Hope someone can help. I know my PC is infected as IE8 goes to fictitious sites. I've tried a number of time running mbam-setup.exe, but it extracts files, but never finishes. The resulting program won't run. I've tried to follow the instructions in "I'm Infected" , but will limited success. First, Defogger executes and goes to "OK", but never asks to reboot - I rebooted anyhow. I was able to run DDS and will attach the files as asked for below. My PC is so sick that I won't fully run GMER Rootkit before locking up - GMER taks more than 1 hour. I copied and saves the first part of GMER and will past it below - it showed some items in "red" entitled "library". I will still try to get a full GMER scan and post it if and when I'm able to. I will appreciate any help or advice. Thanks, Jim. DDS.txt: DDS (Ver_09-12-01.01) - NTFSx86 Run by HP_Administrator at 6:26:05.78 on Tue 01/05/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1483 [GMT -7:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\windows\system32\svchost -k DcomLaunch svchost.exe C:\windows\system32\svchost.exe -k netsvcs C:\Program Files\Panda Security\Panda Global Protection 2010\TPSrv.exe C:\windows\system32\svchost.exe -k WudfServiceGroup C:\PROGRAM FILES\PANDA SECURITY\PANDA GLOBAL PROTECTION 2010\WebProxy.exe svchost.exe svchost.exe C:\windows\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\arservice.exe C:\windows\system32\cisvc.exe C:\windows\eHome\ehRecvr.exe C:\windows\eHome\ehSched.exe C:\windows\Explorer.EXE C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe C:\windows\ARPWRMSG.EXE C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\windows\RTHDCPL.EXE C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Panda Security\Panda Global Protection 2010\APVXDWIN.EXE C:\windows\system32\rundll32.exe C:\Documents and Settings\HP_Administrator\My Documents\My Downloads\KnockOut.exe C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe C:\windows\system32\svchost -k Panda C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\windows\system32\nvsvc32.exe C:\Program Files\Panda Security\Panda Global Protection 2010\PsCtrls.exe C:\Program Files\Panda Security\Panda Global Protection 2010\PavFnSvr.exe C:\WINDOWS\system32\PSIService.exe c:\program files\panda security\panda global protection 2010\firewall\PSHOST.EXE C:\Program Files\Panda Security\Panda Global Protection 2010\PsImSvc.exe C:\Program Files\Panda Security\Panda Global Protection 2010\PskSvc.exe svchost.exe C:\windows\system32\svchost.exe -k imgsvc C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\windows\system32\wuauclt.exe C:\windows\eHome\ehmsas.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\imapi.exe C:\Documents and Settings\HP_Administrator\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://my.yahoo.com/ uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll BHO: {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - No File BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0988.2\msneshellx.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uRun: [Companion for Microsoft Outlook] "c:\documents and settings\hp_administrator\my documents\my downloads\KnockOut.exe" uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe" mRun: [WinPatrol] "c:\program files\billp studios\winpatrol\winpatrol.exe" -expressboot mRun: [Recguard] "c:\windows\sminst\RECGUARD.EXE" mRun: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [ftutil2] "rundll32.exe" ftutil2.dll,SetWriteCacheMode mRun: [ehTray] "c:\windows\ehome\ehtray.exe" mRun: [DMAScheduler] "c:\program files\hp digitalmedia archive\DMAScheduler.exe" mRun: [AlwaysReady Power Message APP] "ARPWRMSG.EXE" mRun: [AcronisTimounterMonitor] "c:\program files\acronis\trueimagehome\TimounterMonitor.exe" mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe" mRun: [CanonMyPrinter] "c:\program files\canon\myprinter\BJMyPrt.exe" /logon mRun: [RTHDCPL] "RTHDCPL.EXE" mRun: [Alcmtr] "ALCMTR.EXE" mRun: [TrueImageMonitor.exe] "c:\program files\acronis\trueimagehome\TrueImageMonitor.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [APVXDWIN] "c:\program files\panda security\panda global protection 2010\APVXDWIN.EXE" /s mRun: [sCANINICIO] "c:\program files\panda security\panda global protection 2010\Inicio.