Jump to content

ctedholm

Members
  • Posts

    14
  • Joined

  • Last visited

Everything posted by ctedholm

  1. ComboFix 13-05-06.01 - Chandler 05/06/2013 12:20:59.1.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2635 [GMT -4:00] Running from: c:\documents and settings\Chandler\Desktop\ComboFix.exe AV: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} . WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ADS - system32: deleted 142 bytes in 1 streams. . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\All Users\Application Data\TEMP c:\documents and settings\All Users\Application Data\TEMP\A8ADE5D8.TMP c:\documents and settings\All Users\Application Data\TEMP\DFC5A2B2.TMP c:\documents and settings\Chandler\g2mdlhlpx.exe c:\documents and settings\Chandler\WINDOWS C:\install.exe c:\windows\system32\kock c:\windows\system32\SET379.tmp c:\windows\system32\SET37C.tmp c:\windows\system32\SETDCD.tmp c:\windows\system32\SETE06.tmp c:\windows\system32\SETE0B.tmp c:\windows\system32\URTTemp c:\windows\system32\URTTemp\fusion.dll c:\windows\system32\URTTemp\mscoree.dll c:\windows\system32\URTTemp\mscoree.dll.local c:\windows\system32\URTTemp\mscorsn.dll c:\windows\system32\URTTemp\mscorwks.dll c:\windows\system32\URTTemp\msvcr71.dll c:\windows\system32\URTTemp\regtlib.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_.netbt . . ((((((((((((((((((((((((( Files Created from 2013-04-06 to 2013-05-06 ))))))))))))))))))))))))))))))) . . 2013-05-05 23:20 . 2013-05-05 23:20 -------- d-----w- C:\_OTL 2013-05-05 22:20 . 2013-05-05 23:57 15616 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2013-05-05 17:05 . 2013-04-04 09:35 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-04-29 19:13 . 2013-04-29 19:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2013-04-29 17:50 . 2013-04-29 19:23 -------- d-----w- c:\documents and settings\Chandler\Local Settings\Application Data\LogMeIn Rescue Applet 2013-04-26 12:44 . 2013-04-26 12:44 -------- d-----w- c:\documents and settings\Chandler\Application Data\Malwarebytes 2013-04-26 12:43 . 2013-04-26 12:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2013-04-26 12:43 . 2013-04-26 12:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-04-26 12:43 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-04-22 13:48 . 2013-04-22 13:48 26520 ----a-w- c:\program files\Mozilla Firefox\plugin-hang-ui.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-13 13:27 . 2012-04-06 11:33 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-13 13:27 . 2011-05-13 23:52 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-13 13:27 . 2013-03-13 13:27 16486616 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe 2013-03-12 19:58 . 2012-07-28 01:15 861088 ----a-w- c:\windows\system32\npdeployJava1.dll 2013-03-12 19:58 . 2010-05-07 02:42 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-03-08 08:36 . 2004-08-04 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll 2013-03-07 01:32 . 2004-08-04 12:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-07 00:50 . 2004-08-03 22:59 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-02 02:06 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2013-03-02 02:06 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll 2013-03-02 02:06 . 2004-08-04 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl 2013-03-02 01:25 . 2004-08-04 12:00 1867264 ----a-w- c:\windows\system32\win32k.sys 2013-03-02 01:08 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec 2013-02-27 07:56 . 2009-06-27 00:07 2067456 ----a-w- c:\windows\system32\mstscax.dll 2013-02-12 00:32 . 2008-04-13 18:56 12928 ----a-w- c:\windows\system32\drivers\usb8023x.sys 2013-02-12 00:32 . 2004-08-04 12:00 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys 2013-04-22 13:48 . 2013-03-08 05:00 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2012-10-22 04:41 1019976 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2012-10-22 04:41 1019976 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2012-10-22 04:41 1019976 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Chandler\Application Data\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Chandler\Application Data\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Chandler\Application Data\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Chandler\Application Data\Dropbox\bin\DropboxExt.17.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\Steam\Steam.exe" [2013-04-19 1631144] "cdloader"="c:\documents and settings\Chandler\Application Data\mjusbsp\cdloader2.exe" [2012-02-01 50592] "GameShadow"="c:\program files\GameShadow\GameShadow.exe" [2010-08-05 667928] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-28 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-06-28 622592] "SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 77824] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424] "RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288] "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696] "ASUS Update Checker"="c:\program files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe" [2008-12-11 114688] "SES_FE"="c:\storm eagle studios\SES_Form.exe" [2012-11-23 583424] "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-10 421776] "Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-10-22 1065032] "ProfilerU"="c:\program files\SmartTechnology\Software\ProfilerU.exe" [2013-01-31 327680] "SaiMfd"="c:\program files\SmartTechnology\Software\SaiMfd.exe" [2013-01-31 122880] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "TraySantaCruz"="c:\windows\system32\tbctray.exe" [2003-06-23 290816] . c:\documents and settings\Chandler\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Chandler\Application Data\Dropbox\bin\Dropbox.exe [2013-3-12 29106336] OpenOffice.org 3.4.1.lnk - c:\program files\program\quickstart.exe [2012-8-13 1199104] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Button Manager.lnk - c:\program files\HP\Button Manager\BM.exe [2009-7-23 249856] Magic-i.lnk - c:\program files\ArcSoft\Magic-i 3\Magic-i.exe [2009-7-23 530944] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "50000:UDP"= 50000:UDP:IHA_MessageCenter . R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9/3/2009 10:40 AM 368616] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [12/15/2010 12:49 PM 342168] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [12/15/2010 12:49 PM 909728] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [4/1/2013 2:03 PM 55008] R0 TFSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [4/1/2013 2:03 PM 577176] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [9/3/2009 10:41 AM 260760] R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [4/1/2013 1:40 PM 202280] R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [6/11/2012 4:22 PM 193616] R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [12/15/2010 12:49 PM 580728] R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [8/3/2012 5:22 PM 352248] R3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [4/1/2013 1:40 PM 62688] S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7/3/2012 1:19 PM 160944] S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [6/11/2012 4:22 PM 240208] S3 cpuz135;cpuz135;\??\c:\windows\TEMP\cpuz135\cpuz135_x32.sys --> c:\windows\TEMP\cpuz135\cpuz135_x32.sys [?] S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [12/30/2011 7:29 PM 135584] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [9/3/2009 10:40 AM 71752] S3 pctplsm;pctplsm;c:\windows\system32\drivers\pctplsm.sys [4/1/2013 1:40 PM 68272] S3 SaiH0464;SaiH0464;c:\windows\system32\drivers\SaiH0464.sys [5/1/2007 4:37 PM 132232] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [12/15/2010 12:49 PM 403416] S3 tbcspud;Santa Cruz Driver;c:\windows\system32\drivers\tbcspud.sys [6/23/2003 12:15 PM 149632] S3 tbcwdm;Santa Cruz WDM Driver;c:\windows\system32\drivers\tbcwdm.sys [6/23/2003 12:15 PM 554304] S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [4/1/2013 2:03 PM 36456] S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?] . