ricardo1979
Posts: 16 +0
Hi there,
I've run the recommended tools (MBAM, GMER and DDS), and some nasty stuff has turned up, but I don't know what to remove (logs pasted below)
My regular tools are AVG, Zonealarm, SBS&D
Any help very, very gratefully received!
Cheers, R
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Database version: 5243
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
12/4/2010 7:56:47 PM
mbam-log-2010-12-04 (19-56-47).txt
Scan type: Quick scan
Objects scanned: 165328
Time elapsed: 2 minute(s), 54 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\TBH (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0C7C23EF-A848-485B-873C-0ED954731014} (Trojan.Agent) -> Value: {0C7C23EF-A848-485B-873C-0ED954731014} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0C7C23EF-A848-485B-873C-0ED954731014} (Trojan.Agent) -> Value: {0C7C23EF-A848-485B-873C-0ED954731014} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Value: {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Value: {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Value: {A57E074F-56D8-4A33-8112-AAC9693AA909} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Value: {A57E074F-56D8-4A33-8112-AAC9693AA909} -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Start (Disabled.Cryptsvc) -> Bad: (4) Good: (2) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\system32\madCHook.dll (MadCodeHook) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\SSup.dll (Trojan.Agent) -> Quarantined and deleted successfully.
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-12-04 21:14:26
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\00000032 ST3802110AS_________________41N3273_LEN rev.3.AAH
Running: w1ryenmw.exe; Driver: C:\DOCUME~1\PC\LOCALS~1\Temp\fxddapow.sys
---- System - GMER 1.0.15 ----
SSDT spcq.sys ZwEnumerateKey [0xBA6C5CA4]
SSDT spcq.sys ZwEnumerateValueKey [0xBA6C6032]
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A5451F8
Device \Driver\atapi \Device\Ide\IdePort0 8A5451F8
Device \Driver\atapi \Device\Ide\IdePort1 8A5451F8
Device \Driver\aerp9gp3 \Device\Scsi\aerp9gp31Port3Path0Target0Lun0 8A087500
Device \Driver\aerp9gp3 \Device\Scsi\aerp9gp31 8A087500
Device \FileSystem\Fastfat \Fat 8A4FB1F8
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Device\00000071 -> \??\IDE#DiskST3802110AS_________________41N3273_LEN_3.AAH___#2020202020202020202020204C39315243464246#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- EOF - GMER 1.0.15 ----
DDS (Ver_10-11-27.01) - FAT32x86
Run by PC at 21:17:10.95 on 12/04/2010 Sat
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Professional 5.1.2600.2.936.86.1033.18.1982.1000 [GMT 0:00]
AV: AVG Anti-Virus Free Edition 2011 *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CMBCHINA\WebProtect\WPService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VM303_STI.EXE
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\AVG\AVG10\avgui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Documents and Settings\PC\My Documents\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.co.uk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
uWindows: load=?粑? ?
BHO: {00C6482D-C502-44C8-8409-FCE54AD9C208} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {53707962-6F74-2D53-2644-206D7942484F} - No File
BHO: {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} - No File
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: EndNote Web: {82d2e569-25a7-4e4d-9fa3-c5025b4b7912} - c:\program files\endnote web\ENWIEPlug.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - No File
BHO: {90760F64-1931-4AAC-8E2E-AB39AAC071E1} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No File
TB: EndNote Web: {945c8270-a848-11d5-a805-00b0d092f45b} - c:\program files\endnote web\ENWIEPlug.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - e:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [BigDog303] c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: Add to QQ Customized Emoticons
IE: Add to QQ Customized Panel
IE: Add to QQ Emotions
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send picture by MMS
IE: Send Picture with QQ MMS
IE: Upload to QQ Network Hard Disk
IE: ìí?óμ?QQ±í?é
IE: ìí?óμ?QQ±í?é
IE: 添加到QQ表情 - c:\program files\tencent\qq\AddEmotion.htm
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - c:\microgaming\poker\ladbrokesmpp\MPPoker.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - e:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F}
Trusted Zone: com.cn\mybank.icbc
Trusted Zone: com.cn\www.icbc
Trusted Zone: shanghaiexpat.com\jobs
DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715}
DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} - hxxps://site.cmbchina.com/download/CMBEdit.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844}
DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}
DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476}
DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} - hxxps://mybank.icbc.com.cn/icbc/NetSign.dll
DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://vip.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29}
TCP: {7AE70460-E422-4A20-968E-B73A31413B8E} = 8.8.8.8,8.8.4.4
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\pc\application data\mozilla\firefox\profiles\8o6anw1j.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\pc\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\pc\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\pc\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npaliedit.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Extension: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Extension: EndNote Web: {322e833a-a7d4-4277-97c6-334fa1622d6a} - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\{322e833a-a7d4-4277-97c6-334fa1622d6a}
FF - Extension: Zotero: zotero@chnm.gmu.edu - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\zotero@chnm.gmu.edu
============= SERVICES / DRIVERS ===============
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 249424]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 298448]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-3-23 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 67656]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2006-12-21 532224]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-10-11 6104656]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-9-10 265400]
R2 CMBWPS;Cmb WebProtect Support;c:\program files\cmbchina\webprotect\WPService.exe [2008-12-25 232848]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\postgresql\8.3\bin\pg_ctl.exe [2008-9-19 65536]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
S2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\icbcebanktools\icbcantiphishing\IcbcDaemon.exe [2009-10-14 397184]
S3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [2008-4-29 6656]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\drivers\cnxetp.sys --> c:\windows\system32\drivers\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\cnxetu.sys --> c:\windows\system32\drivers\CnxEtU.sys [?]
S3 CnxTgNW;Conexant AccessRunner ADSL WAN PPPoA Adapter Driver;c:\windows\system32\drivers\cnxtgnw.sys --> c:\windows\system32\drivers\CnxTgNW.sys [?]
S3 GKeyUSB;GKeyUSB;c:\windows\system32\drivers\GKeyUSB.sys [2007-9-7 62096]
S3 Irisp2ht;irisp2ht.sys bulk pen driver;c:\windows\system32\drivers\irisp2ht.sys [2009-1-12 16516]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.188\McCHSvc.exe [2010-10-5 237008]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\27.tmp --> c:\windows\system32\27.tmp [?]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 12872]
S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2006-12-24 428160]
=============== File Associations ===============
chm.file="hh.exe" %1
txtfile=c:\windows\notepad.exe %1
=============== Created Last 30 ================
2010-12-04 19:48:22 -------- d-----w- c:\docume~1\pc\applic~1\Malwarebytes
2010-12-04 19:47:53 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-04 19:47:52 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-12-04 19:47:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-04 19:47:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-04 18:01:28 -------- d-sh--w- C:\FOUND.001
2010-12-04 17:47:30 -------- d-sh--w- C:\FOUND.000
2010-12-04 15:53:42 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-12-04 15:50:21 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2010-12-04 15:50:00 -------- d-----w- c:\program files\McAfee Security Scan
2010-12-04 15:31:37 -------- d-----w- c:\docume~1\alluse~1\applic~1\F-Secure
2010-12-04 15:10:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-12-02 14:15:30 -------- d-----w- c:\program files\HandHistory
2010-11-28 22:19:22 -------- d-----w- C:\spoolerlogs
2010-11-28 06:23:37 -------- d-----w- c:\program files\Veetle
2010-11-24 23:51:41 -------- d-----w- c:\docume~1\pc\applic~1\Pyti
2010-11-24 23:51:41 -------- d-----w- c:\docume~1\pc\applic~1\Hohi
2010-11-23 18:30:06 -------- d-----w- c:\program files\iPod
2010-11-23 18:30:02 -------- d-----w- c:\program files\iTunes
2010-11-23 18:30:02 -------- d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-11-23 18:24:33 -------- d-----w- c:\program files\Bonjour
2010-11-23 17:47:42 -------- d-----w- c:\docume~1\pc\applic~1\OpenOffice.org
2010-11-23 17:41:57 -------- d-----w- c:\program files\JRE
2010-11-23 17:41:51 -------- d-----w- c:\program files\OpenOffice.org 3
2010-11-22 03:48:57 -------- d-----w- c:\docume~1\pc\locals~1\applic~1\TruePoker
2010-11-22 03:46:15 -------- d-----w- c:\program files\TruePoker
2010-11-17 04:04:36 -------- d-----w- c:\windows\system32\drivers\AVG
2010-11-07 19:49:03 -------- d-----w- c:\docume~1\pc\applic~1\XPTpoker
==================== Find3M ====================
2010-12-04 15:09:54 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-07 12:23:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-10-07 12:23:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-09-08 11:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 11:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
