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Family\Desktop\AppRemover.exe
[2011/07/28 22:02:58 | 004,157,170 | R--- | M] (Swearware) -- C:\Documents and Settings\Family\Desktop\ComboFix.exe
[2011/07/28 23:08:55 | 001,832,544 | ---- | M] (McAfee, Inc.) -- C:\Documents and Settings\Family\Desktop\MCPR.exe
[2011/07/29 00:39:35 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Family\Desktop\OTL.exe
[2011/07/28 18:35:56 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Family\Desktop\RKUnhookerLE.EXE
[2011/07/28 17:57:14 | 001,436,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Family\Desktop\tdsskiller.exe
[2011/07/28 00:15:18 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Family\Desktop\x8irh4vc.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2006/04/07 21:43:22 | 081,334,119 | ---- | M] (InstallShield Software Corporation) -- C:\Documents and Settings\Family\My Documents\Studio10_5_full.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 06:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\FXSEXT.ECF

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2005/05/05 21:35:09 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Family\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/07/24 22:41:01 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Family\Cookies\desktop.ini
[2011/07/29 00:37:53 | 000,688,128 | ---- | M] () -- C:\Documents and Settings\Family\Cookies\INDEX.DAT

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2004/09/15 13:27:54 | 000,192,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 20:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 02:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\LOGOWIN.GIF
[2004/08/04 02:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\LVBACK.GIF
[2008/05/02 10:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 13:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 20:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 02:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\NEWALERT.WAV
[2004/08/04 02:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\NEWEMAIL.WAV
[2004/08/04 02:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\ONLINE.WAV
[2004/08/04 02:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\TYPE.WAV
[2004/08/04 02:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\XPMSGR.CHM

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 186 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ECF54A0E

< End of report >

Klyonh2010 · Jul 29, 2011

Second Report from OLT-Extras

OTL Extras logfile created on: 7/29/2011 12:43:47 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Family\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

509.98 Mb Total Physical Memory | 202.06 Mb Available Physical Memory | 39.62% Memory free
1.22 Gb Paging File | 0.89 Gb Available in Paging File | 72.91% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.94 Gb Total Space | 50.41 Gb Free Space | 71.05% Space Free | Partition Type: NTFS

Computer Name: FAMILY | User Name: Family | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-858501603-3356223048-2641331676-1006\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel(R) PROSet for Wired Connections
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{2E7595EC-4FB1-4E29-93D4-9083C8A9B107}" = TurboTax ItsDeductible 2005
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{47813E93-F2A0-484A-838E-47EC1B28D190}" = Adobe Stock Photos 1.0
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6EC874C2-F950-4B7E-A5B7-B1066D6B74AA}" = QuickTime
"{7373184D-8E8F-4308-912A-3901071FA1AD}" = LightScribe Applications
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}" = TurboTax ItsDeductible 2006
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe 1.8.13.1
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{EF781A5C-58F5-4BFD-87F9-E4F14D382F25}" = Pinnacle Instant DVD Recorder
"3DGroove" = 3D Groove Playback Engine
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"avast" = avast! Free Antivirus
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 5.0.1 (x86 en-US)" = Mozilla Firefox 5.0.1 (x86 en-US)
"MVApplication1" = SureThing CD Labeler 4 SE
"MWASPI" = MicroStaff WINASPI
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"RealPlayer 6.0" = RealPlayer
"SpongeBob SquarePants Obstacle Odyssey 2" = SpongeBob SquarePants Obstacle Odyssey 2
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/25/2011 2:02:18 AM | Computer Name = FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 7/25/2011 2:02:18 AM | Computer Name = FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 7/25/2011 2:02:18 AM | Computer Name = FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 7/25/2011 2:02:18 AM | Computer Name = FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 7/27/2011 5:28:31 PM | Computer Name = FAMILY | Source = Application Hang | ID = 1002
Description = Hanging application mbam-setup-1.51.1.1800.tmp, version 51.52.0.0,
hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/27/2011 5:29:01 PM | Computer Name = FAMILY | Source = Application Hang | ID = 1002
Description = Hanging application _iu14D2N.tmp, version 51.52.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 7/27/2011 5:30:34 PM | Computer Name = FAMILY | Source = Application Hang | ID = 1002
Description = Hanging application _iu14D2N.tmp, version 51.52.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 7/28/2011 11:19:24 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/28/2011 11:19:24 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 7/28/2011 11:19:39 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

[ System Events ]
Error - 7/28/2011 12:27:34 AM | Computer Name = FAMILY | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort0, did not respond within the timeout
period.