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-11 06:25 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-05-06 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 13:27] . 2013-05-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57] . 2013-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 20:10] . 2013-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 20:10] . . ------- Supplementary Scan ------- . uStart Page = hxxp://msn.com/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM Trusted Zone: aflac.com TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\documents and settings\Chandler\Application Data\Mozilla\Firefox\Profiles\9l33qna1.default\ FF - prefs.js: browser.search.selectedEngine - Search Results FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/ FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=362&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=3941065642054873&o=APN10645&q= FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: !HIDDEN! 2009-10-27 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . - - - - ORPHANS REMOVED - - - - . HKCU-Run-CardScan AutoSync - (no file) HKLM-Run-PCTools FGuard - c:\program files\Spyware Doctor\BDT\FGuard.exe HKLM-Run-DisplaySwitch - c:\documents and settings\All Users\Application Data\DisplaySwitch.exe AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-05-06 12:49 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1409082233-920026266-1060284298-1004\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(4084) c:\windows\system32\WININET.dll c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll c:\documents and settings\Chandler\Application Data\Dropbox\bin\DropboxExt.17.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\nvsvc32.exe c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe c:\program files\Java\jre7\bin\jqs.exe c:\program files\ArcSoft\Magic-i 3\uMgiSvr.exe c:\windows\system32\pctspk.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\wscntfy.exe c:\program files\Brother\ControlCenter3\brccMCtl.exe c:\windows\RTHDCPL.EXE c:\windows\system32\RUNDLL32.EXE c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac c:\program files\program\soffice.exe c:\program files\iPod\bin\iPodService.exe c:\program files\program\soffice.bin . ************************************************************************** . Completion time: 2013-05-06 13:02:35 - machine was rebooted ComboFix-quarantined-files.txt 2013-05-06 17:02 . Pre-Run: 102,665,846,784 bytes free Post-Run: 111,947,448,320 bytes free . - - End Of File - - C89A111438DDB98953E9BC00EC903863
  2. Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.06.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Chandler :: DADSDESKTOP [administrator] 5/6/2013 8:04:12 AM mbar-log-2013-05-06 (08-04-12).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 30668 Time elapsed: 43 minute(s), 44 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot. Registry Values Detected: 1 HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD|CDBurn (Hijack.Trojan.Siredef.C) -> Data: {fbeb8a05-beee-4442-804e-409d6c4515e9} -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 6 c:\windows\$ntuninstallkb16146$\2154086262 (Backdoor.0Access) -> Delete on reboot. c:\windows\$ntuninstallkb16146$\2154086262\l (Backdoor.0Access) -> Delete on reboot. c:\windows\$ntuninstallkb16146$\2154086262\u (Backdoor.0Access) -> Delete on reboot. c:\windows\$ntuninstallkb16146$\2348843808 (Backdoor.0Access) -> Delete on reboot. c:\RECYCLER\S-1-5-18\$e8564fd87fd24d195cad3d6620221643 (Trojan.Siredef.C) -> Delete on reboot. c:\RECYCLER\S-1-5-21-1409082233-920026266-1060284298-1004\$e8564fd87fd24d195cad3d6620221643 (Trojan.Siredef.C) -> Delete on reboot. Files Detected: 0 Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.06.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Chandler :: DADSDESKTOP [administrator] 5/6/2013 9:16:05 AM mbar-log-2013-05-06 (09-16-05).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 30616 Time elapsed: 48 minute(s), 59 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 Java version: 1.6.0_38 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 2.712000 GHz Memory total: 3220402176, free: 2164887552 --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 Java version: 1.6.0_38 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 2.712000 GHz Memory total: 3220402176, free: 2185445376 ------------ Kernel report ------------ 05/06/2013 07:19:56 ------------ Loaded modules ----------- \windows\system32\ntkrnlpa.exe \windows\system32\hal.dll \windows\system32\KDCOM.DLL \windows\system32\BOOTVID.dll fltmgr.sys ACPI.sys \windows\system32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys pciide.sys \windows\system32\DRIVERS\PCIIDEX.SYS viaide.sys MountMgr.sys ftdisk.sys PartMgr.sys sfsync02.sys VolSnap.sys atapi.sys nvgts.sys \windows\system32\DRIVERS\SCSIPORT.SYS disk.sys \windows\system32\DRIVERS\CLASSPNP.SYS sr.sys PCTCore.sys pctDS.sys pctEFA.sys TfFsMon.sys TfSysMon.sys KSecDD.sys Ntfs.sys NDIS.sys vvoice.sys vpctcom.sys vmodem.sys viaagp.sys sfhlp02.sys sfdrv01.sys Mup.sys \SystemRoot\system32\DRIVERS\AmdPPM.sys \SystemRoot\system32\DRIVERS\ASACPI.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\serial.sys \SystemRoot\system32\DRIVERS\serenum.sys \SystemRoot\system32\DRIVERS\usbohci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\drivers\Afc.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\redbook.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\DRIVERS\nvnetbus.sys \SystemRoot\system32\DRIVERS\NVNRM.SYS \SystemRoot\system32\DRIVERS\nv4_mini.sys \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS \SystemRoot\system32\DRIVERS\ArcSoftVirtualCapture.sys \SystemRoot\system32\DRIVERS\STREAM.SYS \SystemRoot\system32\DRIVERS\serscan.sys \SystemRoot\system32\DRIVERS\audstub.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\psched.sys \SystemRoot\system32\DRIVERS\msgpc.sys \SystemRoot\system32\DRIVERS\ptilink.sys \SystemRoot\system32\DRIVERS\raspti.sys \SystemRoot\system32\drivers\SaiBus.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\update.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\DRIVERS\SaiMini.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\NVENETFD.sys \SystemRoot\system32\drivers\RtkHDAud.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\ipsec.sys \SystemRoot\system32\DRIVERS\tcpip.sys \??\C:\WINDOWS\system32\drivers\pctgntdi.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\netbt.sys \SystemRoot\System32\drivers\ws2ifsl.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\System32\Drivers\PCTSD.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\system32\drivers\AsIO.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\usbprint.sys \SystemRoot\system32\DRIVERS\BrScnUsb.sys \SystemRoot\System32\Drivers\BrUsbSer.sys \SystemRoot\System32\Drivers\BrSerIf.sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\System32\Drivers\dump_atapi.sys \SystemRoot\System32\Drivers\dump_WMILIB.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\nv4_disp.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\system32\DRIVERS\mrxdav.sys \SystemRoot\system32\DRIVERS\srv.sys \??\C:\WINDOWS\system32\drivers\pctplsg.sys \??\C:\WINDOWS\system32\drivers\pctplsm.sys \SystemRoot\System32\Drivers\HTTP.sys \SystemRoot\System32\Drivers\PCTBD.sys \??\C:\windows\system32\drivers\TfNetMon.sys \SystemRoot\system32\drivers\kmixer.sys \??