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxp://lms.jetnet.aa.com/wbt/res/cab/awswaxd.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab DPF: {62789780-B744-11D0-986B-00609731A21D} - hxxp://vanmappub.vancouver.ca/download/mgaxctrl.cab DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219279867703 DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} - hxxp://web1.shutterfly.com/downloads/Uploader.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5093/mcfscan.cab DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} - hxxp://photos.msn.com/resources/neutral/controls/DigWebX2.cab?10,0,910,0 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: avldr - avldr.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll LSA: Authentication Packages = msv1_0 relog_ap LSA: Notification Packages = scecli scecli ============= SERVICES / DRIVERS =============== R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2010-1-3 28552] R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-4-21 29808] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2010-1-3 75016] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2010-1-3 53128] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2010-1-3 22072] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2010-1-3 193800] R1 IsDrv118;IsDrv118;c:\windows\system32\drivers\IsDrv118.sys [2007-12-17 160955] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2010-1-3 159112] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2010-1-3 46728] R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k panda --> c:\windows\system32\svchost -k Panda [?] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 Panda Software Controller;Panda Software Controller;c:\program files\panda security\panda global protection 2010\PsCtrlS.exe [2010-1-3 173312] R2 PAVDRV;pavdrv;c:\windows\system32\drivers\pavdrv51.sys [2010-1-3 84024] R2 PAVFNSVR;Panda Function Service;c:\program files\panda security\panda global protection 2010\PavFnSvr.exe [2010-1-3 169216] R2 PskSvcRetail;Panda PSK service;c:\program files\panda security\panda global protection 2010\psksvc.exe [2010-1-3 28928] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008] R3 CXFALCON;Conexant Falcon II NTSC Video Capture;c:\windows\system32\drivers\cxfalcon.sys [2006-9-13 82048] R3 NETIMFLT01060039;PANDA NDIS IM Filter Miniport v1.6.0.39;c:\windows\system32\drivers\neti1639.sys [2010-1-3 199432] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\pavtpk.sys --> c:\windows\system32\PavTPK.sys [?] S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?] S1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys --> c:\windows\system32\drivers\mfehidk.sys [?] S2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-2-10 234888] S2 Ca533av;Icatch(IV) Video Camera Device;c:\windows\system32\drivers\Ca533av.sys [2009-10-23 515803] S2 gupdate1c9923b258d1ae0;Google Update Service (gupdate1c9923b258d1ae0);c:\program files\google\update\GoogleUpdate.exe [2009-2-18 133104] S2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-7-30 359952] S2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe --> c:\progra~1\mcafee\viruss~1\mcshield.exe [?] S2 PAVSRV;Panda On-Access Anti-Malware Service;c:\program files\panda security\panda global protection 2010\PAVSRV51.EXE [2010-1-3 291584] S2 VG6000;Actiontec IPW;c:\windows\system32\drivers\vg6000.sys --> c:\windows\system32\drivers\vg6000.sys [?] S2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;"c:\program files\webroot\spy sweeper\spysweeper.exe" --> c:\program files\webroot\spy sweeper\SpySweeper.exe [?] S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-1-3 30104] S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-1-3 30104] S3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe --> c:\progra~1\mcafee\viruss~1\mcsysmon.exe [?] S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys --> c:\windows\system32\drivers\mfeavfk.sys [?] S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys --> c:\windows\system32\drivers\mfebopk.sys [?] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys --> c:\windows\system32\drivers\mferkdk.sys [?] S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys --> c:\windows\system32\drivers\mfesmfk.sys [?] ============== File Associations =============== JSEFile=c:\progra~1\pandas~1\pandag~1\PavScrip.exe "%1" %* VBEFile=c:\progra~1\pandas~1\pandag~1\PavScrip.exe "%1" %* VBSFile=c:\progra~1\pandas~1\pandag~1\PavScrip.exe "%1" %* =============== Created Last 30 ================ 2010-01-05 13:21:30 0 ----a-w- c:\documents and settings\hp_administrator\defogger_reenable 2010-01-05 00:14:55 0 d-----w- c:\program files\james 2010-01-04 22:33:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-04 22:33:01 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-04 22:33:00 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-04 22:00:43 0 d-----w- c:\windows\ServicePackFiles 2010-01-04 18:25:12 333952 ------w- c:\windows\system32\dllcache\srv.sys 2010-01-04 18:22:47 455296 ------w- c:\windows\system32\dllcache\mrxsmb.sys 2010-01-04 18:22:31 1315328 ------w- c:\windows\system32\dllcache\msoe.dll 2010-01-04 18:21:44 337408 ------w- c:\windows\system32\dllcache\netapi32.dll 2010-01-04 18:21:32 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2010-01-04 17:53:21 0 dc-h--w- c:\windows\ie8 2010-01-04 00:11:07 0 d-----w- c:\program files\CCleaner 2010-01-03 15:14:31 8627 ----a-w- c:\windows\system32\PAV_FOG.OPC 2010-01-03 15:02:20 0 d-----w- c:\docume~1\alluse~1\applic~1\Backup 2010-01-03 15:01:56 87296 ----a-w- c:\windows\system32\PavLspHook.dll 2010-01-03 15:01:56 55552 ----a-w- c:\windows\system32\pavipc.dll 2010-01-03 15:01:56 193792 ----a-w- c:\windows\system32\TpUtil.dll 2010-01-03 15:01:56 107568 ----a-w- c:\windows\system32\SYSTOOLS.DLL 2010-01-03 15:01:55 518400 ----a-w- c:\windows\system32\PavSHook.dll 2010-01-03 15:01:54 84024 ----a-w- c:\windows\system32\drivers\pavdrv51.sys 2010-01-03 15:01:54 58672 ----a-w- c:\windows\system32\avldr.dll 2010-01-03 15:01:54 199432 ----a-w- c:\windows\system32\drivers\neti1639.sys 2010-01-03 15:01:54 0 d-----w- c:\windows\system32\PAV 2010-01-03 15:01:54 0 d-----w- c:\program files\Panda Security 2010-01-03 15:01:54 0 d-----w- c:\docume~1\hp_adm~1\applic~1\Panda Security 2010-01-03 15:01:54 0 d-----w- c:\docume~1\alluse~1\applic~1\Panda Security 2010-01-03 14:59:55 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys 2010-01-03 14:20:00 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar 2010-01-03 14:19:28 50968 ----a-w- c:\windows\system32\avgfwdx.dll 2010-01-03 14:19:28 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys 2010-01-03 01:21:56 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9 2010-01-03 00:22:30 0 d-----w- c:\program files\AVG 2010-01-03 00:12:27 0 d-----w- c:\docume~1\hp_adm~1\applic~1\AVG8 2010-01-02 13:38:28 0 d-----w- c:\docume~1\alluse~1\applic~1\Intuit 2010-01-02 13:38:28 0 d-----w- c:\docume~1\alluse~1\applic~1\CanonIJPLM 2010-01-02 05:40:35 8212 ----a-w- c:\windows\mfebcdata 2010-01-02 05:02:03 561 ----a-w- c:\windows\system32\krl32mainweq.dll 2010-01-02 05:01:01 246 ----a-w- c:\windows\system32\srcr.dat 2009-12-28 23:43:07 3523872 ----a-w- c:\windows\system32\cdintf300.dll 2009-12-28 23:41:50 0 d-----w- c:\program files\Quicken 2009-12-28 23:41:40 165 ----a-w- c:\windows\QUICKEN.INI 2009-12-27 22:31:18 0 d-----w- c:\docume~1\hp_adm~1\applic~1\Windows Search 2009-12-26 19:38:11 28288 ----a-w- c:\windows\system32\dllcache\grserial.sys 2009-12-26 19:38:09 82304 ----a-w- c:\windows\system32\dllcache\grclass.sys 2009-12-26 19:38:07 17408 ----a-w- c:\windows\system32\dllcache\gpr400.sys 2009-12-26 19:38:05 59136 ----a-w- c:\windows\system32\dllcache\gckernel.sys 2009-12-26 19:38:04 10624 ----a-w- c:\windows\system32\dllcache\gameenum.sys 2009-12-26 19:38:02 322432 ----a-w- c:\windows\system32\dllcache\g400m.sys 2009-12-26 19:38:00 1733120 ----a-w- c:\windows\system32\dllcache\g400d.dll 2009-12-26 19:36:57 347550 ----a-w- c:\windows\system32\dllcache\es56tpi.sys 2009-12-26 19:35:56 20992 ----a-w- c:\windows\system32\dllcache\dshowext.ax 2009-12-26 19:34:57 419357 ----a-w- c:\windows\system32\dllcache\dgconfig.dll 2009-12-26 19:33:59 44032 ----a-w- c:\windows\system32\dllcache\cnusd.dll 2009-12-26 19:32:53 13824 ----a-w- c:\windows\system32\dllcache\bulltlp3.sys 2009-12-26 19:31:59 26496 ----a-w- c:\windows\system32\dllcache\asc.sys 2009-12-26 19:16:03 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll 2009-12-26 19:00:34 0 d-----w- c:\program files\common files\AnswerWorks 5.0 ==================== Find3M ==================== 2010-01-03 15:02:36 197400 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT.bck 2010-01-03 15:02:36 197400 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT 2010-01-03 15:02:36 1132 ----a-w- c:\windows\system32\drivers\APPFLTR.CFG.bck 2010-01-03 15:02:36 1132 ----a-w- c:\windows\system32\drivers\APPFLTR.CFG 2010-01-01 16:20:06 5018 --sha-w- c:\windows\system32\KGyGaAvL.sys 2009-10-28 14:40:47 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe 2009-10-21 12:14:46 238368 ----a-w- c:\windows\fonts\spranq_eco_sans_regular.ttf 2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:38:36 75776 ------w- c:\windows\system32\dllcache\strmfilt.dll 2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll 2009-10-21 05:38:36 25088 ------w- c:\windows\system32\dllcache\httpapi.dll 2009-10-20 16:20:16 265728 ------w- c:\windows\system32\dllcache\http.sys 2009-10-13 10:30:16 270336 ----a-w- c:\windows\system32\oakley.dll 2009-10-13 10:30:16 270336 ------w- c:\windows\system32\dllcache\oakley.dll 2009-10-12 13:38:19 149504 ----a-w- c:\windows\system32\rastls.dll 2009-10-12 13:38:19 149504 ------w- c:\windows\system32\dllcache\rastls.dll 2009-10-12 13:38:18 79872 ----a-w- c:\windows\system32\raschap.dll 2009-10-12 13:38:18 79872 ------w- c:\windows\system32\dllcache\raschap.dll 2009-10-08 21:57:02 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2009-10-08 21:57:00 220160 ----a-w- c:\windows\system32\oleacc.dll 2009-10-08 21:57:00 220160 ----a-w- c:\windows\system32\dllcache\oleacc.dll 2009-10-08 21:56:56 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2009-10-08 21:56:56 20480 ----a-w- c:\windows\system32\dllcache\oleaccrc.dll 2008-05-28 16:52:10 3522600 ----a-w- c:\program files\procexp.exe 2007-03-28 09:01:46 22 --sh--w- c:\windows\sminst\HPCD.SYS 2007-04-25 22:55:28 88 --sh--r- c:\windows\system32\B1FD3D7639.sys ============= FINISH: 6:29:27.26 =============== GMER Scan: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-05 08:31:48 Windows 5.1.2600 Service Pack 3 Running: uqdrzxpd.exe; Driver: C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\pxldipow.sys ---- System - GMER 1.0.15 ---- Code 8A7E59D0 ZwEnumerateKey Code 8A7E56D8 ZwFlushInstructionCache Code 8A7E618E IofCallDriver Code 8A2E8706 IofCompleteRequest ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com)) Device \Driver\Tcpip \Device\Ip 8A7C3020 Device \Driver\Tcpip \Device\Ip 8A5E4990 Device \Driver\Tcpip \Device\Ip 898F01C0 Device \Driver\Tcpip \Device\Ip 8A66B0B0 Device \Driver\Tcpip \Device\Ip 89E016E0 Device \Driver\Tcpip \Device\Ip 8ABBC0C0 Device \Driver\Tcpip \Device\Ip 8AA8C4E8 Device \Driver\Tcpip \Device\Ip 8A81F408 AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Ip NETFLTDI.SYS (Panda TDI Filter/Panda Security, S.L.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IsDrv118.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IsDrv118.sys Device \Driver\Tcpip \Device\Tcp 8A7C3020 Device \Driver\Tcpip \Device\Tcp 8A5E4990 Device \Driver\Tcpip \Device\Tcp 898F01C0 Device \Driver\Tcpip \Device\Tcp 8A66B0B0 Device \Driver\Tcpip \Device\Tcp 89E016E0 Device \Driver\Tcpip \Device\Tcp 8ABBC0C0 Device \Driver\Tcpip \Device\Tcp 8AA8C4E8 Device \Driver\Tcpip \Device\Tcp 8A81F408 AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp NETFLTDI.SYS (Panda TDI Filter/Panda Security, S.L.) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis) Device \Driver\Tcpip \Device\Udp 8A7C3020 Device \Driver\Tcpip \Device\Udp 8A5E4990 Device \Driver\Tcpip \Device\Udp 898F01C0 Device \Driver\Tcpip \Device\Udp 8A66B0B0 Device \Driver\Tcpip \Device\Udp 89E016E0 Device \Driver\Tcpip \Device\Udp 8ABBC0C0 Device \Driver\Tcpip \Device\Udp 8AA8C4E8 Device \Driver\Tcpip \Device\Udp 8A81F408 AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Udp NETFLTDI.SYS (Panda TDI Filter/Panda Security, S.L.) Device \Driver\Tcpip \Device\RawIp 8A7C3020 Device \Driver\Tcpip \Device\RawIp 8A5E4990 Device \Driver\Tcpip \Device\RawIp 898F01C0 Device \Driver\Tcpip \Device\RawIp 8A66B0B0 Device \Driver\Tcpip \Device\RawIp 89E016E0 Device \Driver\Tcpip \Device\RawIp 8ABBC0C0 Device \Driver\Tcpip \Device\RawIp 8AA8C4E8 Device \Driver\Tcpip \Device\RawIp 8A81F408 AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp NETFLTDI.SYS (Panda TDI Filter/Panda