Error - 7/28/2011 7:52:59 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p
asc3550
cbidf
cd20xrnt
CmdIde
Cpqarray
dac2w2k
dac960nt
dpti2o
hpn
i2omp
ini910u
IntelIde
mraid35x
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
sisagp
Sparrow
symc810
symc8xx
sym_hi
sym_u3
TosIde
ultra
viaagp
ViaIde

Error - 7/28/2011 8:21:26 PM | Computer Name = FAMILY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 7/28/2011 8:21:26 PM | Computer Name = FAMILY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your system. .

Error - 7/28/2011 8:21:26 PM | Computer Name = FAMILY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\DOCUME~1\Family\LOCALS~1\Temp\RarSFX0\MFC80U.DLL.
Reference
error message: The operation completed successfully. .

Error - 7/28/2011 8:21:27 PM | Computer Name = FAMILY | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 7/28/2011 8:21:27 PM | Computer Name = FAMILY | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your system. .

Error - 7/28/2011 8:21:27 PM | Computer Name = FAMILY | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\DOCUME~1\Family\LOCALS~1\Temp\RarSFX0\MFC80U.DLL.
Reference
error message: The operation completed successfully. .

Error - 7/28/2011 9:34:45 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the HTTP SSL service to connect.

Error - 7/28/2011 9:34:45 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7000
Description = The HTTP SSL service failed to start due to the following error: %%1053

< End of report >

Klyonh2010 · Jul 29, 2011

Update on computer condition

It is faster than I can ever remember it on the internet. Everyting seems to be working great. I haven't tried running a "defrag" or "chkdsk" yet for I thought I should wait until we are done even though that was one of my problems. What do you think? Do you want me to try it now or wait?

All the other problems seem to have gone away though. And this thing is now
faster than my laptop, which is way newer with way more memor and everything
else. So what about my question: Can I do this on my laptop after we are done
to help it using this thread and all your previous directions?

Broni · Jul 29, 2011

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
@Alternate Data Stream - 186 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ECF54A0E

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

================================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

Klyonh2010 · Jul 29, 2011

Here is OTL:

-Here is the OTL you requested.

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET19.tmp deleted successfully.
C:\WINDOWS\System32\SETB7.tmp deleted successfully.
C:\WINDOWS\002706_.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\IO96BC~.TMP deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:ECF54A0E deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 7920218 bytes
->Flash cache emptied: 431 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
->Flash cache emptied: 83 bytes

User: Family
->Temp folder emptied: 6719804 bytes
->Temporary Internet Files folder emptied: 4337194 bytes
->Java cache emptied: 27647415 bytes
->FireFox cache emptied: 7007379 bytes
->Flash cache emptied: 3922050 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 147590 bytes
->Flash cache emptied: 300 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 998367 bytes
RecycleBin emptied: 15270036 bytes

Total Files Cleaned = 71.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Family
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.26.1 log created on 07292011_145405

Files\Folders moved on Reboot...
C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\XGQGPOFD\918[1].htm moved successfully.
C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\5G971G74\partner[1].htm moved successfully.
C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\5G971G74\topic168410-2[1].html moved successfully.
C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\4P11WTW7\sh47[1].html moved successfully.
C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

Klyonh2010 · Jul 29, 2011

Here is Security Check

-Security Check

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Adobe Flash Player
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Out of date Adobe Reader installed!
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
``````````End of Log````````````

Broni · Jul 29, 2011

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

Solved Can't load and run AV software for first step of guidelines..

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Similar threads