\C:\windows\system32\drivers\mbamchameleon.sys \??\C:\windows\system32\drivers\mbamswissarmy.sys \WINDOWS\system32\ntdll.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR2 Upper Device Object: 0xffffffff89ce6030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000081\ Lower Device Object: 0xffffffff8a77b7e0 Lower Device Driver Name: \Driver\usbstor\ Driver name found: usbstor Initialization returned 0x0 Load Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8b66a030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\ Lower Device Object: 0xffffffff8b645d98 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Load Function returned 0x0 Downloaded database version: v2013.05.06.04 Downloaded database version: v2013.05.01.01 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8b66a030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8b624830, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff8b66a030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8b6d52d8, DeviceName: Unknown, DriverName: \Driver\PCTCore\ DevicePointer: 0xffffffff8b629f18, DeviceName: \Device\0000006e\, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8b645d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xffffffffe1238aa0, 0xffffffff8b66a030, 0xffffffff87b27ab8 Lower DeviceData: 0xffffffffe6751818, 0xffffffff8b645d98, 0xffffffff87f06c98 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\windows\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 2AD21C Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 625137282 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 320072933376 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xffffffff89ce6030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8a2ca748, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff89ce6030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8a055790, DeviceName: Unknown, DriverName: \Driver\PCTCore\ DevicePointer: 0xffffffff8a77b7e0, DeviceName: \Device\00000081\, DriverName: \Driver\usbstor\ ------------ End ---------- Done! Performing system, memory and registry scan... Read File: File "c:\WINDOWS\$NtUninstallKB950762_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB950974$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB951066_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB951376-v2$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB951978$\updatebr.inf" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB952287_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB952954$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB954600_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB955069_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB956802_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB956803$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB956844_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB957097_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB958644_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB958687_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB960225$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB960803_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB961501_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB967715_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB968537_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB971557$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB971633_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB971657$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973354_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973507_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973815_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973869_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB946648$\update.ver" is compressed (flags = 1) Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C] Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD|CDBurn --> [Hijack.Trojan.Siredef.C] Infected: c:\windows\$ntuninstallkb16146$\2154086262 --> [backdoor.0Access] Infected: c:\windows\$ntuninstallkb16146$\2154086262\l --> [backdoor.0Access] Infected: c:\windows\$ntuninstallkb16146$\2154086262\u --> [backdoor.0Access] Infected: c:\windows\$ntuninstallkb16146$\2348843808 --> [backdoor.0Access] Infected: c:\RECYCLER\S-1-5-18\$e8564fd87fd24d195cad3d6620221643 --> [Trojan.Siredef.C] Infected: c:\RECYCLER\S-1-5-21-1409082233-920026266-1060284298-1004\$e8564fd87fd24d195cad3d6620221643 --> [Trojan.Siredef.C] Done! Scan finished Creating System Restore point... Scheduling clean up... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Executing an action fixdamage.exe... Success! Removal successful. No system shutdown is required. ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 Java version: 1.6.0_38 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 2.712000 GHz Memory total: 3220402176, free: 2351595520 ------------ Kernel report ------------ 05/06/2013 08:25:48 ------------ Loaded modules ----------- \windows\system32\ntkrnlpa.exe \windows\system32\hal.dll \windows\system32\KDCOM.DLL \windows\system32\BOOTVID.dll fltmgr.sys ACPI.sys \windows\system32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys pciide.sys \windows\system32\DRIVERS\PCIIDEX.SYS viaide.sys MountMgr.sys ftdisk.sys PartMgr.sys sfsync02.sys VolSnap.sys atapi.sys nvgts.sys \windows\system32\DRIVERS\SCSIPORT.SYS disk.sys \windows\system32\DRIVERS\CLASSPNP.SYS sr.sys PCTCore.sys pctDS.sys pctEFA.sys TfFsMon.sys TfSysMon.sys KSecDD.sys Ntfs.sys NDIS.sys vvoice.sys vpctcom.sys vmodem.sys viaagp.sys sfhlp02.sys sfdrv01.sys Mup.sys \SystemRoot\system32\DRIVERS\AmdPPM.sys \SystemRoot\system32\DRIVERS\ASACPI.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\serial.sys \SystemRoot\system32\DRIVERS\serenum.sys \SystemRoot\system32\DRIVERS\usbohci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\drivers\Afc.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\redbook.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\DRIVERS\nvnetbus.sys \SystemRoot\system32\DRIVERS\NVNRM.SYS \SystemRoot\system32\DRIVERS\nv4_mini.sys \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS \SystemRoot\system32\DRIVERS\ArcSoftVirtualCapture.sys \SystemRoot\system32\DRIVERS\STREAM.SYS \SystemRoot\system32\DRIVERS\serscan.sys \SystemRoot\system32\DRIVERS\audstub.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\psched.sys \SystemRoot\system32\DRIVERS\msgpc.sys \SystemRoot\system32\DRIVERS\ptilink.sys \SystemRoot\system32\DRIVERS\raspti.sys \SystemRoot\system32\drivers\SaiBus.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\update.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\DRIVERS\SaiMini.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\NVENETFD.sys \SystemRoot\system32\drivers\RtkHDAud.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\ipsec.sys \SystemRoot\system32\DRIVERS\tcpip.sys \SystemRoot\system32\DRIVERS\ipnat.sys \??\C:\WINDOWS\system32\drivers\pctgntdi.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\netbt.sys \SystemRoot\System32\drivers\ws2ifsl.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\System32\Drivers\PCTSD.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\system32\drivers\AsIO.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\usbprint.sys \SystemRoot\system32\DRIVERS\BrScnUsb.sys \SystemRoot\System32\Drivers\BrUsbSer.sys \SystemRoot\System32\Drivers\BrSerIf.sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\System32\Drivers\dump_atapi.sys \SystemRoot\System32\Drivers\dump_WMILIB.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\nv4_disp.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\system32\DRIVERS\mrxdav.sys \SystemRoot\system32\DRIVERS\srv.sys \??