Security, S.L.) Device \Driver\Tcpip \Device\IPMULTICAST 8A7C3020 Device \Driver\Tcpip \Device\IPMULTICAST 8A5E4990 Device \Driver\Tcpip \Device\IPMULTICAST 898F01C0 Device \Driver\Tcpip \Device\IPMULTICAST 8A66B0B0 Device \Driver\Tcpip \Device\IPMULTICAST 89E016E0 Device \Driver\Tcpip \Device\IPMULTICAST 8ABBC0C0 Device \Driver\Tcpip \Device\IPMULTICAST 8AA8C4E8 Device \Driver\Tcpip \Device\IPMULTICAST 8A81F408 AttachedDevice \FileSystem\Fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com)) AttachedDevice \FileSystem\Fastfat \Fat pavdrv51.sys (Antivirus Filter Driver for Windows XP/2003 x86/Panda Security, S.L.) ---- Modules - GMER 1.0.15 ---- Module \systemroot\system32\drivers\H8SRTfoawlddqce.sys (*** hidden *** ) B269D000-B26BA000 (118784 bytes) ---- Processes - GMER 1.0.15 ---- Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [408] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [484] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [780] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [1820] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [1948] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [2028] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [2868] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [3356] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\system32\svchost.exe [3512] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [3620] 0x10000000 Library \\?\globalroot\systemroot\system32\H8SRTlnxmvejkkg.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [3620] 0x00C80000 Library \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll (*** hidden *** ) @ C:\windows\Explorer.EXE [3812] 0x10000000 ---- Services - GMER 1.0.15 ---- Service C:\windows\system32\drivers\H8SRTfoawlddqce.sys (*** hidden *** ) [sYSTEM] H8SRTd.sys <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys@start 1 Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys@type 1 Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys@group file system Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys\modules (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbgtmlvkbas.dll Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTopysvdndck.dat Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll Reg HKLM\SYSTEM\ControlSet001\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTlnxmvejkkg.dll Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@start 1 Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@type 1 Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@group file system Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbgtmlvkbas.dll Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTopysvdndck.dat Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTlnxmvejkkg.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbgtmlvkbas.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTopysvdndck.dat Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTlnxmvejkkg.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess\Performance@Error Count 143 Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@start 1 Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@type 1 Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@group file system Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbgtmlvkbas.dll Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTopysvdndck.dat Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTlnxmvejkkg.dll Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys (not active ControlSet) Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys@start 1 Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys@type 1 Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys@group file system Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys\modules (not active ControlSet) Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfoawlddqce.sys Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbgtmlvkbas.dll Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTopysvdndck.dat Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTkkrlhudcri.dll Reg HKLM\SYSTEM\ControlSet005\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTlnxmvejkkg.dll ---- Files - GMER 1.0.15 ---- File C:\Documents and Settings\Administrator\Local Settings\Temp\h8srtmainqt.dll 16136 bytes Attach.zip