=================== ROOTKIT ====================
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3802110AS_________________41N3273_LEN rev.3.AAH -> Harddisk0\DR0 -> \Device\0000008e
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A2FCEC5]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8827c872; SUB DWORD [EBP-0x4], 0x8827c12e; PUSH EDI; CALL 0xffffffffffffdf33; }
1 ntkrnlpa!IofCallDriver[0x804EDFEA] -> \Device\Harddisk0\DR0[0x8A45CAB8]
3 CLASSPNP[0xBA8E905B] -> ntkrnlpa!IofCallDriver[0x804EDFEA] -> \Device\00000072[0x8A4BA908]
5 ACPI[0xBA666620] -> ntkrnlpa!IofCallDriver[0x804EDFEA] -> [0x8A45C030]
[0x8A465F38] -> IRP_MJ_CREATE -> 0x8A2FCEC5
error: Read Incorrect function.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\00000071 -> \??\IDE#DiskST3802110AS_________________41N3273_LEN_3.AAH___#2020202020202020202020204C39315243464246#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi -> 0x8a5451f8
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
============= FINISH: 21:21:55.04 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-11-27.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 12/21/2006 9:59:25 AM
System Uptime: 12/4/2010 8:34:25 PM (1 hours ago)
Motherboard: PCCHIPS | | A13G
Processor: AMD Sempron(tm) Processor 3200+ | Socket M2 | 1808/201mhz
==== Disk Partitions =========================
C: is FIXED (FAT32) - 16 GiB total, 2.702 GiB free.
D: is FIXED (FAT32) - 29 GiB total, 1.368 GiB free.
E: is FIXED (FAT32) - 29 GiB total, 2.929 GiB free.
F: is CDROM ()
H: is CDROM ()
J: is Removable
==== Disabled Device Manager Items =============
Class GUID:
Description:
Device ID: ROOT\LEGACY_UDFS\SYSTEM
Manufacturer:
Name:
PNP Device ID: ROOT\LEGACY_UDFS\SYSTEM
Service:
==== System Restore Points ===================
RP1: 12/4/2010 8:24:15 PM - System Checkpoint
==== Installed Programs ======================
?§??±|°2è????t 1,1,0,1
32 Bit HP CIO Components Installer
50 FREE MP3s +1 Free Audiobook!
888poker.net
Adobe Download Manager
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 8.1.4
Adobe Shockwave Player 11.5
Adobe? Photoshop? Album Starter Edition 3.0
Alipay security control 2,4,0,1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AudibleManager
AVG 2011
B109a-m
Bonjour
BufferChm
Chinese Simplified Fonts Support For Adobe Reader 8
Creative Software AutoUpdate
Creative System Information
Creative ZEN
CyberTweak Version 1.3 Final
D1300_Help
Dafa Poker
Destinations
DeviceDiscovery
DoubleRing Pc Camera (Vimicro301 Neptune)
EndNote Web
Everest Poker (Remove Only)
Flickr Uploadr 3.0.5
Free Mp3 Wma Converter V 1.9
FreshDiagnose
GemSafe OEM Edition 5.0 for China
Google Chrome
Google Talk Plugin
GPBaseService2
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
HP Customer Participation Program 14.0
HP Imaging Device Functions 14.0
HP Photosmart B109a-m All-in-One Driver Software 14.0 Rel. 6
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
hph_readme
hph_software_req
HPProductAssistant
HPSSupply
ICBC install (goldpac personal version)
ICBC Token CSP - Goldpac 2007
icbc_netbank_client_controls
InFlac 1.1.1
iTunes
Java Auto Updater
Java(TM) 6 Update 22
LEAD MCMP_MJPEG Codec Eval
Malwarebytes' Anti-Malware
MarketResearch
McAfee Security Scan Plus
Microsoft .NET Framework 2.0
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.3
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MobileMe Control Panel
Mozilla Firefox (3.6.12)
Mozilla Thunderbird (2.0.0.23)
MSVCRT
NVIDIA Drivers
On-line Help Console
OpenOffice.org 3.2
PokerStove version 1.23
PokerTracker 3 (remove only)
PostgreSQL 8.3
PowerDVD
PS_AIO_06_B109a-m_SW_Min
QuickTime
QuickTransfer
RealPlayer
Realtek High Definition Audio Driver
ResearchSoft Direct Export Helper
Scan
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Segoe UI
Shop for HP Supplies
Skype web features
Skype? 4.2
SmartWebPrinting
SnagIt 8
SolutionCenter
Sophos Anti-Rootkit 1.5.4
SOSO AddressBar Search
Spybot - Search & Destroy
Status
Storm Codec
StormPlayer
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
TruePoker (High Res)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
VC 9.0 Runtime
Veetle TV 0.9.18
VJOcx2.0
WebFldrs XP
WebReg
Winamp
Winamp Application Detect
Winamp Toolbar
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
XPTpoker
ZEN Media Explorer
ZENcast Organizer
ZoneAlarm
μTorrent
中国工商银行防钓鱼软件
工行IE浏览器安全插件
招商银行一网通网盾
支付宝插件 1.2.0.2
==== Event Viewer Messages From Past Week ========
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Workstation service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The HID Input Service service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/4/2010 8:19:46 PM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Logical Disk Manager service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Error Reporting Service service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
12/4/2010 8:19:45 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
12/4/2010 8:19:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the NVIDIA Display Driver Service service to connect.