\C:\WINDOWS\system32\drivers\pctplsg.sys \??\C:\WINDOWS\system32\drivers\pctplsm.sys \SystemRoot\System32\Drivers\HTTP.sys \SystemRoot\System32\Drivers\PCTBD.sys \??\C:\windows\system32\drivers\TfNetMon.sys \SystemRoot\system32\drivers\kmixer.sys \??\C:\windows\system32\drivers\mbamchameleon.sys \??\C:\windows\system32\drivers\mbamswissarmy.sys \WINDOWS\system32\ntdll.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR2 Upper Device Object: 0xffffffff89cc6668 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000081\ Lower Device Object: 0xffffffff8b2fbea0 Lower Device Driver Name: \Driver\usbstor\ Driver name found: usbstor Initialization returned 0x0 Load Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8b617030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\ Lower Device Object: 0xffffffff8b668d98 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Load Function returned 0x0 Downloaded database version: v2013.05.06.05 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8b617030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8b617b70, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff8b617030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8b694d38, DeviceName: Unknown, DriverName: \Driver\PCTCore\ DevicePointer: 0xffffffff8b6191c0, DeviceName: \Device\0000006e\, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8b668d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xffffffffe128c250, 0xffffffff8b617030, 0xffffffff88afcab8 Lower DeviceData: 0xffffffffe172df00, 0xffffffff8b668d98, 0xffffffff88b09a40 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\windows\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 2AD21C Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 625137282 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 320072933376 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xffffffff89cc6668, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff89f9e7d0, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff89cc6668, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8a05b790, DeviceName: Unknown, DriverName: \Driver\PCTCore\ DevicePointer: 0xffffffff8b2fbea0, DeviceName: \Device\00000081\, DriverName: \Driver\usbstor\ ------------ End ---------- Done! Performing system, memory and registry scan... Read File: File "c:\WINDOWS\$NtUninstallKB950762_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB950974$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB951066_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB951376-v2$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB951978$\updatebr.inf" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB952287_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB952954$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB954600_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB955069_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB956802_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB956803$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB956844_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB957097_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB958644_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB958687_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB960225$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB960803_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB961501_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB967715_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB968537_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB971557$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB971633_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB971657$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973354_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973507_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973815_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB973869_0$\update.ver" is compressed (flags = 1) Read File: File "c:\WINDOWS\$NtUninstallKB946648$\update.ver" is compressed (flags = 1) Done! Scan finished =======================================
  3. My mistake, it does become unresponsive after a period of time.
  4. RK finds two registry objects. If I just hit Delete after Scan with both Registry objects checked, nothing happens, although RK does not become unresponsive.
  5. RK is either very fragile or something is messing with it. As soon as I try to uncheck the non-bad object found under Registry (or do much of anything else) it becomes unresponsive and does not allow the deletion of the SUSP PATH.
  6. RogueKiller V8.5.4 [Mar 18 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version Started in : Normal mode User : Chandler [Admin rights] Mode : Scan -- Date : 05/05/2013 18:57:00 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 2 ¤¤¤ [RUN][sUSP PATH] HKLM\[...]\Run : DisplaySwitch ("C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe") [x] -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FOLDER] $NtUninstallKB16146$ : C:\windows\$NtUninstallKB16146$ --> FOUND ¤¤¤ Driver : [LOADED] ¤¤¤ SSDT[41] : NtCreateKey @ 0x8062423A -> HOOKED (TfSysMon.sys @ 0xB7C96AC0) SSDT[63] : NtDeleteKey @ 0x806246D6 -> HOOKED (TfSysMon.sys @ 0xB7C96D30) SSDT[65] : NtDeleteValueKey @ 0x806248A6 -> HOOKED (TfSysMon.sys @ 0xB7C96DF0) SSDT[119] : NtOpenKey @ 0x80625618 -> HOOKED (TfSysMon.sys @ 0xB7C96960) SSDT[247] : NtSetValueKey @ 0x806227AC -> HOOKED (TfSysMon.sys @ 0xB7C96FF0) SSDT[257] : NtTerminateProcess @ 0x805D22D8 -> HOOKED (TfSysMon.sys @ 0xB7C98DC0) IRP[iRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] sfsync02.sys @ 0xB8338D60) ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: +++++ --- User --- [MBR] e4d9088a73b6ca864ec406730b65ec8d [bSP] e8d3345e88d1f34c7f01f4793eb9302e : Windows XP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_05052013_02d1857.txt >> RKreport[1]_S_05052013_02d1857.txt
  7. Ran full scan, found three Trojans. I don't know if they are related to the previous problem. Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.05.05.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Chandler :: DADSDESKTOP [administrator] 5/5/2013 9:32:44 AM mbam-log-2013-05-05 (09-32-44).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 547117 Time elapsed: 3 hour(s), 6 minute(s), 39 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 2 HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32| (Trojan.0Access) -> Bad: (C:\RECYCLER\S-1-5-18\$e8564fd87fd24d195cad3d6620221643\n.) Good: (fastprox.dll) -> Quarantined and repaired successfully. HKCR\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InProcServer32| (Trojan.0Access) -> Bad: (C:\RECYCLER\S-1-5-21-1409082233-920026266-1060284298-1004\$e8564fd87fd24d195cad3d6620221643\n.) Good: (shell32.dll) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\_OTL\MovedFiles\05052013_192008\C_Documents and Settings\All Users\Application Data\DisplaySwitch.exe (Trojan.FakeMS) -> Quarantined and deleted successfully. (end)
  8. ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DisplaySwitch deleted successfully. C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe moved successfully. File C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe not found. C:\windows\tasks\vfbxrjfrel.job moved successfully. C:\Documents and Settings\All Users\Application Data\1.bmp moved successfully. C:\Documents and Settings\All Users\Application Data\1.jpg moved successfully. OTLPE by OldTimer - Version 3.1.48.0 log created on 05052013_192008 Seems to have worked. Running full scan now.
  9. I had a hard time getting REATOGO to recognize my flash drive; now for some reason it has stopped recognizing my USB mouse, so I am unable to do anything. Any ideas?
  10. OTL logfile created on: 5/4/2013 6:55:43 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): c:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 298.09 Gb Total Space | 93.11 Gb Free Space | 31.23% Space Free | Partition Type: NTFS Drive E: | 0.27 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive F: | 1.91 Gb Total Space | 1.66 Gb Free Space | 87.16% Space Free | Partition Type: FAT32 Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet006 ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2013/04/22 09:48:38 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013/03/13 09:27:14 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013/03/12 15:58:50 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2012/11/01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) [Auto] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService) SRV - [2012/10/31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) [Auto] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService) SRV - [2012/10/31 09:19:48 | 000,072,824 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\TFEngine\TFService.exe -- (ThreatFire) SRV - [2012/10/23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service) SRV - [2012/10/22 00:41:22 | 004,653,128 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) [Auto] -- C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe -- (CarboniteService) SRV - [2012/08/03 17:22:18 | 000,352,248 | ---- | M] (Verizon) [Auto] -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe -- (IHA_MessageCenter) SRV - [2012/07/03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate) SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc) SRV - [2011/12/09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand] -- C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service) SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2006/11/13 14:02:08 | 000,076,544 | ---- | M] (ArcSoft, Inc.) [Auto] -- C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe -- (MgiSvr) SRV - [2001/08/17 18:36:54 | 000,086,016 | ---- | M] (PCtel, Inc.) [Auto] -- C:\WINDOWS\system32\pctspk.exe -- (Pctspk) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | On_Demand] -- -- (cpuz135) DRV - File not found [Kernel | System] -- -- (Changer) DRV - File not found [Kernel | On_Demand] -- -- (.netbt) DRV - [2013/05/03 18:19:09 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2013/05/03 18:16:01 | 000,035,144 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\system32\drivers\mbamchameleon.sys -- (mbamchameleon) DRV - [2013/02/01 09:45:44 | 000,046,624 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiBus.sys -- (SaiNtBus) DRV - [2013/02/01 09:45:44 | 000,023,200 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiMini.sys -- (SaiMini) DRV - [2012/11/01 15:35:20 | 000,068,272 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pctplsm.sys -- (pctplsm) DRV - [2012/11/01 15:35:18 | 000,071,752 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pctplsg.sys -- (pctplsg) DRV - [2012/11/01 15:35:14 | 000,202,280 | ---- | M] (PC Tools) [Kernel | System] -- C:\WINDOWS\system32\drivers\PCTSD.sys -- (PCTSD) DRV - [2012/10/31 14:21:28 | 000,260,760 | ---- | M] (PC Tools) [Kernel | System] -- C:\WINDOWS\system32\drivers\pctgntdi.sys -- (pctgntdi) DRV - [2012/10/31 09:19:50 | 000,577,176 | --S- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\TfSysMon.sys -- (TFSysMon) DRV - [2012/10/31 09:19:48 | 000,055,008 | --S- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\TfFsMon.sys -- (TfFsMon) DRV - [2012/10/31 09:19:48 | 000,036,456 | --S- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\TfNetMon.sys -- (TfNetMon) DRV - [2012/10/23 17:40:32 | 000,062,688 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PCTBD.sys -- (PCTBD) DRV - [2012/10/22 16:38:28 | 000,368,616 | ---- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore) DRV - [2012/02/28 11:43:06 | 000,909,728 | ---- | M] (PC Tools) [File_System | Boot] -- C:\WINDOWS\system32\drivers\pctEFA.sys -- (pctEFA) DRV - [2012/02/28 11:43:00 | 000,342,168 | ---- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\pctDS.sys -- (pctDS) DRV - [2008/11/25 04:37:50 | 004,952,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008/08/18 06:54:24 | 000,145,952 | R--- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts) DRV - [2008/07/31 23:36:26 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2008/07/31 23:36:20 | 000,054,784 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2007/12/17 05:14:06 | 000,012,400 | R--- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO) DRV - [2007/07/02 15:08:08 | 000,015,616 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ArcSoftVirtualCapture.sys -- (ARCSOFTVIRTUALCAPTURE) DRV - [2007/05/01 16:37:40 | 000,132,232 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiH0464.sys -- (SaiH0464) DRV - [2007/04/16 16:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc) DRV - [2005/03/03 13:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x) DRV - [2005/02/23 11:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x) DRV - [2004/12/03 06:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x) DRV - [2004/08/14 14:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2004/08/03 18:31:20 | 000,036,224 | ---- | M] (ADMtek Incorporated.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\an983.sys -- (AN983) DRV - [2003/06/23 12:15:14 | 000,554,304 | ---- | M] (Voyetra Turtle Beach) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tbcwdm.sys -- (tbcwdm) DRV - [2003/06/23 12:15:10 | 000,149,632 | ---- | M] (Voyetra Turtle Beach) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tbcspud.sys -- (tbcspud) DRV - [2001/08/17 09:28:16 | 000,397,502 | ---- | M] (PCtel, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\vpctcom.sys -- (Vpctcom) DRV - [2001/08/17 09:28:16 | 000,064,605 | ---- | M] (PCtel, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\vvoice.sys -- (Vvoice) DRV - [2001/08/17 09:28:14 | 000,604,253 | ---- | M] (PCTEL, INC.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\vmodem.sys -- (Vmodem) DRV - [2001/08/17 09:28:14 | 000,112,574 | ---- | M] (PCTEL, INC.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ptserlp.sys -- (Ptserlp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Chandler_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/ IE - HKU\Chandler_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKU\Chandler_ON_C\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) IE - HKU\Chandler_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Chandler_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npdeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Chandler\Application Data\Move Networks\plugins\npqmp071503000010.dll (Move Networks) FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\Spyware Doctor\BDT\Firefox\ [2013/04/01 13:41:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/22 09:48:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/03/12 16:21:08 | 000,000,000 | ---D | M] [2013/04/29 15:13:30 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions [2013/03/22 22:52:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2013/03/08 01:00:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013/03/08 01:00:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} File not found (No name found) -- [2013/04/22 09:48:40 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012/09/01 12:55:55 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2013/03/22 22:52:28 | 000,002,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml [2013/02/19 20:06:09 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml Hosts file not found O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {377e5d4d-77e5-476a-8716-7e70a9272da0} - File not found O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.) O3 - HKU\Chandler_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O4 - HKLM..