12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The System Event Notification service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The NVIDIA Display Driver Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The pipe state is invalid.
12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Cmb WebProtect Support service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 6:07:06 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
11/30/2010 5:55:35 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
11/30/2010 5:54:47 PM, error: Service Control Manager [7034] - The ICBC Daemon Service service terminated unexpectedly. It has done this 1 time(s).
11/30/2010 5:53:10 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
11/30/2010 5:53:10 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
11/30/2010 3:21:29 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'javacpl.cpl' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
11/30/2010 2:58:22 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
11/28/2010 3:22:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/28/2010 3:07:51 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
11/28/2010 12:46:54 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SASDIFSV SASKUTIL Tcpip vsdatant
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the vsdatant service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 11:59:55 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\mfc40.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 4.1.0.6140.
11/28/2010 10:20:19 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/27/2010 2:32:16 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
==== End Of File ===========================
I've run the recommended tools (MBAM, GMER and DDS), and some nasty stuff has turned up, but I don't know what to remove (logs pasted below)
My regular tools are AVG, Zonealarm, SBS&D
Any help very, very gratefully received!
Cheers, R
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Database version: 5243
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
12/4/2010 7:56:47 PM
mbam-log-2010-12-04 (19-56-47).txt
Scan type: Quick scan
Objects scanned: 165328
Time elapsed: 2 minute(s), 54 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\TBH (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0C7C23EF-A848-485B-873C-0ED954731014} (Trojan.Agent) -> Value: {0C7C23EF-A848-485B-873C-0ED954731014} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0C7C23EF-A848-485B-873C-0ED954731014} (Trojan.Agent) -> Value: {0C7C23EF-A848-485B-873C-0ED954731014} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Value: {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Value: {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Value: {A57E074F-56D8-4A33-8112-AAC9693AA909} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Value: {A57E074F-56D8-4A33-8112-AAC9693AA909} -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Start (Disabled.Cryptsvc) -> Bad: (4) Good: (2) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\system32\madCHook.dll (MadCodeHook) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\SSup.dll (Trojan.Agent) -> Quarantined and deleted successfully.
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-12-04 21:14:26
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\00000032 ST3802110AS_________________41N3273_LEN rev.3.AAH
Running: w1ryenmw.exe; Driver: C:\DOCUME~1\PC\LOCALS~1\Temp\fxddapow.sys
---- System - GMER 1.0.15 ----
SSDT spcq.sys ZwEnumerateKey [0xBA6C5CA4]
SSDT spcq.sys ZwEnumerateValueKey [0xBA6C6032]
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A5451F8
Device \Driver\atapi \Device\Ide\IdePort0 8A5451F8
Device \Driver\atapi \Device\Ide\IdePort1 8A5451F8
Device \Driver\aerp9gp3 \Device\Scsi\aerp9gp31Port3Path0Target0Lun0 8A087500
Device \Driver\aerp9gp3 \Device\Scsi\aerp9gp31 8A087500
Device \FileSystem\Fastfat \Fat 8A4FB1F8
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Device\00000071 -> \??\IDE#DiskST3802110AS_________________41N3273_LEN_3.AAH___#2020202020202020202020204C39315243464246#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- EOF - GMER 1.0.15 ----
DDS (Ver_10-11-27.01) - FAT32x86
Run by PC at 21:17:10.95 on 12/04/2010 Sat
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Professional 5.1.2600.2.936.86.1033.18.1982.1000 [GMT 0:00]
AV: AVG Anti-Virus Free Edition 2011 *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CMBCHINA\WebProtect\WPService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VM303_STI.EXE
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\AVG\AVG10\avgui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Documents and Settings\PC\My Documents\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.co.uk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
uWindows: load=?粑? ?