\Run: [Alcmtr] C:\windows\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [ASUS Update Checker] C:\Program Files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe () O4 - HKLM..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe (Carbonite, Inc.) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [DisplaySwitch] C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe (Hilgraeve, Inc.) O4 - HKLM..\Run: [iSTray] C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools) O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe () O4 - HKLM..\Run: [PCTools FGuard] File not found O4 - HKLM..\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe (Saitek) O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) O4 - HKLM..\Run: [saiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Saitek) O4 - HKLM..\Run: [sES_FE] C:\Storm Eagle Studios\SES_Form.exe (Storm Eagle Studios) O4 - HKLM..\Run: [setDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.) O4 - HKLM..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe (Voyetra Turtle Beach, Inc.) O4 - HKU\Chandler_ON_C..\Run: [CardScan AutoSync] File not found O4 - HKU\Chandler_ON_C..\Run: [GameShadow] C:\Program Files\GameShadow\GameShadow.exe (GameShadow Ltd) O4 - HKU\Chandler_ON_C..\Run: [steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Button Manager.lnk = C:\Program Files\HP\Button Manager\BM.exe () O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Magic-i.lnk = C:\Program Files\ArcSoft\Magic-i 3\Magic-i.exe (ArcSoft, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\Chandler\Start Menu\Programs\Startup\Dropbox.lnk = File not found O4 - Startup: C:\Documents and Settings\Chandler\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Chandler_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software) O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software) O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab (Windows Live Safety Center Base Module) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1246109643615 (MUWebControl Class) O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager) O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine) O16 - DPF: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab (Java Plug-in 1.6.0_38) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab (Java Plug-in 1.6.0_38) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\mgrldr.dll) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/26 20:13:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2011/02/22 04:21:56 | 000,042,400 | R--- | M] (magicJack L.P.) - E:\autorun.exe -- [ CDFS ] O32 - AutoRun File - [2011/02/22 04:21:56 | 000,016,158 | R--- | M] () - E:\autorun.ico -- [ CDFS ] O32 - AutoRun File - [2011/02/22 04:21:56 | 000,000,308 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\autorun.exe O33 - MountPoints2\D\Shell\phone\command - "" = D:\autorun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\SH4Autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: Sharedaccess - File not found NetSvcs: WmdmPmSp - File not found Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\windows\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.iv31 - C:\windows\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\windows\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\windows\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\windows\System32\ir50_32.dll (Intel Corporation) ========== Files/Folders - Created Within 30 Days ========== [2013/05/03 10:52:44 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys [2013/05/03 10:13:03 | 000,118,272 | ---- | C] (Hilgraeve, Inc.) -- C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe [2013/04/29 15:13:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla [2013/04/29 15:13:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla [2013/04/29 13:50:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chandler\Local Settings\Application Data\LogMeIn Rescue Applet [2013/04/26 08:44:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chandler\Application Data\Malwarebytes [2013/04/26 08:43:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware [2013/04/26 08:43:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2013/04/26 08:43:41 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2013/04/26 08:43:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013/04/15 11:34:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chandler\My Documents\personality_profile [9 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [6 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/05/03 18:19:09 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys [2013/05/03 18:18:34 | 000,000,882 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2013/05/03 18:18:30 | 000,000,312 | -HS- | M] () -- C:\windows\tasks\vfbxrjfrel.job [2013/05/03 18:18:29 | 000,001,374 | ---- | M] () -- C:\windows\System32\wpa.dbl [2013/05/03 18:18:25 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat [2013/05/03 18:18:09 | 001,131,455 | ---- | M] () -- C:\windows\System32\drivers\Cat.DB [2013/05/03 18:16:01 | 000,035,144 | ---- | M] () -- C:\windows\System32\drivers\mbamchameleon.sys [2013/05/03 17:28:04 | 000,000,886 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2013/05/03 17:27:44 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013/05/03 17:12:42 | 1610,612,736 | ---- | M] () -- C:\windows\MEMORY.DMP [2013/05/03 14:33:44 | 000,001,023 | ---- | M] () -- C:\Documents and Settings\Chandler\Desktop\magicJack.lnk [2013/05/03 10:23:36 | 002,250,054 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1.bmp [2013/05/03 10:23:22 | 000,350,795 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1.jpg [2013/05/03 10:12:54 | 000,118,272 | ---- | M] (Hilgraeve, Inc.) -- C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe [2013/05/02 09:36:11 | 000,000,441 | ---- | M] () -- C:\Documents and Settings\Chandler\Desktop\xntimer.ini [2013/05/02 08:21:38 | 000,002,479 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk [2013/05/02 08:08:44 | 000,002,465 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk [2013/05/01 18:26:03 | 000,000,284 | ---- | M] () -- C:\windows\tasks\AppleSoftwareUpdate.job [2013/04/30 17:17:35 | 000,002,503 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Outlook.lnk [2013/04/29 18:39:14 | 000,002,477 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk [2013/04/26 08:43:44 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk [2013/04/26 08:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware [2013/04/13 13:59:26 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup [2013/04/12 12:49:46 | 000,716,659 | ---- | M] () -- C:\Documents and Settings\Chandler\Desktop\SDwA_history_20130412.htm [2013/04/11 08:19:17 | 000,161,936 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2013/04/11 03:06:25 | 000,001,374 | ---- | M] () -- C:\windows\imsins.BAK [2013/04/11 02:25:44 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk [2013/04/08 11:59:17 | 