BHO: {00C6482D-C502-44C8-8409-FCE54AD9C208} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {53707962-6F74-2D53-2644-206D7942484F} - No File
BHO: {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} - No File
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: EndNote Web: {82d2e569-25a7-4e4d-9fa3-c5025b4b7912} - c:\program files\endnote web\ENWIEPlug.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - No File
BHO: {90760F64-1931-4AAC-8E2E-AB39AAC071E1} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No File
TB: EndNote Web: {945c8270-a848-11d5-a805-00b0d092f45b} - c:\program files\endnote web\ENWIEPlug.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - e:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [BigDog303] c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html
IE: Add to QQ Customized Emoticons
IE: Add to QQ Customized Panel
IE: Add to QQ Emotions
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Send picture by MMS
IE: Send Picture with QQ MMS
IE: Upload to QQ Network Hard Disk
IE: ìí?óμ?QQ±í?é
IE: ìí?óμ?QQ±í?é
IE: 添加到QQ表情 - c:\program files\tencent\qq\AddEmotion.htm
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - c:\microgaming\poker\ladbrokesmpp\MPPoker.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - e:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F}
Trusted Zone: com.cn\mybank.icbc
Trusted Zone: com.cn\www.icbc
Trusted Zone: shanghaiexpat.com\jobs
DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715}
DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} - hxxps://site.cmbchina.com/download/CMBEdit.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844}
DPF: {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE}
DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476}
DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} - hxxps://mybank.icbc.com.cn/icbc/NetSign.dll
DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://vip.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29}
TCP: {7AE70460-E422-4A20-968E-B73A31413B8E} = 8.8.8.8,8.8.4.4
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\pc\application data\mozilla\firefox\profiles\8o6anw1j.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\pc\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\pc\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\pc\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npaliedit.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Extension: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Extension: EndNote Web: {322e833a-a7d4-4277-97c6-334fa1622d6a} - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\{322e833a-a7d4-4277-97c6-334fa1622d6a}
FF - Extension: Zotero: zotero@chnm.gmu.edu - c:\docume~1\pc\applic~1\mozilla\firefox\profiles\8o6anw1j.default\extensions\zotero@chnm.gmu.edu
============= SERVICES / DRIVERS ===============
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 249424]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 298448]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-3-23 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 67656]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2006-12-21 532224]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-10-11 6104656]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-9-10 265400]
R2 CMBWPS;Cmb WebProtect Support;c:\program files\cmbchina\webprotect\WPService.exe [2008-12-25 232848]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\postgresql\8.3\bin\pg_ctl.exe [2008-9-19 65536]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
S2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\icbcebanktools\icbcantiphishing\IcbcDaemon.exe [2009-10-14 397184]
S3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [2008-4-29 6656]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\drivers\cnxetp.sys --> c:\windows\system32\drivers\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\cnxetu.sys --> c:\windows\system32\drivers\CnxEtU.sys [?]
S3 CnxTgNW;Conexant AccessRunner ADSL WAN PPPoA Adapter Driver;c:\windows\system32\drivers\cnxtgnw.sys --> c:\windows\system32\drivers\CnxTgNW.sys [?]