012,975,104 | ---- | M] () -- C:\Documents and Settings\Chandler\My Documents\Contacts.cdb [9 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [6 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/05/03 18:16:01 | 000,035,144 | ---- | C] () -- C:\windows\System32\drivers\mbamchameleon.sys [2013/05/03 10:23:36 | 002,250,054 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.bmp [2013/05/03 10:23:09 | 000,350,795 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.jpg [2013/04/26 08:43:44 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk [2013/04/12 12:49:43 | 000,716,659 | ---- | C] () -- C:\Documents and Settings\Chandler\Desktop\SDwA_history_20130412.htm [2013/02/28 21:03:42 | 000,086,760 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat [2012/10/14 12:32:52 | 000,000,852 | ---- | C] () -- C:\windows\MEDIAPAQ.INI [2012/10/13 19:56:31 | 000,000,666 | ---- | C] () -- C:\windows\eReg.dat [2012/08/13 10:57:00 | 000,012,927 | ---- | C] () -- C:\Program Files\readme.html [2012/05/22 13:42:37 | 000,244,206 | ---- | C] () -- C:\Documents and Settings\Chandler\Application Data\fontlst2.opf [2012/05/08 14:15:36 | 000,000,005 | ---- | C] () -- C:\Program Files\basis-link [2012/03/13 14:27:02 | 000,000,385 | ---- | C] () -- C:\Documents and Settings\Chandler\Application Data\com.aflac.launchpad.desktop_state.xml [2012/02/15 09:52:36 | 000,003,072 | ---- | C] () -- C:\windows\System32\iacenc.dll [2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\windows\System32\xlive.dll.cat [2010/12/15 12:49:40 | 000,769,144 | ---- | C] () -- C:\windows\BDTSupport.dll [2010/12/15 12:49:40 | 000,767,952 | ---- | C] () -- C:\windows\BDTSupport.dll0454.old [2010/10/01 13:53:29 | 000,011,832 | ---- | C] () -- C:\windows\System32\drivers\AsInsHelp64.sys [2010/10/01 13:53:29 | 000,010,216 | ---- | C] () -- C:\windows\System32\drivers\AsInsHelp32.sys [2010/10/01 13:51:31 | 000,024,576 | R--- | C] () -- C:\windows\System32\AsIO.dll [2010/10/01 13:51:31 | 000,012,400 | R--- | C] () -- C:\windows\System32\drivers\AsIO.sys [2010/09/02 20:50:07 | 000,000,272 | ---- | C] () -- C:\windows\_delis32.ini [2010/08/13 16:23:16 | 000,232,968 | ---- | C] () -- C:\windows\System32\nvdrsdb0.bin [2010/08/13 16:23:06 | 000,232,968 | ---- | C] () -- C:\windows\System32\nvdrsdb1.bin [2010/08/13 16:23:06 | 000,000,001 | ---- | C] () -- C:\windows\System32\nvdrssel.bin [2010/08/13 15:56:52 | 000,000,000 | ---- | C] () -- C:\windows\nsreg.dat [2010/07/21 11:01:45 | 000,000,256 | ---- | C] () -- C:\windows\System32\pool.bin [2010/04/25 15:01:17 | 000,069,632 | R--- | C] () -- C:\windows\System32\xmltok.dll [2010/04/25 15:01:17 | 000,036,864 | R--- | C] () -- C:\windows\System32\xmlparse.dll [2010/03/31 13:58:23 | 000,000,165 | ---- | C] () -- C:\windows\QUICKEN.INI [2010/01/11 14:24:07 | 000,060,304 | ---- | C] () -- C:\Documents and Settings\Chandler\g2mdlhlpx.exe [2009/12/13 14:09:52 | 000,000,023 | ---- | C] () -- C:\windows\kodakpcd.Chandler.ini [2009/12/03 14:16:37 | 000,763,832 | ---- | C] () -- C:\windows\BDTSupport.dll.old [2009/10/26 09:56:33 | 000,176,235 | ---- | C] () -- C:\windows\System32\Primomonnt.dll [2009/10/07 03:10:47 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\Chandler\Local Settings\Application Data\fusioncache.dat [2009/10/04 20:26:57 | 000,000,000 | ---- | C] () -- C:\windows\PowerReg.dat [2009/10/04 20:26:26 | 000,185,344 | ---- | C] () -- C:\windows\patchw32.dll [2009/10/04 19:04:32 | 000,000,403 | ---- | C] () -- C:\windows\SIERRA.INI [2009/10/03 19:05:26 | 000,004,984 | R--- | C] () -- C:\windows\System32\drivers\nvphy.bin [2009/10/03 18:34:05 | 000,028,194 | ---- | C] () -- C:\windows\Ascd_log.ini [2009/10/03 18:12:21 | 000,001,746 | ---- | C] () -- C:\windows\Language_trs.ini [2009/10/03 18:11:27 | 000,005,810 | R--- | C] () -- C:\windows\System32\drivers\ASACPI.sys [2009/10/03 18:11:04 | 000,023,629 | ---- | C] () -- C:\windows\Ascd_tmp.ini [2009/10/03 18:11:03 | 000,010,296 | ---- | C] () -- C:\windows\System32\drivers\ASUSHWIO.SYS [2009/09/15 21:33:26 | 000,018,790 | ---- | C] () -- C:\windows\System32\ddmon.dll [2009/09/09 22:46:12 | 000,028,076 | -H-- | C] () -- C:\windows\System32\mlfcache.dat [2009/07/30 21:58:42 | 000,000,314 | ---- | C] () -- C:\windows\primopdf.ini [2009/07/23 16:36:17 | 000,000,056 | -H-- | C] () -- C:\windows\System32\ezsidmv.dat [2009/07/12 15:16:11 | 000,093,696 | ---- | C] () -- C:\Documents and Settings\Chandler\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/06/27 19:32:44 | 000,043,520 | ---- | C] () -- C:\windows\System32\CmdLineExt03.dll [2009/06/27 16:13:12 | 000,001,032 | ---- | C] () -- C:\windows\Brpfx04a.ini [2009/06/27 16:13:12 | 000,000,154 | ---- | C] () -- C:\windows\brpcfx.ini [2009/06/27 16:13:12 | 000,000,050 | ---- | C] () -- C:\windows\System32\bridf06a.dat [2009/06/27 16:12:20 | 000,000,419 | ---- | C] () -- C:\windows\BRWMARK.INI [2009/06/27 16:12:20 | 000,000,027 | ---- | C] () -- C:\windows\BRPP2KA.INI [2009/06/27 16:10:58 | 000,106,496 | ---- | C] () -- C:\windows\System32\BrMuSNMP.dll [2009/06/27 16:10:58 | 000,000,000 | ---- | C] () -- C:\windows\brdfxspd.dat [2009/06/27 09:30:12 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI [2009/06/26 20:27:45 | 000,000,664 | ---- | C] () -- C:\windows\System32\d3d9caps.dat [2009/06/26 20:27:43 | 000,000,552 | ---- | C] () -- C:\windows\System32\d3d8caps.dat [2009/06/26 20:16:20 | 000,002,048 | --S- | C] () -- C:\windows\bootstat.dat [2009/06/26 20:09:42 | 000,022,720 | ---- | C] () -- C:\windows\System32\emptyregdb.dat [2009/06/26 15:57:07 | 000,001,536 | ---- | C] () -- C:\windows\System32\TrueSoft.dat [2009/06/26 15:57:03 | 000,000,456 | ---- | C] () -- C:\windows\System32\pthsp.dat [2009/06/26 15:55:41 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI [2009/06/26 15:52:39 | 000,161,936 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT [2009/06/10 06:03:00 | 002,195,030 | ---- | C] () -- C:\windows\System32\nvdata.bin [2007/05/01 16:37:40 | 001,970,176 | ---- | C] () -- C:\windows\System32\SaiC0464.Dll [2007/05/01 16:37:40 | 000,008,704 | ---- | C] () -- C:\windows\System32\SaiC0464_0C.dll [2007/05/01 16:37:40 | 000,008,192 | ---- | C] () -- C:\windows\System32\SaiC0464_10.dll [2007/05/01 16:37:40 | 000,008,192 | ---- | C] () -- C:\windows\System32\SaiC0464_0A.dll [2007/05/01 16:37:40 | 000,008,192 | ---- | C] () -- C:\windows\System32\SaiC0464_07.dll [2007/05/01 16:37:40 | 000,007,680 | ---- | C] () -- C:\windows\System32\SaiC0464_09.dll [2007/05/01 16:37:40 | 000,007,168 | ---- | C] () -- C:\windows\System32\SaiC0464_0402.dll [2007/05/01 16:37:40 | 000,005,632 | ---- | C] () -- C:\windows\System32\SaiC0464_11.dll [2004/08/04 08:00:00 | 013,107,200 | ---- | C] () -- C:\windows\System32\oembios.bin [2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat [2004/08/04 08:00:00 | 000,481,662 | ---- | C] () -- C:\windows\System32\perfh009.dat [2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\windows\System32\perfi009.dat [2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\windows\System32\dssec.dat [2004/08/04 08:00:00 | 000,079,736 | ---- | C] () -- C:\windows\System32\perfc009.dat [2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\windows\System32\mib.bin [2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\windows\System32\perfd009.dat [2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\windows\System32\secupd.dat [2004/08/04 08:00:00 | 000,004,461 | ---- | C] () -- C:\windows\System32\oembios.dat [2004/08/04 08:00:00 | 000,001,804 | ---- | C] () -- C:\windows\System32\dcache.bin [2004/08/04 08:00:00 | 000,000,741 | ---- | C] () -- C:\windows\System32\noise.dat [2000/04/12 12:24:10 | 000,338,944 | ---- | C] () -- C:\windows\System32\LFFPX7.DLL [1999/01/22 14:46:58 | 000,065,536 | ---- | C] () -- C:\windows\System32\MSRTEDIT.DLL [1997/09/30 11:30:02 | 000,122,880 | ---- | C] () -- C:\windows\System32\LFKODAK.DLL ========== LOP Check ========== [2012/05/22 13:37:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\CardScan [2011/08/29 11:38:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.adobe.Aflac.STD-ppt-app.59F69CBCBA7543A463CE554A7CC7279B8744C226.1 [2010/05/04 21:49:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.adobe.example.main.52A93B964BBEB0902CC01E05810570B8BA16AEC8.1 [2009/06/27 11:48:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2012/01/03 17:20:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.aflac.launchpad.desktop [2009/12/08 16:44:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.cbs.himym.desktop.E9E67C1457924EABBA27327D1BAF79E9B78ADD40.1 [2009/09/15 21:38:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\deskPDF [2009/10/19 15:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\DMS [2012/07/27 21:18:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Downloaded Installations [2013/05/03 18:17:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Dropbox [2010/02/07 11:40:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Facebook [2012/05/11 15:07:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Firefly Studios [2012/08/02 18:33:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Garmin [2011/12/09 21:35:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\GetRightToGo [2012/09/30 19:15:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Hemera [2012/06/25 21:55:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\HexWar Launcher [2013/01/26 23:07:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Hoyle [2011/01/22 09:34:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Hoyle FaceCreator [2010/07/28 23:59:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\ieSpell [2013/03/22 22:54:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\ilividtoolbargaw [2010/09/02 20:50:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\InterTrust [2009/06/27 19:10:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Leadertech [2013/05/03 15:11:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\mjusbsp [2009/06/27 10:53:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\OfficeUpdate12 [2010/07/21 13:19:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\OpenOffice.org [2012/10/25 15:09:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\PC-FAX TX [2011/06/02 12:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\PrimoPDF [2011/05/17 17:58:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Research In Motion [2012/11/17 17:06:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\TechWizard [2012/12/13 09:24:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\TestApp [2011/05/27 19:42:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\The Creative Assembly [2009/10/04 20:26:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\ubi.com [2011/11/04 11:45:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\webex [2012/10/27 17:13:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2010/05/03 15:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications [2009/10/02 17:42:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Carbonite [2013/03/22 22:51:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Datamngr [2011/01/22 09:20:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Encore [2012/05/11 15:05:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Firefly Studios [2012/07/08 16:21:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\magicJack [2011/02/27 16:58:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Saitek [2013/02/27 19:45:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartTechnology [2013/05/03 18:21:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2010/04/01 15:57:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009/09/09 22:17:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2013/05/03 18:18:30 | 000,000,312 | -HS- | M] () -- C:\windows\Tasks\vfbxrjfrel.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2009/06/26 20:13:15 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2009/06/26 20:13:15 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt [2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt [2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt [2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini [2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe [2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini [2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll [2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll [2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll [2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll [2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll [2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll [2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll [2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll [2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll [2009/06/26 20:13:15 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2011/12/20 23:18:42 | 000,002,152 | ---- | M] () -- C:\log.txt [2009/06/26 20:13:15 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2004/08/04 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2009/06/26 21:36:44 | 000,250,048 | RHS- | M] () -- C:\ntldr [2013/05/03 18:18:17 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys [2013/04/19 12:46:44 | 000,109,068 | ---- | M] () -- C:\Spec.log [2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp [2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab [2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI [1 C:\*.tmp files -> C:\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2004/08/04 08:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe < MD5 for: SERVICES.EXE > [2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe [2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe [2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe [2009/02/06 13:14:03 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\$NtServicePackUninstall$\services.exe [2009/02/06 06:22:21 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe [2004/08/04 08:00:00 | 000,108,032 | ---- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtUninstallKB956572_0$\services.exe < MD5 for: USERINIT.EXE > [2004/08/04 08:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2004/08/04 08:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe ========== Alternate Data Streams ========== @Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 @Alternate Data Stream - 142 bytes -> C:\windows\system32:,
  11. I have been infected by the 'Department of Justice' malware locking up my computer and demanding money to unlock it. Apparently this is a varient of similar infections purporting to be from the FBI, DHS etc. Cannot start in any Safe Mode. I have only a short time between bootup and the point where the virus takes over. I can get to Chameleon, but there is not enough time to check for updates before the virus takes over. Any suggestions?
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.