S3 GKeyUSB;GKeyUSB;c:\windows\system32\drivers\GKeyUSB.sys [2007-9-7 62096]
S3 Irisp2ht;irisp2ht.sys bulk pen driver;c:\windows\system32\drivers\irisp2ht.sys [2009-1-12 16516]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.188\McCHSvc.exe [2010-10-5 237008]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\27.tmp --> c:\windows\system32\27.tmp [?]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 12872]
S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2006-12-24 428160]
=============== File Associations ===============
chm.file="hh.exe" %1
txtfile=c:\windows\notepad.exe %1
=============== Created Last 30 ================
2010-12-04 19:48:22 -------- d-----w- c:\docume~1\pc\applic~1\Malwarebytes
2010-12-04 19:47:53 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-04 19:47:52 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-12-04 19:47:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-04 19:47:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-04 18:01:28 -------- d-sh--w- C:\FOUND.001
2010-12-04 17:47:30 -------- d-sh--w- C:\FOUND.000
2010-12-04 15:53:42 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-12-04 15:50:21 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2010-12-04 15:50:00 -------- d-----w- c:\program files\McAfee Security Scan
2010-12-04 15:31:37 -------- d-----w- c:\docume~1\alluse~1\applic~1\F-Secure
2010-12-04 15:10:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-12-02 14:15:30 -------- d-----w- c:\program files\HandHistory
2010-11-28 22:19:22 -------- d-----w- C:\spoolerlogs
2010-11-28 06:23:37 -------- d-----w- c:\program files\Veetle
2010-11-24 23:51:41 -------- d-----w- c:\docume~1\pc\applic~1\Pyti
2010-11-24 23:51:41 -------- d-----w- c:\docume~1\pc\applic~1\Hohi
2010-11-23 18:30:06 -------- d-----w- c:\program files\iPod
2010-11-23 18:30:02 -------- d-----w- c:\program files\iTunes
2010-11-23 18:30:02 -------- d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-11-23 18:24:33 -------- d-----w- c:\program files\Bonjour
2010-11-23 17:47:42 -------- d-----w- c:\docume~1\pc\applic~1\OpenOffice.org
2010-11-23 17:41:57 -------- d-----w- c:\program files\JRE
2010-11-23 17:41:51 -------- d-----w- c:\program files\OpenOffice.org 3
2010-11-22 03:48:57 -------- d-----w- c:\docume~1\pc\locals~1\applic~1\TruePoker
2010-11-22 03:46:15 -------- d-----w- c:\program files\TruePoker
2010-11-17 04:04:36 -------- d-----w- c:\windows\system32\drivers\AVG
2010-11-07 19:49:03 -------- d-----w- c:\docume~1\pc\applic~1\XPTpoker
==================== Find3M ====================
2010-12-04 15:09:54 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-07 12:23:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-10-07 12:23:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-09-08 11:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 11:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
=================== ROOTKIT ====================
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3802110AS_________________41N3273_LEN rev.3.AAH -> Harddisk0\DR0 -> \Device\0000008e
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A2FCEC5]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8827c872; SUB DWORD [EBP-0x4], 0x8827c12e; PUSH EDI; CALL 0xffffffffffffdf33; }
1 ntkrnlpa!IofCallDriver[0x804EDFEA] -> \Device\Harddisk0\DR0[0x8A45CAB8]
3 CLASSPNP[0xBA8E905B] -> ntkrnlpa!IofCallDriver[0x804EDFEA] -> \Device\00000072[0x8A4BA908]
5 ACPI[0xBA666620] -> ntkrnlpa!IofCallDriver[0x804EDFEA] -> [0x8A45C030]
[0x8A465F38] -> IRP_MJ_CREATE -> 0x8A2FCEC5
error: Read Incorrect function.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\00000071 -> \??\IDE#DiskST3802110AS_________________41N3273_LEN_3.AAH___#2020202020202020202020204C39315243464246#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi -> 0x8a5451f8
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
============= FINISH: 21:21:55.04 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-11-27.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 12/21/2006 9:59:25 AM
System Uptime: 12/4/2010 8:34:25 PM (1 hours ago)
Motherboard: PCCHIPS | | A13G
Processor: AMD Sempron(tm) Processor 3200+ | Socket M2 | 1808/201mhz
==== Disk Partitions =========================
C: is FIXED (FAT32) - 16 GiB total, 2.702 GiB free.
D: is FIXED (FAT32) - 29 GiB total, 1.368 GiB free.
E: is FIXED (FAT32) - 29 GiB total, 2.929 GiB free.
F: is CDROM ()
H: is CDROM ()
J: is Removable
==== Disabled Device Manager Items =============
Class GUID:
Description:
Device ID: ROOT\LEGACY_UDFS\SYSTEM
Manufacturer:
Name:
PNP Device ID: ROOT\LEGACY_UDFS\SYSTEM
Service:
==== System Restore Points ===================
RP1: 12/4/2010 8:24:15 PM - System Checkpoint
==== Installed Programs ======================
?§??±|°2è????t 1,1,0,1
32 Bit HP CIO Components Installer
50 FREE MP3s +1 Free Audiobook!
888poker.net
Adobe Download Manager
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 8.1.4
Adobe Shockwave Player 11.5
Adobe? Photoshop? Album Starter Edition 3.0
Alipay security control 2,4,0,1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AudibleManager
AVG 2011
B109a-m
Bonjour
BufferChm
Chinese Simplified Fonts Support For Adobe Reader 8
Creative Software AutoUpdate
Creative System Information
Creative ZEN
CyberTweak Version 1.3 Final
D1300_Help
Dafa Poker
Destinations
DeviceDiscovery
DoubleRing Pc Camera (Vimicro301 Neptune)
EndNote Web
Everest Poker (Remove Only)
Flickr Uploadr 3.0.5
Free Mp3 Wma Converter V 1.9
FreshDiagnose
GemSafe OEM Edition 5.0 for China
Google Chrome
Google Talk Plugin
GPBaseService2
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
HP Customer Participation Program 14.0
HP Imaging Device Functions 14.0
HP Photosmart B109a-m All-in-One Driver Software 14.0 Rel. 6
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
hph_readme
hph_software_req
HPProductAssistant
HPSSupply
ICBC install (goldpac personal version)
ICBC Token CSP - Goldpac 2007
icbc_netbank_client_controls
InFlac 1.1.1
iTunes
Java Auto Updater
Java(TM) 6 Update 22
LEAD MCMP_MJPEG Codec Eval
Malwarebytes' Anti-Malware
MarketResearch
McAfee Security Scan Plus
Microsoft .NET Framework 2.0
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.3
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MobileMe Control Panel
Mozilla Firefox (3.6.12)
Mozilla Thunderbird (2.0.0.23)
MSVCRT
NVIDIA Drivers
On-line Help Console
OpenOffice.org 3.2
PokerStove version 1.23
PokerTracker 3 (remove only)
PostgreSQL 8.3
PowerDVD
PS_AIO_06_B109a-m_SW_Min
QuickTime
QuickTransfer
RealPlayer
Realtek High Definition Audio Driver
ResearchSoft Direct Export Helper
Scan
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Segoe UI
Shop for HP Supplies
Skype web features
Skype? 4.2
SmartWebPrinting
SnagIt 8
SolutionCenter
Sophos Anti-Rootkit 1.5.4
SOSO AddressBar Search
Spybot - Search & Destroy
Status
Storm Codec
StormPlayer
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
TruePoker (High Res)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
VC 9.0 Runtime
Veetle TV 0.9.18
VJOcx2.0
WebFldrs XP
WebReg
Winamp
Winamp Application Detect
Winamp Toolbar
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
XPTpoker
ZEN Media Explorer
ZENcast Organizer
ZoneAlarm
μTorrent
中国工商银行防钓鱼软件
工行IE浏览器安全插件
招商银行一网通网盾
支付宝插件 1.2.0.2
==== Event Viewer Messages From Past Week ========
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Workstation service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7034] - The HID Input Service service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:46 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/4/2010 8:19:46 PM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Logical Disk Manager service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Error Reporting Service service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 8:19:45 PM, error: Service Control Manager [7031] - The Help and Support service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
12/4/2010 8:19:45 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
12/4/2010 8:19:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the NVIDIA Display Driver Service service to connect.
12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The System Event Notification service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The NVIDIA Display Driver Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The pipe state is invalid.
12/4/2010 8:19:45 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The pipe state is invalid.
12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Cmb WebProtect Support service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 7:42:15 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
12/4/2010 6:07:06 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
11/30/2010 5:55:35 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
11/30/2010 5:54:47 PM, error: Service Control Manager [7034] - The ICBC Daemon Service service terminated unexpectedly. It has done this 1 time(s).
11/30/2010 5:53:10 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
11/30/2010 5:53:10 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
11/30/2010 3:21:29 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'javacpl.cpl' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
11/30/2010 2:58:22 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
11/28/2010 3:22:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/28/2010 3:07:51 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
11/28/2010 12:46:54 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SASDIFSV SASKUTIL Tcpip vsdatant
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the vsdatant service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 12:46:54 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/28/2010 11:59:55 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\mfc40.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 4.1.0.6140.
11/28/2010 10:20:19 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/27/2010 2:32:16 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
==== End Of File ===========================
